DO NOT MERGE: main-source probe (pass)

.changeset/everything-sdk-v2.md

@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/server-everything": major
+---
+
+Move to the TypeScript SDK v2 packages (`@modelcontextprotocol/server`, `@modelcontextprotocol/node`, and `@modelcontextprotocol/server-legacy` for the deprecated HTTP+SSE transport) from `@modelcontextprotocol/sdk` 1.x (#4856). The task tools `simulate-research-query`, `trigger-sampling-request-async` and `trigger-elicitation-request-async` are removed, and the server no longer advertises the `tasks` capability, because SDK v2 dropped the experimental tasks layer they were built on; they return on the tasks extension in #4852. Breaking for clients: the server now requires Node.js 20 or later; over stdio, a single incoming JSON-RPC message larger than 10 MiB now closes the connection (the SDK v2 default read-buffer cap; SDK 1.x buffered without a limit); an unknown tool name is rejected with JSON-RPC error `-32602` instead of returning an `isError` result; error messages no longer carry the `MCP error <code>: ` prefix, and input-validation messages name the field first (`field: message`); tool schemas in `tools/list` declare JSON Schema 2020-12 instead of draft-07; and tools no longer advertise `execution.taskSupport`. The optional `state` argument of `args-prompt` now carries its description.

.changeset/filesystem-sdk-v2.md

@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/server-filesystem": major
+---
+
+Move to the TypeScript SDK v2 packages (`@modelcontextprotocol/server`) from `@modelcontextprotocol/sdk` 1.x (#4856). Breaking for clients: the server now requires Node.js 20 or later; over stdio, a single incoming JSON-RPC message larger than 10 MiB now closes the connection (the SDK v2 default read-buffer cap; SDK 1.x buffered without a limit); an unknown tool name is rejected with JSON-RPC error `-32602` instead of returning an `isError` result; error messages no longer carry the `MCP error <code>: ` prefix, and input-validation messages name the field first (`field: message`); and tools no longer advertise `execution.taskSupport`.

.changeset/memory-sdk-v2.md

@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/server-memory": major
+---
+
+Move to the TypeScript SDK v2 packages (`@modelcontextprotocol/server`) from `@modelcontextprotocol/sdk` 1.x (#4856). Breaking for clients: the server now requires Node.js 20 or later; over stdio, a single incoming JSON-RPC message larger than 10 MiB now closes the connection (the SDK v2 default read-buffer cap; SDK 1.x buffered without a limit); an unknown tool name is rejected with JSON-RPC error `-32602` instead of returning an `isError` result; error messages no longer carry the `MCP error <code>: ` prefix, and input-validation messages name the field first (`field: message`); tool schemas in `tools/list` declare JSON Schema 2020-12 instead of draft-07; and tools no longer advertise `execution.taskSupport`.

.changeset/sequentialthinking-sdk-v2.md

@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/server-sequential-thinking": major
+---
+
+Move to the TypeScript SDK v2 packages (`@modelcontextprotocol/server`) from `@modelcontextprotocol/sdk` 1.x (#4856). Breaking for clients: the server now requires Node.js 20 or later; over stdio, a single incoming JSON-RPC message larger than 10 MiB now closes the connection (the SDK v2 default read-buffer cap; SDK 1.x buffered without a limit); an unknown tool name is rejected with JSON-RPC error `-32602` instead of returning an `isError` result; error messages no longer carry the `MCP error <code>: ` prefix, and input-validation messages name the field first (`field: message`); tool schemas in `tools/list` declare JSON Schema 2020-12 instead of draft-07; and tools no longer advertise `execution.taskSupport`.

.claude/skills/client-smoke/SKILL.md

@@ -172,9 +172,10 @@ CLI) or **Server Settings → Protocol Era** (the web UI):
 | `modern` | Pins 2026-07-28 through `server/discover`, with no fallback |
 | `auto` | Probes `server/discover`, and falls back to `initialize` |
 
-⚠️ **Only the legacy era can be exercised against these servers today.** All
-seven are on a v1 SDK (`@modelcontextprotocol/sdk` 1.x, `mcp` 1.x), whose
-newest protocol version is 2025-11-25. None implements `server/discover`. So:
+⚠️ **Only the legacy era can be exercised against these servers today.** The
+Python servers are on `mcp` 1.x, whose newest protocol version is 2025-11-25.
+The TypeScript servers are on the TS SDK v2 packages (#4856) but still serve
+only the `initialize` handshake. None implements `server/discover`. So:
 
 - `--protocol-era modern` fails, by design, with `Version negotiation failed:
   the server did not offer pinned protocol version 2026-07-28 via
@@ -259,7 +260,7 @@ Claude Code, run this way, has no era switch and does not print the protocol
 version it negotiated. `/pr-flow` asks for the LLM client in both eras as well;
 where the client gives no way to choose, record the client and its version and
 say that the era could not be selected, rather than labelling the run with an
-era it was not shown to use. Against a v1-SDK server the connection is legacy
+era it was not shown to use. Against a server without modern-era support the connection is legacy
 whatever the client prefers, for the reason given under Protocol eras.
 
 ## What to write down

.claude/skills/pre-push-gate/SKILL.md

@@ -273,6 +273,31 @@ of the server's stderr. Re-run a subset with
 - **A new server fails `test:scripts`** with "every server directory in the
   repo has a smoke entry": add it to `SERVERS` in `scripts/smoke-servers.mjs`.
 
