[johnxie]

Summary

This PR applies the security updates of #81 and moves @modelcontextprotocol/sdk to 1.32.1. It keeps one zod copy in node_modules and in bin/cli.mjs. It closes 72 of the 124 open Dependabot alerts, and every open alert with runtime scope. The 62 stdio and HTTP tools keep the same names and order.

Supersedes #81.

Why

• chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates #81 alone resolves the SDK zod range (^3.25 || ^4.0) to a second zod (4.6.1) next to the zod 3.25.28 of packages/server. With two zod copies, tsc --noEmit -p packages/server runs out of memory at the 4 GB heap limit after about 2.5 minutes, and bin/cli.mjs grows from 564 KB to 1.25 MB.
• chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates #81 stops at SDK 1.30. Alerts #142, #160, #161 and #162 need SDK 1.31 or 1.32.
• chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates #81 leaves fast-uri at 3.1.7 (#137 needs 3.1.8), proxy-addr at 2.0.7 (#159, critical, runtime) and handlebars at 4.7.9 (#144 and #147, critical).
• With SDK 1.32 types, tsc rejects capabilities in the serverInfo argument of McpServer (TS2353 at packages/server/src/server.ts:19).

What changes

Files	Change
yarn.lock	The lockfile of #81, plus: SDK 1.32.1 for every range (^1.11.4 from mcp-proxy and ^1.32.1), zod ^3.25 || ^4.0 folded into zod 3.25.28, fast-uri 3.1.9, handlebars 4.7.10, proxy-addr 2.0.8, ip-address 10.7.4. Each patched version is inside the existing range, so the PR adds no resolutions. qs stays at 6.16.0 from #81, which is the patched version for #126.
packages/server/package.json, packages/openapi-codegen/package.json	@modelcontextprotocol/sdk ^1.12.0 to ^1.32.1 (devDependencies in both).
packages/server/src/server.ts	The constructor passes only { name, version }. McpServer advertises the tools capability when the first tool is registered.
packages/server/src/server.test.ts	One test pins the capabilities (tools only) and the serverInfo (name, version). It fails on main, because main echoes capabilities inside serverInfo.
.changeset/server-sdk-1-32.md	Patch for @taskade/mcp-server.

ip-address: #81 adds ip-address 10.7.0 (through express-rate-limit 8 in the SDK), and 10.7.0 is inside the range of #136. This PR moves it to 10.7.4.

Note on resources: the task asked to move capabilities (with resources: {}) to the options argument. I tested that build. The initialize response then lists resources, but resources/list answers -32601 Method not found, because the server registers no resource. A client that reads the capability calls resources/list and gets an error. This PR thus advertises no resources capability. That is the same capability set as main.

Zero-regression evidence

Check	main e7bf36f	#81 head fffecce (gate run)	This PR
yarn install --frozen-lockfile	pass	pass	pass
yarn build, then git status	pass, clean	pass, clean	pass, clean
yarn lint	pass	pass	pass
yarn test	23 passed	19 passed (older base)	24 passed (1 new)
tsc --noEmit -p packages/server	pass, 1.05 s	out of memory at 4 GB	pass, 0.76 s
stdio tools/list	62 tools	62 tools	62 tools, same names, same order
HTTP /stream tools/list (src/http.ts)	62 tools	62 tools	62 tools, same names and order (md5 of the name list equal)
bin/cli.mjs size	564,203 B	1,254,069 B	1,066,166 B
yarn why zod	3.25.28	3.25.28 + 4.6.1	3.25.28 only
Codegen pack smoke test (CI step)	pass	n/a	pass
stdio probe on Node 20.20.2 (CI Node major)	n/a	n/a	62 tools, same as on Node 22

The bundle grows by about 500 KB because SDK 1.32 validates with ajv (212 KB with fast-uri) and imports more of zod and of the SDK itself. The bundle now holds @modelcontextprotocol/sdk, ajv, ajv-formats, fast-uri, zod, zod-to-json-schema, node-fetch and its polyfills.

