ci: gate MCP releases on transport and runtime checks

Run frozen installs, type checking, both builds and protocol tests across Node 20, 22, 24 and 26. Update release actions and use Node 24; validate before atomically pushing a new release commit and tag without rewriting history. Document the dependency baseline and reproducible verification command. Actionlint and package dry-run pass.

Author: ccbbccbb

.github/workflows/check.yml

@@ -0,0 +1,30 @@
+name: Check
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [20, 22, 24, 26]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.4.2'
+      - name: Install locked dependencies
+        run: bun install --frozen-lockfile
+      - name: Check types, build and test both transports
+        run: bun run check
+      - name: Verify package contents
+        run: npm pack --dry-run --ignore-scripts

.github/workflows/release-publish.yml

@@ -26,6 +26,10 @@ on:
         default: 'latest'
         type: string
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   release-and-publish:
     runs-on: ubuntu-latest
@@ -35,24 +39,24 @@ jobs:
       id-token: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.PAT_GITHUB }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '18.x'
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: '1.4.2'
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Configure Git
         run: |
@@ -62,42 +66,32 @@ jobs:
 
       - name: Bump version
         id: bump_version
+        env:
+          CUSTOM_VERSION: ${{ inputs.custom_version }}
+          VERSION_TYPE: ${{ inputs.version_type }}
         run: |
-          if [ -n "${{ github.event.inputs.custom_version }}" ]; then
-            echo "Using custom version ${{ github.event.inputs.custom_version }}"
-            npm version ${{ github.event.inputs.custom_version }} --no-git-tag-version
-            echo "VERSION=${{ github.event.inputs.custom_version }}" >> $GITHUB_ENV
-          else
-            echo "Bumping ${{ github.event.inputs.version_type }} version"
-            NEW_VERSION=$(npm version ${{ github.event.inputs.version_type }} --no-git-tag-version)
-            echo "VERSION=${NEW_VERSION:1}" >> $GITHUB_ENV
-          fi
-          echo "New version: ${{ env.VERSION }}"
+          npm version "${CUSTOM_VERSION:-$VERSION_TYPE}" --no-git-tag-version
+          VERSION=$(node -p "JSON.parse(require('fs').readFileSync('package.json', 'utf8')).version")
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+          bun install --lockfile-only
 
       - name: Generate Changelog
         run: |
           npm run changelog
           npm run changelog:latest
 
-      - name: Build project
-        run: bun run build && bun run build:http
-
-      - name: Commit and push changes
-        run: |
-          git pull origin main --no-edit
-          git add package.json CHANGELOG.md
-          git commit -m "Bump version to v${{ env.VERSION }}"
-          git push --force-with-lease
+      - name: Check types, build and test before release
+        run: bun run check
 
-      - name: Create and push tag
+      - name: Commit and tag the verified release
         run: |
-          git tag -d "v${{ env.VERSION }}" 2>/dev/null || true
-          git push origin --delete "v${{ env.VERSION }}" 2>/dev/null || true
-          git tag -a "v${{ env.VERSION }}" -m "Release v${{ env.VERSION }}"
-          git push origin "v${{ env.VERSION }}"
+          git add package.json bun.lock CHANGELOG.md
+          git commit -m "chore: release v$VERSION"
+          git tag -a "v$VERSION" -m "Release v$VERSION"
+          git push --atomic origin "HEAD:refs/heads/$GITHUB_REF_NAME" "refs/tags/v$VERSION"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: v${{ env.VERSION }}
           name: Release v${{ env.VERSION }}
@@ -107,7 +101,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.PAT_GITHUB }}
 
       - name: Publish to npm
-        run: npm publish --access public --provenance --tag ${{ github.event.inputs.dist_tag || 'latest' }}
+        run: npm publish --ignore-scripts --access public --provenance --tag "$DIST_TAG"
         env:
+          DIST_TAG: ${{ inputs.dist_tag || 'latest' }}
           # Restored the token here to ensure it works
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

README.md

@@ -175,7 +175,7 @@ All services are exposed through a consistent interface of MCP tools, resources,
 
 ## 🛠️ Prerequisites
 
-- [Bun](https://bun.sh/) 1.0.0 or higher (recommended)
+- [Bun](https://bun.sh/) 1.4.2 (the version used by CI)
 - Node.js 20.0.0 or higher (if not using Bun)
 - Optional: [Etherscan API key](https://etherscan.io/apis) for ABI fetching
 
@@ -187,7 +187,7 @@ git clone https://github.com/mcpdotdirect/evm-mcp-server.git
 cd evm-mcp-server
 
