Uh oh!
There was an error while loading. Please reload this page.
feat(mcp): migrate to TypeScript SDK v2 via Agents SDK - #1356
Conversation
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
mattzcarey
commented
Jul 24, 2026
Note this isn't using the agents sdk. We can get rid of a bunch of code if we do but it's not released yet. Will be Monday so feel free to wait or merge as you feel like it. |
Summary
Migrate the Supermemory MCP Worker from the v1
@modelcontextprotocol/sdk+agents/mcpDurable Object runtime to the split MCP TypeScript SDK v2 packages,currently
2.0.0-beta.5.The HTTP design follows the request-local, stateless handler used by
cloudflare/mcp, now through thenew isolated
agents/mcp/serverWorker wrapper released in
agents@0.20.0:2026-07-28withcreateMcpHandler();McpServerper HTTP request;x-sm-projectscoping, tools, resources, prompts,PostHog attribution, and the Memory Graph MCP App.
Runtime changes
McpAgent/SupermemoryMCP.serve()with an SDK v2 server factory.createMcpHandlerfromagents/mcp/server, retainingthe Agents Worker lifecycle, legacy-compatibility keepalives, and Origin guard.
/mcpexact-routed and authenticated before MCP dispatch.Mcp-Method,Mcp-Name, and dynamicMcp-Param-*headers work without maintaining a fixed CORS list.Grok, and T3 hosts; reject unapproved Origins before MCP dispatch. Origin-less
desktop/non-browser clients remain valid. Ops can add a newly supported host without
a code change through
ALLOWED_MCP_ORIGIN_HOSTNAMES.sessionId: nullfromwhoAmIbecause the v2 HTTP transport isintentionally stateless.
SupermemoryMCPDurable Object class through a Wrangler v2migration. Its stored data was limited to client identity and a project-list cache;
memories remain in the Supermemory API.
Important
Deploying the
deleted_classesmigration is one-way: Wrangler cannot roll back acrossthat migration boundary. An emergency revert requires a new forward migration, and the
disposable client-identity/project-cache DO data will remain deleted.
Zod v4 migration
SDK v2 requires Zod v4. To avoid mixed schema identities, this PR upgrades every
workspace declaration to
^4.4.3and adds a root^4.4.3override. All JavaScriptlockfiles now resolve exactly one Zod version:
4.4.3.Related migrations:
zod-openapi4 → 6 and.openapi()→ native Zod v4.meta();z.record(value)→z.record(z.string(), value);@hono/zod-validator,drizzle-zod,hono-openapi) and theatmnCLI moved to current v4-compatible releases;second Zod version.
MCP Apps note
@modelcontextprotocol/ext-apps@1.7.5has not published its SDK-v2 migration yet(upstream work). It remains
a browser-build-only dev dependency with its v1 peer. The server-side App tool/resource
metadata is registered directly on the v2
McpServer. A Wrangler metafile check confirmsthe Worker contains only the isolated
agents/mcp/serverstateless wrapper plus SDK v2;SDK v1,
McpAgent, WorkerTransport, PartyServer, and MCP client modules stay out.Validation
bun install --frozen-lockfilebun run check:zod→Single Zod resolution: 4.4.3bun test packages/validation/api.test.ts→ 11 passedbunx vitest run packages/tools/src/tools-shared.test.ts packages/tools/src/tool-operations.test.ts→ 21 passedbunx turbo run check-types --filter='@supermemory/ai-sdk' --filter='@supermemory/memory-graph'→ passedcd apps/mcp && bun run check→ typecheck, UI build, 18 protocol/unit tests passedcd apps/mcp && bunx vitest run e2e/auth.test.ts→ 4 public deployed-server auth tests passedcd packages/memory-graph && bunx vitest run→ 195 passedcd apps/mcp && bunx wrangler deploy --dry-run --minify→ successful,1544.91 KiB raw / 403.98 KiB gzip
no SDK v1,
McpAgent, WorkerTransport, PartyServer, or MCP client runtime modulesAuthenticated memory e2e suites remain opt-in and skip without
SUPERMEMORY_API_KEY, as before.apps/webis not typecheck-clean on currentmain(125 existing diagnostics), so itcannot be added to the CI typecheck filter in this PR. A manual compile showed no
Zod-specific diagnostics after the migration; shared API/validation modules compile
standalone, and their v4 default/record/OpenAPI behavior is covered by the new tests.
Automated review
Re-reviewed read-only with
claude-fable-5at low effort after theagents/mcp/serverfollow-up. It found no P0/P1 issues and judged the PR ready forhuman review. Its actionable compatibility finding (a hard-coded browser Origin list)
was addressed by the documented
ALLOWED_MCP_ORIGIN_HOSTNAMESoperational override;malformed optional
MCP_URLvalues are also guarded. Remaining P3 notes are theintentional request-local authenticated handler lifecycle and the documented analytics
shift from stateful session IDs to stateless request metadata.