Changes that come from the SDK and that a client can see:

Area	main (SDK 1.12.1)	This PR (SDK 1.32.1)
Negotiated protocol for a 2025-11-25 client	2025-03-26	2025-11-25
Negotiated protocol for a 2025-06-18 client	2025-03-26	2025-06-18
Negotiated protocol for a 2024-11-05 client	2024-11-05	2024-11-05
initialize capabilities	{ tools: { listChanged: true } }	same
initialize serverInfo	{ name, version, capabilities: {...} }	{ name, version }
Tool call with invalid arguments, or an unknown tool	JSON-RPC error -32602	tool result with isError: true and the message MCP error -32602: Input validation error: ...
Tool call that reaches the API	unchanged	unchanged (same 401 text with a dummy key)
Each tool in tools/list	no execution field	execution: { taskSupport: "forbidden" }
workspacesGet input schema (no arguments)	additionalProperties: false	required: []

The other 61 input schemas are byte-equal.

Dependabot alerts

Closed by this PR (72, computed from the open alerts and the versions in yarn.lock):

Package	Scope	Alerts
@modelcontextprotocol/sdk	runtime	#10, #16, #89, #142, #160, #161, #162
fast-uri	runtime	#105, #106, #115, #121, #122, #127, #128, #134, #137
proxy-addr	runtime	#159
qs	runtime	#11, #17, #73, #126
path-to-regexp	runtime	#49, #50
body-parser	runtime	#9, #104
ajv	runtime	#20
handlebars	development	#41, #44, #45, #47, #48, #51, #52, #143, #144, #147
axios	development	23 alerts (#19 to #154)
form-data	development	#3, #84
lodash	development	#14, #53, #54
shell-quote	development	#82, #96
postcss	development	#107, #114
flatted, follow-redirects, picomatch, postcss-selector-parser	development	#37, #55, #40, #125

Still open (52, all development scope, out of the scope of this PR): nx, vite, vitest and @vitest/mocker, js-yaml, tar, minimatch, brace-expansion, ip-address 9.0.5, glob, tmp, uuid, sigstore, @sigstore/core, source-map-js, postcss-selector-parser #148 (needs 7.x), http-cache-semantics #141 (no patch).

Rollback

Revert the merge commit. The release workflow then publishes the next patch with SDK 1.12.1. No data and no config depend on this change.

QA

Step	Action	Expected
1	yarn install --frozen-lockfile && yarn build && git status --short	Build passes. Nothing changes.
2	yarn lint && yarn test	Pass, 24 tests.
3	time npx tsc --noEmit -p packages/server	Pass in a few seconds, no TS2353.
4	yarn why zod	One version, 3.25.28.
5	TASKADE_API_KEY=<key> node packages/server/bin/cli.mjs, then send initialize and tools/list	protocolVersion equals the version that the client sent (up to 2025-11-25), capabilities lists only tools, 62 tools.
6	Call projectGet with {}	Tool result with isError: true that names projectId.
7	PORT=3000 npx tsx packages/server/src/http.ts, then initialize and tools/list on /stream?access_token=<key>	62 tools. Stop the server after the check.
8	Add the server to a client (npx @taskade/mcp-server from a local pack) and call workspacesGet with a real key	The workspaces list returns.

[changeset-bot]

🦋 Changeset detected

Latest commit: f6397b4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@taskade/mcp-server	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[johnxie]

@deanzaka This PR replaces Dependabot #81. It moves the bundled MCP SDK from 1.12.1 to 1.32.1 and keeps one zod copy, so tsc for packages/server passes in under 1 second again (with #81 alone it runs out of memory). It closes 72 Dependabot alerts, and every open alert with runtime scope (SDK, fast-uri, proxy-addr, qs, path-to-regexp, body-parser, ajv). A user of npx @taskade/mcp-server sees the same 62 tools. Only the error shape for a bad tool call changes: it is now a tool result that the model can read.

Before and after: a developer runs the stdio server

BEFORE (main, SDK 1.12.1)                        AFTER (this PR, SDK 1.32.1)
npx @taskade/mcp-server                          npx @taskade/mcp-server
  |                                                |
  v                                                v
initialize                                       initialize
  protocol 2025-03-26 (newest it knows)           protocol = the client's, up to 2025-11-25
  capabilities { tools }                           capabilities { tools }
  serverInfo { name, version, capabilities }       serverInfo { name, version }
  |                                                |
  v                                                v
tools/list -> 62 tools                           tools/list -> same 62 tools, same order
  |                                                |
  v                                                v
projectGet {}                                    projectGet {}
  -> JSON-RPC error -32602                         -> result isError: true
     (the model sees a failed request)                "Invalid arguments ... Required at projectId"
                                                      (the model reads it and retries)

