feat: migrate to base MCP SDK v2 beta.4

[khandrew1]

Summary

• replace the monolithic @modelcontextprotocol/sdk v1 dependency with the exact published base MCP SDK v2 beta.4 split packages
• make App extend the public client Client and AppBridge extend the public server Server, while preserving the separate outer host/server and inner View/host channels
• preserve the temporary inner double handshake and Apps-ready gate, and replace protocol inheritance for events with a composed EventDispatcher
• migrate shared types, transports, React/server helpers, tests, examples, documentation, snippets, skills, and package metadata

This is intentionally a breaking dependency migration. Apps protocol negotiation remains unchanged.

Verification

• npm install
• npm run build:all
• npm test — 392 passed, 1 skipped, 0 failed
• strict TypeDoc validation
• snippet sync, Prettier, version, and git diff --check checks
• package dry run and all public entrypoint import checks
• generated declaration and stale v1/private import audits
• manual Chrome verification of the integration and PDF server flows, including callbacks, sandbox attributes, PDF navigation/zoom/fullscreen, model context, and interactions

The full Playwright suite was not rerun locally because Express rejects the hidden .codex worktree path when basic-host serves sandbox.html; the affected flows were verified manually through Chrome from a non-hidden path. CI should run the suite from its normal checkout.

---

Summary by cubic

Migrates the Apps SDK to the base MCP SDK v2.0.0-beta.4 split packages, replacing @modelcontextprotocol/sdk v1 across the codebase. This is a breaking dependency update; App protocol negotiation and behavior remain unchanged.

• Refactors

  • App now subclasses @modelcontextprotocol/client Client; AppBridge subclasses @modelcontextprotocol/server Server for the inner iframe, with a separate outer Client to the MCP server.
  • Preserves the inner double handshake and Apps-ready gate; replaces protocol inheritance with a composed EventDispatcher.
  • Updates examples to use @modelcontextprotocol/express, @modelcontextprotocol/node (NodeStreamableHTTPServerTransport), and @modelcontextprotocol/server/stdio.
  • Standardizes schemas to z.object({...}); updates docs/snippets; externalizes peer deps for @modelcontextprotocol/{client,core,server} and zod in standard builds.
  • Regenerates lockfile for npm 10.

• Migration

  • Install and pin: @modelcontextprotocol/client@2.0.0-beta.4, @modelcontextprotocol/server@2.0.0-beta.4, @modelcontextprotocol/core@2.0.0-beta.4, and zod@^4.2.0 (examples may also need @modelcontextprotocol/express and @modelcontextprotocol/node).
  • Update imports from @modelcontextprotocol/sdk v1 to the split packages (e.g., createMcpExpressApp from @modelcontextprotocol/express, StdioServerTransport from @modelcontextprotocol/server/stdio).
  • Change tool/resource schemas to z.object({ ... }); remove .shape usage and pass Zod schemas directly.
  • Ensure Node 20+; reinstall and rebuild (npm install, then build/tests).

^{Written for commit f50ec6e. Summary will update on new commits.}

[cubic-dev-ai]

We've triggered an ultrareview automatically — This PR migrates the entire codebase from the monolithic MCP SDK v1 to the split MCP SDK v2 beta.4 packages, changing 122 files with 4077 lines — a large cross-cutting dependency that touches core client/server class hierarchies, transports, testing infrastructure, examples, and documentation,.... I'll post findings when complete.

An ultrareview is cubic's deepest review, catching hard-to-find bugs in the most critical PRs. It runs a longer, multi-pass analysis using cubic's most capable review models, and typically takes around 30 minutes. It consumes your team's reviewed-lines allowance at 3× the standard rate.

Automated ultrareviews are disabled by default. We triggered this run as part of your trial. Want cubic to do this for every high-risk PR? Enable auto-ultrareview in your settings.