+### `interface-diff`
+
+The last stage diffs the `everything` server's MCP interface (capabilities,
+tools, prompts, resources, resource templates) in this checkout's build
+against the same server built from the merge-base with `origin/v2/main`, and
+prints the report. **A changed interface does not fail it**: the report is
+what the PR's sticky comment will show, so read it, and if a change is not
+one you meant, that is the finding. It fails only when the diff cannot run,
+with `❌ The interface diff could not run` and the reason:
+
+- **"origin/v2/main is not available"**: `git fetch origin v2/main`.
+- **"src/everything/dist/index.js does not exist"**: you ran it on its own
+  before building: `npm run build -w src/everything`.
+- **An `npm ci` or `npm run build` failure**: the _base_ did not install or
+  build. Offline with a cold npm cache is the usual cause; otherwise name a
+  base that builds with `npm run interface-diff -- --base <ref>`.
+- **"Base server probe failed" / "Target probe failed"**: a server did not
+  answer the probe. A target failure is this checkout's server and is the
+  real defect; the smoke stage before it usually fails first.
+
+Re-run it on its own with `npm run interface-diff` (about ten seconds). What
+it compares against in CI, and why it is a script rather than an action, is
+in [`docs/quality-gate.md`](../../../docs/quality-gate.md) and the header of
+`scripts/interface-diff.mjs`.
+
 ## Waiting on the lease
 
 A gate that starts with

.claude/skills/release/SKILL.md

@@ -258,6 +258,24 @@ squash writes one new commit that `v2/main` does not contain, so the two
 branches stop sharing history and the next milestone merge conflicts with
 itself.
 
+⚠️ **Do not click "Update branch" on the merge PR.** GitHub always offers it
+here, because `main` always holds commits the merge branch lacks (its own
+earlier merge commits), so it does not mean the PR is out of date. Clicking it
+merges `main` into the merge branch: the PR gains a commit of its own, `main`
+receives two merge commits, and the branch head is no longer the commit the
+ledger names. If it was clicked, put the branch back on its head from before
+the click: the update merge's **first parent**, which is the commit the ledger
+verified. Not `origin/v2/main`, which may have moved on to a commit nothing has
+verified. Then repeat the `git merge-tree` check above:
+
+```sh
+B="v2/chore/$N-release-$MILESTONE"
+git fetch origin
+UPDATE=$(git rev-parse "origin/$B")
+git log -1 --format='%s' "$UPDATE"   # must be "Merge branch 'main' into …"
+git push --force-with-lease="$B:$UPDATE" origin "$UPDATE^1:refs/heads/$B"
+```
+
 ⚠️ **Never merge `main` back into `v2/main`** to "sync" them. Everything
 reaches `main` through `v2/main`, so there is nothing on `main` to bring back
 except the merge commits themselves. `v2/main` ahead of `main` means a release

.claude/skills/security-advisory/SKILL.md

@@ -140,7 +140,8 @@ this order:
    Servers listed in the README or the Registry are third-party; their reports
    go to their own maintainers.
 2. **Is the code path the server's, or an SDK's?** The TypeScript servers are
-   built on `@modelcontextprotocol/sdk`
+   built on the TypeScript SDK's v2 packages (`@modelcontextprotocol/server`,
+   `@modelcontextprotocol/node` and the frozen `@modelcontextprotocol/server-legacy`)
    ([typescript-sdk](https://github.com/modelcontextprotocol/typescript-sdk)),
    the Python servers on `mcp`
    ([python-sdk](https://github.com/modelcontextprotocol/python-sdk)). Transport

.claude/skills/testing/SKILL.md

@@ -72,7 +72,7 @@ per-session setup and teardown the server needs.
 
 | Server | Factory | Harness | `connect(…)` takes |
 | --- | --- | --- | --- |
-| `everything` | `createServer()` in `server/index.ts`, returns `{ server, cleanup }` | `__tests__/harness.ts` | `{ capabilities, taskStore, setup, sessionId }`, all optional |
+| `everything` | `createServer()` in `server/index.ts`, returns `{ server, cleanup }` | `__tests__/harness.ts` | `{ capabilities, setup, sessionId }`, all optional |
 | `filesystem` | `createServer(allowedDirectories)` in `server.ts` | `__tests__/helpers.ts` | the allowed directories, then `{ capabilities, listRoots }` |
 | `memory` | `createServer(memoryFilePath)` in `index.ts` | `__tests__/helpers.ts` | the graph file's path (`makeTempGraph()` makes one) |
 | `sequentialthinking` | `createServer()` in `index.ts` | `__tests__/helpers.ts` | `{ disableThoughtLogging }`, defaulting to `"true"` |
@@ -83,7 +83,7 @@ Each `connect` returns the `client` and a `close()`; call `close()` in
 
 ```ts
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { Client } from "@modelcontextprotocol/client";
 import { connect, contentOf, textOf, type Session } from "./harness.js";
 
 describe("echo, over the protocol", () => {
@@ -123,12 +123,12 @@ What `everything`'s harness does that a hand-rolled connection would miss:
   next test. `connect()` sets a fresh `sessionId` on the server transport
   (`sessionId: null` keeps it undefined, as stdio does), and `close()` runs the
   server's `cleanup(sessionId)`, which also stops the timers `createServer()`
-  starts (the roots sync, the task store).
+  starts (the roots sync).
 - **Capabilities.** A tool `everything` registers in `registerConditionalTools`
   appears only when the client declares the matching capability: pass
   `capabilities` (`ALL_CAPABILITIES` declares every one), with `setup` to
   install the client's handlers for the requests the server sends back
-  (sampling, elicitation, roots) and `taskStore` for the task-augmented ones.
+  (sampling, elicitation, roots).
 - **Notifications.** `session.notifications` collects every notification no
   specific handler consumed; `ofMethod(notifications, method)` filters it.