chore(mcp): update MCP packages to 2.3.1 and conformance to alpha.12

[mattzcarey]

Updates @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1, @modelcontextprotocol/sdk to 1.32.1, and the conformance referee to 0.2.0-alpha.12. It also fixes two server bugs that the new SDK and referee exposed.

• Legacy compatibility handler: in 2.3, Server.connect() rejects an instance that's already connected. When a createMcpHandler factory returned one shared instance, the second Legacy request failed and its teardown then closed that instance, cutting off the request still using it. createLegacyCompatibilityRequestHandler now rejects a still-serving instance before taking ownership of it, the same check upstream added on the modern path.
• McpAgent session termination: alpha.12's server-session-lifecycle scenario found that DELETE returned 204 but the session kept being served until the deferred teardown alarm ran. The spec requires 404 for a terminated session ID. _cf_terminateSession() schedules the teardown and then clears the stored initialize request, so every route treats the ID as unknown straight away.
• Conformance: the driver covers the new json-schema-2020-12-preservation client scenario. The vendored fixture is ported from @modelcontextprotocol/server@2.3.1, adding the scope-challenge registrations. http-standard-headers leaves the 2026-07-28 client baseline because alpha.12 fixed the referee bug behind it.
• The client transports now follow redirects only within the same origin (upstream change, noted in the changeset).

Tests ran: the full agents and codemode suites, every pnpm run test:conformance lane, and a typecheck of every MCP-consuming project. Both fixes have regression tests that fail without them.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 64e2c53

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
agents	Patch
@cloudflare/agent-think	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[agent-think]

🟡 agents import sizes: 2 entry points grew

	Entry point	Exports	Largest gzip change	Size now
🟡	agents/mcp	15 resized	up to +1.9 KiB (+0.49%)	398.8 KiB
🟡	agents	2 resized	up to +1 KiB (+0.38%)	266.2 KiB

Changed exports (17)

	Import	Gzip change	Size now
🟡	agents/mcp#createMcpHandler	+1.9 KiB (+0.49%)	398.8 KiB
🟡	agents/mcp#createLegacyMcpHandler	+1.7 KiB (+0.45%)	384.7 KiB
🟡	agents/mcp#experimental_createMcpHandler	+1.7 KiB (+0.44%)	384.8 KiB
🟡	agents/mcp#ElicitRequestSchema	+1.4 KiB (+0.41%)	350.5 KiB
🟡	agents/mcp#RPC_DO_PREFIX	+1.4 KiB (+0.4%)	350.5 KiB
🟡	agents/mcp#RPCClientTransport	+1.4 KiB (+0.4%)	350.5 KiB
🟡	agents/mcp#normalizeServerId	+1.4 KiB (+0.4%)	350.5 KiB
🟡	agents/mcp#RPCServerTransport	+1.4 KiB (+0.4%)	350.5 KiB
🟡	agents/mcp#DurableObjectEventStore	+1.4 KiB (+0.4%)	350.5 KiB
🟡	agents/mcp#McpAgent	+1.4 KiB (+0.39%)	350.5 KiB
🟡	agents/mcp#MCP_SERVER_ID_MAX_LENGTH	+1.4 KiB (+0.39%)	350.5 KiB
🟡	agents/mcp#getMcpAuthContext	+1.4 KiB (+0.39%)	350.5 KiB
🟡	agents/mcp#StreamableHTTPEdgeClientTransport	+1.4 KiB (+0.39%)	350.6 KiB
🟡	agents/mcp#SSEEdgeClientTransport	+1.3 KiB (+0.38%)	350.6 KiB
🟡	agents/mcp#WorkerTransport	+1.3 KiB (+0.37%)	354.2 KiB
🟡	agents#buildAgentUrl	+1 KiB (+0.38%)	266.2 KiB
🟡	agents#routeSubAgentRequest	+1 KiB (+0.38%)	265.7 KiB

How this works

Each runtime export is bundled on its own, minified, and gzipped. Changes smaller than 100 B, or smaller than 1% and 1 KiB, are ignored. Growth over 10% or 5 KiB is marked 🔴. This report is informational and does not fail CI. The workflow artifact contains every measurement.

_{Compared 46570f53 → 64e2c536 · workflow run · reported by agent-think[bot]}

[pkg-pr-new]

Open in StackBlitz

agents

npm i https://pkg.pr.new/agents@2574

@cloudflare/ai-chat

npm i https://pkg.pr.new/@cloudflare/ai-chat@2574

@cloudflare/codemode

npm i https://pkg.pr.new/@cloudflare/codemode@2574

hono-agents

npm i https://pkg.pr.new/hono-agents@2574

@cloudflare/shell

npm i https://pkg.pr.new/@cloudflare/shell@2574

@cloudflare/think

npm i https://pkg.pr.new/@cloudflare/think@2574

@cloudflare/voice

npm i https://pkg.pr.new/@cloudflare/voice@2574

@cloudflare/worker-bundler

npm i https://pkg.pr.new/@cloudflare/worker-bundler@2574

commit: 64e2c53