[v2] Decouple server from express and hono - http framework-agnostic MCP server

[KKonstantinov]

v1 included express (and hono in recent version), forcing the dependency down to users. (express being >1MB along with middleware deps such as express-rate-limit etc.).

Achieving final & true implementation of #1299

This PR decouples @modelcontextprotocol/server from HTTP frameworks completely, and introduces two plugin packages @modelcontextprotocol/server-express and @modelcontextprotocol/server-hono.

The plugin packages are optional, and users could choose to use them or to map to the MCP SDK themselves and not using any of these plugins.

However, the @modelcontextprotocol/server is completely HTTP framework dependency-free.

Some additional changes:

• Renamed StreamableHTTPServerTransport to NodeStreamableHTTPServerTransport
• Added linting rule to avoid inline type imports (e.g. import { A, type B}). Prefer import type { B } and import { A } on separate lines.
• Removed express dependency from @modelcontextprotocol/server completely
• introduced @modelcontextprotocol/server-express and @modelcontextprotocol/server-hono - each having its own minimum dependencies
• Removed sse transport for server (deprecated)
• Removed server auth
• Replaced examples for server auth with an OAuth library (e.g. better-auth)
• Wrote up FAQ sections for removing SSE from server and removing auth from server
• Tested better-auth server auth demo examples with @modelcontextprotocol/inspector

Motivation and Context

v2

How Has This Been Tested?

Unit tests

Breaking Changes

v2

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

node_modules size

package	size (MB) - this PR	main	v1
@modelcontextprotocol/client	6MB	6MB	34M
@modelcontextprotocol/server	27MB	31MB	34M

Biggest offender in server is zod-to-json-schema - 19MB still.

TODO: Consider if zod v3 is to be supported in v2 -> will reduce package dependency size on server to 12MB.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f5ab824

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1326

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1326

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-express@1326

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server-hono@1326

commit: f5ab824

[KKonstantinov]

Notes:

• Removed express dependency from @modelcontextprotocol/server completely
• introduced @modelcontextprotocol/server-express and @modelcontextprotocol/server-hono - each having its own minimum dependencies
• Removed sse transport for server (deprecated)
• Removed server auth
• Replaced examples for server auth with an OAuth library (e.g. better-auth)
• Wrote up FAQ sections for removing SSE from server and removing auth from server
• Tested better-auth server auth demo examples with @modelcontextprotocol/inspector

TODOs still:

• Converting a Node request to web stanards request still relies on @hono/node-server in @modelcontextprotocol/server - Hono is a minimal dependency and used just for the mapping, but would still like to explore a solution not requiring a full web framework dependency in /server
• Update README.md
• Consider if zod v3 is to be supported in v2 -> will reduce package dependency size on server to 12MB.

node_modules size

package	size (MB) - this PR	main	v1
@modelcontextprotocol/client	6MB	6MB	34M
@modelcontextprotocol/server	27MB	31MB	34M

Biggest offender in server is zod-to-json-schema - 19MB still.

TODO: Consider if zod v3 is to be supported in v2 -> will reduce package dependency size on server to 12MB.