Conversation
- Move RequestTaskStore import to shared/protocol.js (relocated in 1.29) - Narrow sendProgress notification type to match stricter sendNotification signature - Verified against MongoDB 8.2.11 replica set: initialize negotiates 2025-11-25, all capabilities intact, tools/call working
Input validation and MongoDB runtime errors now return isError results so the model can self-correct; unknown tool names remain protocol errors (InvalidParams) and cancellation still propagates as AbortError.
…ion) Invalid origins now receive 403 Forbidden as required by the Streamable HTTP spec. Localhost origins and non-browser clients (no Origin header) are allowed by default; additional origins can be granted via --allowed-origins or MCP_HTTP_ALLOWED_ORIGINS.
… 26) zod is unused in src and only satisfies the SDK peer range; typescript stays on 5.9 pending TS7 ecosystem support, inspector stays on 0.19. Verified via MCP against all 7 test variants (4.4 through 8.2, RS, TLS).
Forces patched versions of 13 transitive packages (shell-quote, qs, hono, ws, express-rate-limit and others), reducing audit findings from 57 (1 critical, 16 high) to 3 moderate. Remaining findings need upstream SDK updates (hono 2.x major, dual-major ajv tree).
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR brings the server into full compliance with the MCP 2025-11-25 specification, hardens the HTTP transport, and updates all dependencies including a transitive security cleanup. Version bumped to 2.1.0.
Spec compliance (2025-11-25)
isError: true) instead of protocol errors, so models can see the failure and self-correct. Unknown tool names remain protocol errors (-32602InvalidParams) and cancellation still propagates asAbortError.title,descriptionandwebsiteUrlto the server info returned duringinitialize.Security
403 Forbiddenas required by the Streamable HTTP spec. Non-browser clients (no Origin header) and localhost origins are allowed by default; additional origins can be granted via--allowed-originsorMCP_HTTP_ALLOWED_ORIGINS.bun auditfindings from 57 (1 critical, 16 high) to 3 moderate. The remaining findings require upstream SDK updates.Dependencies
@modelcontextprotocol/sdk1.26 → 1.29 (adapted to the relocatedRequestTaskStoreand strictersendNotificationtyping)mongodb7.1 → 7.5,zod3 → 4,@biomejs/biome2.3 → 2.5,@types/node25 → 26,@modelcontextprotocol/inspector0.19 → 1.0Testing