Hey, thanks for maintaining the Agents SDK!
After updating to agents@0.22.0, I noticed that @modelcontextprotocol/sdk@1.30.0 is still a required peer dependency. npm and pnpm therefore install it for every consumer.
The v1 SDK brings several server dependencies with it, including express, express-rate-limit, cors, raw-body, and @hono/node-server.
As described in #1557, the package is retained for legacy compatibility paths such as McpAgent, WorkerTransport, and createLegacyMcpHandler. That makes sense for existing users of those APIs, but we do not use any of the legacy MCP functionality and still get the complete SDK v1 dependency tree.
Besides the additional install size, avoiding unused server dependencies also reduces the supply-chain surface for consumers that only use the regular Agents or MCP v2 APIs.
Would highly appreciate if the legacy MCP path could be isolated and @modelcontextprotocol/sdk made optional, so only consumers using the legacy APIs need to install it.
Hey, thanks for maintaining the Agents SDK!
After updating to
agents@0.22.0, I noticed that@modelcontextprotocol/sdk@1.30.0is still a required peer dependency. npm and pnpm therefore install it for every consumer.The v1 SDK brings several server dependencies with it, including
express,express-rate-limit,cors,raw-body, and@hono/node-server.As described in #1557, the package is retained for legacy compatibility paths such as
McpAgent,WorkerTransport, andcreateLegacyMcpHandler. That makes sense for existing users of those APIs, but we do not use any of the legacy MCP functionality and still get the complete SDK v1 dependency tree.Besides the additional install size, avoiding unused server dependencies also reduces the supply-chain surface for consumers that only use the regular Agents or MCP v2 APIs.
Would highly appreciate if the legacy MCP path could be isolated and
@modelcontextprotocol/sdkmade optional, so only consumers using the legacy APIs need to install it.