mcp-sdk-audit
Absorbing a @modelcontextprotocol/server release into Figwright, end to end: audit → upgrade → prove
the wire contract is unchanged.
Do not reason about this the way figma-typings-audit reasons about plugin typings. That package
is types-only, so tsc is a real gate. This one is a runtime dependency: it serializes every
tool result, generates the JSON Schema for all ~112 tools, and negotiates the protocol version. A
release can leave every type identical and still change what clients see. pnpm typecheck will stay
green through it.
Unlike every other dependency here, this one has a dedicated gate — use it.
packages/mcp/test/e2e/mcp-wire.test.ts spawns the built dist over real stdio, speaks raw
JSON-RPC at it, and asserts the advertised contract against what the specs declare. It runs in
pnpm test. That gate answers did anything break; it does not answer what moved, which is what
an audit is for — Stage 5 covers the difference.
Target version: whatever the user named, otherwise the latest @modelcontextprotocol/server on npm.