Update MCP sdk to latest 1.29

[tdraier]

Description

Update MCP from 1.27.0 to 1.29.0, which includes the fix for the tsc path: modelcontextprotocol/typescript-sdk#1623 — this is the motivation for the upgrade.

1.29.0 is the latest 1.x (anything newer is the 2.0.0-beta prerelease line, which we deliberately avoid). Bumped in all workspaces that depend on it (front, sdks/js, cli/dust-cli, extension) plus the root overrides pin, and regenerated package-lock.json.

Why this is safe

Every change between 1.27.0 and 1.29.0 is a bug fix or v1.x backport — no intentional breaking API changes:

• 1.28.0: use scopes_supported from resource metadata by default; default to client_secret_basic when the server omits token_endpoint_auth_methods_supported; reject plain JSON Schema objects passed as inputSchema (Claude has a max_token issue #1596); timeout/abort cleanup fixes; RFC 8252 loopback port relaxation.
• 1.29.0: disallow null (infinite) requested TTL; add missing size field to ResourceSchema; add typings exports / missing package.json types (the tsc path fix above, feat(assistant builder): add basic avatar picker #1623); allow advertising extensions in the capability object; always set windowsHide on Windows for stdio.

The only behavior-narrowing change, #1596 (tool()/registerTool() now throw if passed a plain JSON Schema instead of a Zod shape), does not affect us: every registerTool call site passes a Zod ZodRawShape (register.ts, mcp_internal_actions/wrappers.ts, extension/shared/tools/index.ts). The plain { type: "object", ... } objects in the codebase are our own config types / mock wire-format Tool objects, never arguments to registerTool.

The auth-default changes are also no-ops for us: remote_mcp_servers_resource.ts already branches explicitly on client_secret_post/client_secret_basic and already prioritizes resource-metadata scopes_supported. No StdioClientTransport usage, so the Windows stdio change is irrelevant.

Tests

npx tsgo --noEmit in front (type-check). No source changes required — dependency bump only.

Risk

Low. Patch/minor bug-fix bump with no breaking API changes affecting our usage. Can be rolled back by reverting the version bump.

Deploy Plan

deploy front

[tdraier]

This change is part of the following stack:

• Update MCP sdk to latest 1.29 #29459 ◀

_{Change managed by git-spice.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
playground	Ignored	Preview	Jul 24, 2026 9:46am
storybook	Ignored	Preview	Jul 24, 2026 9:46am

[dust-agent]

Coding Rules LGTM \o/

[Fraggle]

Looks reasonnable.