Skip to content

chore(mcp): add express deps for SDK auth router migration#1140

Merged
kunickiaj merged 1 commit into
mainfrom
b20m.1-mcp-express-deps
May 24, 2026
Merged

chore(mcp): add express deps for SDK auth router migration#1140
kunickiaj merged 1 commit into
mainfrom
b20m.1-mcp-express-deps

Conversation

@kunickiaj
Copy link
Copy Markdown
Owner

@kunickiaj kunickiaj commented May 23, 2026

Description

Adds Express and Express type dependencies required for the upcoming @modelcontextprotocol/sdk mcpAuthRouter migration. Also aligns repo-owned @types/node pins with the already-decided runtime floor (engines.node >=24) so TypeScript does not validate published packages against Node 25-only APIs.

Type of Change

  • 🚀 Feature (new functionality)
  • 🐛 Bug fix (fixes an issue)
  • 📚 Documentation (docs-only change)
  • 🔧 Maintenance (refactor, chore, CI, etc.)
  • 🧪 Testing (test-only changes)

Testing

  • Relevant checks pass locally (pnpm run tsc, pnpm run lint, pnpm run test)
  • Added/updated tests for changes
  • Manually verified changes work as expected

Checklist

  • Code follows project style (pnpm run lint passes for touched files)
  • Self-review completed
  • Documentation updated (if needed)
  • No new warnings introduced

Copy link
Copy Markdown
Owner Author

kunickiaj commented May 23, 2026

Declare express + @types/express as direct deps of packages/mcp-server so the upcoming mcpAuthRouter migration (codemem-b20m.2 onward) can import them explicitly. cors, pkce-challenge, and express-rate-limit remain transitive via @modelcontextprotocol/sdk@1.29.0.

No behavior change; deps-only PR. Validates pnpm install + tsc + lint + test still pass.

Part of codemem-b20m (MCP SDK migration stack).
@kunickiaj kunickiaj marked this pull request as ready for review May 23, 2026 23:02
@kunickiaj kunickiaj force-pushed the b20m.1-mcp-express-deps branch from 490d958 to 319cdb0 Compare May 23, 2026 23:04
@chatgpt-codex-connector
Copy link
Copy Markdown

💡 Codex Review

- `read_write` — principal may read and may write through `memory_remember` and observer ingestion paths into this scope.

P2 Badge Clarify read_write scope to exclude observer ingestion

The role definition says read_write permits writes through both memory_remember and observer ingestion, but the later write-enforcement table says observer ingestion by remote principals is out of scope and owner-only. This contradiction can lead Phase 3 implementers to grant or test an authorization path that the same doc forbids, creating avoidable security and behavior drift across implementations; the role text should match the enforcement section explicitly.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Owner Author

kunickiaj commented May 24, 2026

Merge activity

  • May 24, 1:33 AM UTC: A user started a stack merge that includes this pull request via Graphite.
  • May 24, 1:33 AM UTC: @kunickiaj merged this pull request with Graphite.

@kunickiaj kunickiaj merged commit 1a70e63 into main May 24, 2026
11 checks passed
@kunickiaj kunickiaj deleted the b20m.1-mcp-express-deps branch May 24, 2026 01:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant