chore(deps)(deps): bump @modelcontextprotocol/server from 2.0.0-alpha.2 to 2.0.0-alpha.3

[dependabot]

Bumps @modelcontextprotocol/server from 2.0.0-alpha.2 to 2.0.0-alpha.3.

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.0.0-alpha.3

Minor Changes

• #2206 e03bca9 Thanks @​KKonstantinov! - Add @​modelcontextprotocol/server-legacy package with frozen v1 SSE transport and OAuth Authorization Server helpers for migration from v1 to v2.

Commits

• e4227d1 Version Packages (alpha) (#1845)
• 0fb8406 v2: codemod iterations, canonical zod schema exports from sdk-shared (#2354)
• 7ea6fde test(client): cover refresh retry after invalid token 401 (#2367)
• ee732d6 chore: switch to module ESNext + moduleResolution bundler (#2095)
• c59dc3a feat(server): expose icons on registerTool/registerPrompt (McpServer) (#2353)
• 6312f2a fix(middleware): stop bundling workspace type graphs into .d.ts (avoids dts-g...
• 5e0249f test(integration): stop the cloudflare workers test from rewriting workspace ...
• 78fbe27 feat(core): reserved trace context _meta keys and propagation docs (SEP-414) ...
• e84c3e9 fix(server,client): non-SEP draft spec conformance (eager list handlers, pagi...
• 49c0a71 feat: deprecate roots, sampling, and logging runtime APIs (SEP-2577) (#2268)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Dependency-only bump with no app code changes; alpha SDK upgrades can still affect MCP transport or tool registration behavior at runtime.

Overview
Bumps @modelcontextprotocol/server in apps/api from 2.0.0-alpha.2 to 2.0.0-alpha.3 and refreshes pnpm-lock.yaml. @modelcontextprotocol/hono stays on 2.0.0-alpha.2; the lockfile now resolves it against the new server version.

The lockfile change drops the optional @cfworker/json-schema peer wiring for the server package; @modelcontextprotocol/server now resolves with zod only. No application source files are modified—MCP still imports McpServer and WebStandardStreamableHTTPServerTransport from the same package paths.

^{Reviewed by Cursor Bugbot for commit bcf9115. Bugbot is set up for automated code reviews on this repo. Configure here.}

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cursor]

No concrete security issues found in the changed files.

Reviewed changes:

• apps/api/package.json: bumps @modelcontextprotocol/server from 2.0.0-alpha.2 to 2.0.0-alpha.3.
• pnpm-lock.yaml: updates the resolved MCP server package and removes its previous optional @cfworker/json-schema peer; the new package resolves only to zod.

Threat surfaces checked:

1. MCP endpoint auth: no route/auth code changed; verified existing flow still authenticates bearer token and project before server/tool registration and before resumed session handling, returns JSON-RPC auth errors, and passes token scopes into tool handlers.
2. Query execution sandboxing: no query code changed; verified existing execute_query path still routes through scoped model checks, AST validation, read-only DuckDB instance/hardening, timeout handling, and 1000-row result limiting.
3. Admin auth (Better Auth): no admin auth files changed by this dependency bump.
4. API input validation: no Hono route handler input schemas changed by this dependency bump.
5. Environment secrets: no .env.local/secret-bearing source changes; the lockfile/package change does not add secret logging or response exposure.
6. Dependency exposure: @modelcontextprotocol/server@2.0.0-alpha.3 is the current latest/alpha dist-tag and does not introduce new transitive dependencies beyond zod. pnpm audit --prod reports unrelated existing advisories outside this package path, with no finding introduced through @modelcontextprotocol/server.

Verification run:

• pnpm --filter @archmax/api typecheck passed.
• npx vitest run apps/api/src/mcp/archmax-route.test.ts apps/api/src/mcp/archmax-server.test.ts packages/core/src/services/mcp-tools.test.ts packages/core/src/services/sql-ast-validation.test.ts passed (191 tests).

  

_{Sent by Cursor Automation: archmax Security Review}

[github-actions]

Docker image ready

docker pull ghcr.io/archmaxai/archmax:pr-79