
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@frontmcp/protocol
Advanced tools
Centralized MCP protocol types, server, and client re-exports for FrontMCP
The single boundary between FrontMCP and the upstream
@modelcontextprotocol/sdk.
Internal package. It is published so the other
@frontmcp/*packages can resolve it — you should not import it from application code. Import MCP types from@frontmcp/sdkinstead, and useMcpClientfrom@frontmcp/testingfor a raw client in tests.
libs/protocol/src/types.ts is the only file in the whole monorepo that
transitively imports @modelcontextprotocol/sdk. Everything else — SDK,
adapters, plugins, auth, tests — imports from @frontmcp/protocol.
That indirection means swapping, pinning, or dropping the upstream package is a
one-file change instead of a repo-wide refactor. The
@nx/dependency-checks lint rule enforces it: adding a direct
upstream import anywhere else fails the build.
✅ Route through the boundary:
import { CallToolRequestSchema, McpError, type Tool } from '@frontmcp/protocol';
❌ Never import the upstream package directly — that locks every call site to it:
import { McpError } from '@modelcontextprotocol/sdk/types.js';
If a type you need is not reachable from @frontmcp/protocol, re-export it from
libs/protocol/src/types.ts rather than reaching around the boundary.
| Area | Contents |
|---|---|
| Protocol types | Requests, results, notifications, schemas, McpError, capabilities |
| Protocol 2026-07-28 | Types the upstream SDK does not ship yet — see below |
| Server | McpServer, StreamableHTTPServerTransport, WebStandardStreamableHTTPServerTransport |
| Client | Client, StreamableHTTPClientTransport, SSEClientTransport |
| Transports | stdio (Node + browser), in-memory |
| Auth types | AuthInfo and friends |
Node and browser/worker variants are selected automatically through package subpath imports, so the same import works in every runtime FrontMCP targets.
The upstream SDK tops out at 2025-11-25. Revision 2026-07-28 is therefore
defined here — MCP_20260728_META, MCP_20260728_ERROR_CODES, CacheableResult,
DiscoverResult, InputRequiredResult, SubscriptionFilter, and the rest.
Everything is additive: the 2025-and-earlier types are untouched, because a
FrontMCP server serves both eras on the same endpoint. When upstream catches up,
types-20260728.ts is the only file that has to change.
See the protocol versions guide for what the revision changed and how FrontMCP selects one per request.
Apache-2.0
FAQs
Centralized MCP protocol types, server, and client re-exports for FrontMCP
We found that @frontmcp/protocol demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.