Before and after: a contributor type-checks the server

#81 alone (two zod copies)                       This PR (one zod copy)
tsc --noEmit -p packages/server                  tsc --noEmit -p packages/server
  |                                                |
  v                                                v
~2.5 min, then                                   0.76 s, 0 errors
FATAL ERROR: JavaScript heap out of memory
bin/cli.mjs 1,254,069 B                          bin/cli.mjs 1,066,166 B (main 564,203 B)

QA

Step	Action	Expected	Where
1	yarn install --frozen-lockfile && yarn build && git status --short	Build passes, nothing changes	PR branch checkout
2	yarn lint && yarn test	Pass, 24 tests	PR branch checkout
3	time npx tsc --noEmit -p packages/server	Pass in a few seconds	PR branch checkout
4	yarn why zod	Only 3.25.28	PR branch checkout
5	Run node packages/server/bin/cli.mjs with TASKADE_API_KEY, send initialize and tools/list	Protocol equals the client's version (up to 2025-11-25), capabilities lists only tools, 62 tools	Terminal (stdio)
6	Call projectGet with {}	Tool result with isError: true that names projectId	Terminal (stdio)
7	PORT=3000 npx tsx packages/server/src/http.ts, then initialize and tools/list on /stream?access_token=<key>	62 tools, then stop the server	Terminal (HTTP)
8	Add the local pack to an MCP client and call workspacesGet with a real key	The workspaces list returns	Cursor or another MCP client
9	After merge, open the Dependabot alerts page	The 72 alerts in the PR body show as fixed	github.com/taskade/mcp/security/dependabot

[johnxie]

Code review

Found 1 issue:

1. The changeset says the server negotiates MCP protocol version 2025-06-18. SDK 1.32.1 echoes the version that the client asks for when it is in SUPPORTED_PROTOCOL_VERSIONS (2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05, 2024-10-07), and answers 2025-11-25 otherwise. A stdio probe confirms it: a 2025-11-25 client gets 2025-11-25 (main answers 2025-03-26), and a 2024-11-05 client gets 2024-11-05. The text goes into the published changelog. (bug due to .changeset/server-sdk-1-32.md: "The server negotiates MCP protocol version 2025-06-18.")

mcp/.changeset/server-sdk-1-32.md

Lines 1 to 5 in eefdfa2

	---
	"@taskade/mcp-server": patch
	---
	Bundle `@modelcontextprotocol/sdk` 1.32.1 (was 1.12.1) with one copy of zod (3.25.28). The SDK now validates with `ajv`, so the bundle also holds the patched `fast-uri` 3.1.9. The server negotiates MCP protocol version `2025-06-18`. A tool call with invalid arguments, or with an unknown tool name, now returns a tool result with `isError: true` instead of a JSON-RPC error, so the model can read the message and correct the call. The tool names and their order do not change. The `initialize` response no longer echoes an unused `capabilities` object inside `serverInfo`.

[Copilot]

🔵 Needs a closer look

The broad runtime dependency upgrade warrants human confirmation of the reported compatibility and security checks despite no identified blocking defects.

No open issues 🎉

What changed in this PR

Updates the Taskade MCP server to SDK 1.32.1 and applies dependency security updates while retaining a single zod version and the existing 62-tool interface.

Changes:

• Upgrades SDK dependencies in both packages and refreshes the lockfile with patched transitive dependencies.
• Removes unused capabilities from server metadata and adds a regression test for the initialization response.
• Adds a server patch changeset documenting the dependency and protocol behavior changes.

File	Description
yarn.lock	Updates dependencies and consolidates SDK and zod resolutions.
packages/​server/​src/​server.ts	Limits server metadata to name and version.
packages/​server/​src/​server.test.ts	Checks tools-only capabilities and server metadata.
packages/​server/​package.json	Raises the SDK requirement to ^1.32.1.
packages/​openapi-codegen/​package.json	Aligns the codegen SDK requirement with the server.
.changeset/​server-sdk-1-32.md	Documents the server patch release and observable behavior changes.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking issues remain, and reported lockfile consistency checks, regression checks, and CI results support approval.

No open issues 🎉

_{Review effort: Balanced}