chore(deps): Update the MCP SDK to 1.32.1 with one zod copy, and apply the 11 security updates from #81

.changeset/server-sdk-1-32.md

@@ -0,0 +1,5 @@
+---
+"@taskade/mcp-server": patch
+---
+
+Bundle `@modelcontextprotocol/sdk` 1.32.1 (was 1.12.1) with one copy of zod (3.25.28). The server accepts MCP protocol versions up to `2025-11-25`. A tool call with invalid arguments, or with an unknown tool name, now returns a tool result with `isError: true` instead of a JSON-RPC error, so the model can read the message and correct the call. The tool names and their order do not change. The `initialize` response no longer echoes an unused `capabilities` object inside `serverInfo`.

packages/openapi-codegen/package.json

@@ -35,7 +35,7 @@
     "prettier": "^3.5.3"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@readme/openapi-parser": "^4.0.0"
   }
 }

packages/server/package.json

@@ -26,7 +26,7 @@
     "start:server": "tsx src/http.ts --watch"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@taskade/mcp-openapi-codegen": "*",
     "mcp-proxy": "^3.2.0",
     "node-fetch": "^3.3.2",

packages/server/src/server.test.ts

@@ -62,4 +62,9 @@ describe('TaskadeMCPServer API requests', () => {
     expect(init.headers['User-Agent']).toBe(`taskade-mcp-server/${packageVersion}`);
     expect(init.headers.Authorization).toBe('Bearer test-access-token');
   });
+
+  it('advertises tools and no resources, and sends only the name and version as serverInfo', () => {
+    expect(client.getServerCapabilities()).toEqual({ tools: { listChanged: true } });
+    expect(client.getServerVersion()).toEqual({ name: 'taskade', version: packageVersion });
+  });
 });

packages/server/src/server.ts

@@ -18,14 +18,8 @@ export class TaskadeMCPServer extends McpServer {
   readonly config: TaskadeServerOpts;
 
   constructor(opts: TaskadeServerOpts) {
-    super({
-      name: 'taskade',
-      version,
-      capabilities: {
-        resources: {},
-        tools: {},
-      },
-    });
+    // McpServer advertises the tools capability itself. The server has no resources to advertise.
+    super({ name: 'taskade', version });
 
     this.config = opts;