 # Install dependencies with Bun
-bun install
+bun install --frozen-lockfile
 
 # Or with npm
 npm install
@@ -747,6 +747,15 @@ evm-mcp-server/
 
 ## 🛠️ Development
 
+Run the complete migration checks before committing or publishing:
+
+```bash
+bun install --frozen-lockfile
+bun run check
+```
+
+This type-checks source and tests, builds both Node entry points, and runs the HTTP, OAuth, and modern/legacy stdio integration tests. Tests use local fixtures and do not submit blockchain transactions. CI runs the checks across Node 20, 22, 24, and 26. See [the migration notes](docs/mcp-2026-07-28-upgrade.md) for protocol decisions and dependency versions.
+
 To modify or extend the server:
 
 1. Add new services in the appropriate file under `src/core/services/`

docs/mcp-2026-07-28-upgrade.md

@@ -9,6 +9,10 @@ This repository targets the final MCP `2026-07-28` specification through the rel
 - SDK v1-to-v2 migration: https://github.com/modelcontextprotocol/typescript-sdk/blob/main/docs/migration/upgrade-to-v2.md
 - SDK `2026-07-28` support: https://github.com/modelcontextprotocol/typescript-sdk/blob/main/docs/migration/support-2026-07-28.md
 
+## Dependency Baseline
+
+Verified against the registry on September 13, 2026: the server, Node, Express, and test-client MCP packages are on stable `2.0.0`. Runtime dependencies include Express `5.2.1`, viem `2.56.5`, and Zod `4.6.4`; `bun.lock` pins the complete dependency graph. TypeScript `5.9.3` is a development dependency, not a peer requirement for consumers of the compiled CLI. Node types stay on the existing 22.x line rather than introducing Node 26-only APIs. The migration does not require the TypeScript 7 major upgrade.
+
 ## Final Alignment
 
 - Replaced `@modelcontextprotocol/sdk` v1 with:
@@ -29,6 +33,9 @@ This repository targets the final MCP `2026-07-28` specification through the rel
   - `Mcp-Method`
   - `Mcp-Name`
 - Added Host and Origin validation before the HTTP MCP handler.
+- Added application-level enforcement of the protocol-version header and both accepted response types, including `q=0` exclusions. These supplement SDK v2.0.0's header value validation.
+- Return JSON-RPC parse errors for malformed JSON and a JSON error for the 1 MB request limit; syntactically valid non-RPC JSON remains the SDK's responsibility.
+- Verified Base64 sentinel decoding for `Mcp-Name` and `x-mcp-header` parameter validation. Current EVM tools do not declare routing headers; an annotated test tool verifies missing, malformed, mismatched, and correctly encoded headers before handler execution.
 - Added MCP OAuth resource-server support for HTTP:
   - localhost can run without authorization
   - non-local binds fail closed unless OAuth is configured
@@ -52,6 +59,7 @@ This repository targets the final MCP `2026-07-28` specification through the rel
   - rejects tampering, argument changes, cross-token use, and replay
 - Bounded `wait_for_transaction` with `timeoutSeconds` from 1 through 90, defaulting to 90 seconds so it returns before the 120-second HTTP transport timeout.
 - Kept process diagnostics on `stderr`, including the npm CLI startup line, so stdio `stdout` contains protocol messages only.
+- The CLI uses its parent Node executable and propagates child startup failures. Server identity reads the package version at build time so version bumps update both entry points.
 
 ## Final-Spec Differences from the RC
 
@@ -108,17 +116,21 @@ The automated MCP integration tests cover:
 - cache hints on discovery, list, and resource results
 - resource reads and a read-only tool call
 - final `HeaderMismatch` and `UnsupportedProtocolVersion` error codes
+- real Express HTTP requests covering media types, required headers, Host/Origin rejection, parser errors, removed methods, and the SDK client
+- packaged Node CLI clients exercising tools, resource reads, and prompts over modern and legacy stdio, plus startup exit-code propagation
 - local authorization opt-out, remote fail-closed behavior, OAuth metadata validation, RFC 7662 introspection, audience checks, and scopes
 
 Release checks:
 
 ```bash
-bunx tsc --noEmit
-bun run test:mcp
-bun run build
-bun run build:http
+bun install --frozen-lockfile
+bun run check
+bun audit
+npm pack --dry-run --ignore-scripts
 ```
 
+`bun run check` type-checks source and tests, builds both entry points, then runs the complete test suite (including the built CLI). `bun run test:mcp` runs the suite against existing build output. Tests use localhost listeners and fixture credentials; they do not submit blockchain transactions. CI runs the checks with Node 20, 22, 24, and 26 and Bun 1.4.2. The manual release workflow uses Node 24, verifies the bumped package before committing, and pushes the commit and new tag atomically without rewriting existing tags or branches. No npm release is triggered by a normal branch push.
+
 ## Follow-up Work
 
 These are enhancements, not compliance blockers: