[dependabot]

Bumps @modelcontextprotocol/node to 2.1.2 and updates ancestor dependency @mastra/mcp. These dependencies need to be updated together.

Updates @modelcontextprotocol/node from 2.0.0 to 2.1.2

Release notes

Sourced from @​modelcontextprotocol/node's releases.

@​modelcontextprotocol/node@​2.1.2

Patch Changes

• #3084 10c26b0 Thanks @​claude! - The @hono/node-server dependency range widens from ^1.19.9 to ^1.19.9 || ^2.1.3, so a new install resolves to 2.x and an install that cannot get 2.x keeps 1.x.

• Updated dependencies [ef38c67, c05225a, 43c45f4, 5820f79, c05225a, b381559, 46d9c99, 895007f, b022522]:

  • @​modelcontextprotocol/server@​2.4.0

@​modelcontextprotocol/node@​2.1.1

Patch Changes

• #2897 7f4c12a Thanks @​claude! - hono is now a regular dependency of @modelcontextprotocol/node, so installs with strict peer-dependency checking no longer fail on the hono peer that @hono/node-server requires. No runtime change.

• #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

  What keeps working without a change:

  • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
  • A handler that builds a new server and a new stateless transport for each request.
  • One server and one transport per session (a transport with a sessionIdGenerator).
  • Connecting a server again after close().
  • Client.

  What fails now, how it shows, and what to change:

  • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
  • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
  • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
  • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

  What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

  The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

• #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [40f8f4e, 6d8dbc6, 5238fba, 2fc49ea, 4d94e7b, 84804c2, e55f9ac, 633dd3e, 2237555]:

  • @​modelcontextprotocol/server@​2.3.0

@​modelcontextprotocol/node@​2.1.0

Minor Changes

• #1624 6032170 Thanks @​SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks.

  createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The

... (truncated)

Commits

• 951fe56 Version Packages (#2959)
• 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
• 28124db fix(docs): use relative POSIX package entry globs (#3016)
• f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
• a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
• 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
• ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
• 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
• a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
• c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
• Additional commits viewable in compare view

Updates @mastra/mcp from 2.1.2 to 2.7.0

Release notes

Sourced from @​mastra/mcp's releases.

December 9, 2025

Changelog

Summary

• Total packages with changes: 12
• Packages with major changes: 0
• Packages with minor changes: 0
• Packages with patch changes: 4

---

@​mastra/agent-builder@​0.2.6-alpha.1

Patch Changes

• Fix install step validation error by making targetPath optional in InstallInputSchema. This resolves the "expected string, received undefined" error when running the agent builder template workflow without explicitly providing a targetPath parameter. (#10923)

Dependency Updates

• @​mastra/core@​0.24.7-alpha.3

---

@​mastra/ai-sdk@​0.3.3-alpha.0

Patch Changes

• Return NetworkDataPart on each agent-execution-event and workflow-execution-event in network streams (#10979)

• Fixed tool-call-suspended chunks being dropped in workflow-step-output when using AI SDK. Previously, when an agent inside a workflow step called a tool that got suspended, the tool-call-suspended chunk was not received on the frontend even though tool-input-available chunks were correctly received. (#10988)

  The issue occurred because tool-call-suspended was not included in the isMastraTextStreamChunk list, causing it to be filtered out in transformWorkflow. Now tool-call-suspended, tool-call-approval, object, and tripwire chunks are properly included in the text stream chunk list and will be transformed and passed through correctly.

  Fixes #10978

Dependency Updates

• @​mastra/core@​0.24.7-alpha.3

---

@​mastra/client-js@​0.17.0-alpha.3

Dependency Updates

• @​mastra/core@​0.24.7-alpha.3

---

... (truncated)

Changelog

Sourced from @​mastra/mcp's changelog.

2.7.0

Minor Changes

• Added Mastra-storage-backed tasks to MCPServer (experimental). Closes #28337. (#28521)

  • Shared tasks. A server registered on a Mastra instance with background tasks enabled keeps its tasks in Mastra storage. Any instance that shares the storage can check, answer, cancel, and run a task.
  • Survives restarts. Answers outlive the instance that took them. Each instance picks up tasks left by stopped instances as soon as the server is registered.
  • Cleans up after itself. Expired tasks fail, and finished tasks are deleted when their TTL ends.
  • Limits apply everywhere. maxOpenTasksPerClient and maxOpenTasks count tasks across all instances.
  • Private by default. Storage never keeps task ids or bearer tokens. A readable metadata.clientLabel shows which client sent a task.
  • One trace per task. The call that creates a task, each run of the tool, and later answers and cancels share one trace. Polls aren't traced.
  • Opt-in recovery. When the instance running a task stops, the task fails by default. Set recover: true to run the tool again on another instance. Only use it for tools that are safe to repeat.

  const server = new MCPServer({
    id: 'reports',
    name: 'Reports',
    version: '1.0.0',
    tools: { buildReport },
    tasks: { tools: { buildReport: { mode: 'always', recover: true } } },
  });
  export const mastra = new Mastra({
  storage,
  backgroundTasks: { enabled: true },
  mcpServers: { reports: server },
  });

• MCP tasks in Studio (#28629)

  MCP servers with tasks enabled now report which tools run as tasks (always or auto, whether clients must support tasks to call them, and whether they recover after a restart), and give Studio an admin view to list tasks (filtered by status, tool or client, page by page), find one by its task id, and cancel or answer them. Cancelling or answering from Studio goes through the same path as the protocol's tasks/cancel and tasks/update. The view shows hashed task and client keys and a readable client label, never raw task ids or credentials. Custom task stores can opt in by implementing MCPTaskStoreAdmin (list, updateByKey, cancelByKey); stores without it are reported as not listable.

  The MCP client now writes an mcp-task progress entry (MCPTaskProgress) to a tool's output stream when its call continues as an MCP task and whenever the task's status changes, so UIs can show the remote task id and status while it runs.

  import type { MCPTaskStore, MCPTaskStoreAdmin } from '@mastra/mcp';
  // A custom store opts into Studio's task list by also implementing MCPTaskStoreAdmin.
  class MyTaskStore implements MCPTaskStore, MCPTaskStoreAdmin {
  // ...the MCPTaskStore methods, plus:
  async list(options) {
  /* newest first, with nextCursor when more match /
  }
  async updateByKey(taskKey, inputResponses) {
  / 'done' | 'ignored' | 'not_found' /
  }
  async cancelByKey(taskKey) {
  / 'done' | 'ignored' | 'not_found' */

... (truncated)

Commits

• 77076a1 chore: version - exit prerelease mode
• 582ef17 chore: version packages (alpha) (#28888)
• 80f2f21 feat: show MCP tasks in Studio (server Tasks panel and tool-call task chip) (...
• ea26a4b feat(mcp): serve workflows and agents as MCP tasks (#28619)
• f548c12 feat(mcp): keep MCP tool tasks in Mastra background-task storage (#28521)
• e80dd64 fix(mcp): accept any MCP task createdAt in MCPClient (#28899)
• e30d29b feat(mcp): MCPServer serves MCP Tasks for tools (#28420)
• 76f4110 feat(mcp): MCPClient can wait for MCP Tasks from remote servers (#28343)
• 096e246 feat(mcp): internal wire layer and task store for MCP Tasks (#28340)
• f6cd11f chore(deps): lock file maintenance (#28672)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: manjunathshiva/opendecider
• Branch: main
• File: .coderabbit.yaml
• Commit: 7873aa4
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: d1a1e30e-3381-4714-a9e3-45e786a5c245

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​mastra/​core@​1.73.0 ⏵ 1.81.0			+1
	npm/​@​mastra/​mcp@​2.1.2 ⏵ 2.7.0

View full report