feat!: move to MCP TypeScript SDK v2

.github/workflows/test.yml

@@ -32,6 +32,9 @@ jobs:
       - name: Spellcheck
         run: npm run spellcheck
 
+      - name: Typecheck src and tests
+        run: npm run typecheck
+
       - name: Compile typescript
         run: npm run build
 

CHANGELOG.md

@@ -1,5 +1,13 @@
 ## Unreleased
 
+### Breaking Changes
+
+- **MCP TypeScript SDK v2 (#46, same move as mapbox/mcp-server#296).** The server and the `/tools`, `/resources` and `/utils` exports now use `@modelcontextprotocol/server` 2.4.0 instead of `@modelcontextprotocol/sdk` 1.x. v2 is where new MCP features land.
+  - **For code that imports our tools or resources:** `installTo(server)` needs a v2 `McpServer`, so the hosted server has to move to v2 in the same release it picks this version up in. `getAllTools()`, `getAllResources()` and `installTo()` themselves are unchanged. Handlers get the v2 `ServerContext` instead of `RequestHandlerExtra`.
+  - **Clients:** nothing changes. It still negotiates 2025-11-25 with current clients, and tool input schemas now go out as JSON Schema 2020-12.
+  - **Mostly the codemod:** `npx @modelcontextprotocol/codemod v1-to-v2 .` did the import paths and context types. None of our tools have an output schema, so v2's stricter output validation doesn't affect us. `@modelcontextprotocol/client` is a dev dependency, used by `scripts/test-resources.ts` and the tests.
+  - **Testing:** the tool tests call `run()` directly and never touch the SDK, so there's a new test that installs every tool and resource on a real v2 `McpServer` and goes through `tools/list`, `tools/call`, `resources/list` and `resources/read`. Also checked the built server over stdio, including a live search and document fetch.
+  - **Tests are typechecked in CI now:** `npm run typecheck` checks `src` and `test` together. The tests weren't typechecked before, and `SearchDocsTool.test.ts` had 7 errors on main (the v2 types fix those). `tsconfig.test.json` gets `noEmit` so a plain `tsc` run can't write `.js` files next to the sources.
 - chore: harden document fetching. **Breaking for some URLs:** `get_document_tool` and `batch_get_documents_tool` now accept only `https://docs.mapbox.com` URLs (plus `MAPBOX_DOCS_HOST_OVERRIDE` when set); bare `mapbox.com` and `docs.tilestream.net` (without the override) are rejected. The shared HTTP pipeline no longer follows redirects; document fetches follow up to 3 redirects, each only to an allowed docs URL. `access_token` detection is now case-insensitive (#45)
 - docs: fix two stale tool descriptions left over from the Algolia-to-`llms.txt` search migration. `search_mapbox_docs_tool`'s README entry still said it used "Algolia full-text search" — that was removed a while back (see the "Replace Algolia search with self-contained llms.txt search" entry below) and it now searches the self-hosted `llms.txt` index. Separately, `get_document_tool`'s own description (the text shown to the LLM, not just docs) referenced a tool named `get_latest_mapbox_docs_tool`, which doesn't exist — it should have said `search_mapbox_docs_tool`, and was actively misdirecting tool-chaining behavior.
 - fix: startup/shutdown/error logging messages now actually reach clients. The `McpServer` never declared the `logging` capability, so every `sendLoggingMessage` call (including the existing "server started"/"shutting down"/"Fatal error" messages) was a silent no-op regardless of when it was sent. Declared `logging: {}` in the server's capabilities.

cspell.json

@@ -8,6 +8,7 @@
     "MAPBOX",
     "modelcontextprotocol",
     "oninitialized",
+    "codemod",
     "GHSA",
     "mxjg",
     "anthropics",