mcp-sdk-audit

Absorbing a `@modelcontextprotocol/server` release into Figwright, end to end: audit → upgrade → prove the wire contract is unchanged. **Do not reason about this the way `figma-typings-audit` reasons about plugin typings.** That package is types-only, so `tsc` is a real gate. This one is a **runtime dependency**: it serializes every tool result, generates the JSON Schema for all ~112 tools, and negotiates the protocol version. A release can leave every type identical and still change what clients see. `pnpm typecheck` will stay green through it. **Unlike every other dependency here, this one has a dedicated gate — use it.** `packages/mcp/test/e2e/mcp-wire.test.ts` spawns the built `dist` over real stdio, speaks raw JSON-RPC at it, and asserts the advertised contract against what the specs declare. It runs in `pnpm test`. That gate answers *did anything break*; it does not answer *what moved*, which is what an audit is for — Stage 5 covers the difference. Target version: whatever the user named, otherwise the latest `@modelcontextprotocol/server` on npm. ## Stage 0 — Resolve versions ```bash grep '@modelcontextprotocol' packages/mcp/package.json # declared range grep -m1 '@modelcontextprotocol/server@' pnpm-lock.yaml # what is installed npm view @modelcontextprotocol/server version dist-tags --json # latest gh api repos/modelcontextprotocol/typescript-sdk/releases --jq '.[0:15][] | "\(.tag_name)\t\(.published_at)"' ``` Figwright is on **v2** — the packa...