[cliffhall]

Closes #2784

Bumps the four lockstep typescript-sdk packages — @modelcontextprotocol/client, core, server and server-legacy — from 2.3.1 → 2.4.0. They are declared only in the repo-root package.json and pinned exactly, so they move together; no client manifest declares any of them.

What changed

• package.json: four exact pins moved to 2.4.0.
• package-lock.json: only those four entries changed. Nothing new arrived transitively.

Checklist from the issue

• Root package.json bumped (all four together)
• npm install at the root, lockfile committed
• Bundler external lists checked. 2.4.0's new entry points are the additive ext/skills subpaths (client/ext/skills, server/ext/skills[/node], core/ext/skills), and nothing here imports them. Package root exports are unchanged, and verify:bundle-externals passes in the gate.
• npm run format, then npm run local:gate: green

Upstream upgrade notes, checked against this repo

2.4.0 note	Impact here
x-mcp-header on a number parameter is now rejected	None. Both test-server fixtures (get_weather and the invalid-header tool) annotate z.string() fields
outputSchema from z.object().meta({ id }) is no longer wrapped in { result } on 2025-11-25	None. Nothing reads structuredContent.result, and no fixture uses .meta({ id })
Bundled Ajv uses fast-uri 3.1.8, which rejects a $id/$ref with an invalid URI scheme	None. The only scheme-bearing $refs (in the unportable-schemas* configs) are valid https: URIs

The new SDK features are not adopted in this PR. The Inspector already supports Skills (SEP-2640) through its own implementation (#2234, #2248); moving that onto the SDK's new SkillsClient is #2804. The opt-in scopeForRefresh on token refresh is #2805.

Gate note

The first local:gate run failed at smoke:web:elicit ("launcher exited before serving"). Another session was running a manual Inspector on ports 6275/6278, outside the gate lease. Run alone, the smoke passed on this branch, and a full re-run of the gate came back green.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The local header scanner must match SDK 2.4.0’s rejection of number annotations to preserve exclusion diagnostics and correct salvage filtering.

1 open issue

• Remove number from permitted x-mcp-header types · New

What changed in this PR

Upgrades the four lockstep MCP TypeScript SDK packages from 2.3.1 to 2.4.0 for Inspector, addressing #2784 without adopting new SDK features.

Changes:

• Updates all four exact version pins, preserving server-legacy as a development dependency.
• Refreshes the corresponding lockfile versions, download URLs, integrity hashes, and internal core references without unrelated dependency changes.

File	Description
package.json	Pins all four MCP SDK packages to 2.4.0.
package-lock.json	Aligns resolved SDK packages and internal dependencies with 2.4.0.

_{Review effort: Balanced}

[cliffhall]

Copilot round 1: 1 inline finding, nothing suppressed.

• core/json/xMcpHeader.ts still permitted number after SDK 2.4.0 dropped it. Fixed in 26c69f6. Removed number from the allowlist, ported the SDK's fault-precedence (a number fault is reported in preference to a later fault) so exclusion reasons match, and updated the tests. local:gate is green on the fix.

Requesting round 2.

[Copilot]

🟢 Approval recommended

The dependency versions remain aligned, the prior compatibility issue is resolved with focused regression coverage, and no unresolved findings remain.

No open issues 🎉

1 resolved since last review

• Remove number from permitted x-mcp-header types

_{Review effort: Balanced}

[cliffhall]

Copilot review loop closed. Round 2 was clean (no inline comments, nothing suppressed, approval recommended), so the loop stops on the first clean round.