Cherry-pick: perf(protocol): the MCP client from @frontmcp/protocol/client, and tighter bundle-size budgets (#942, #943) by frontegg-david · Pull Request #947 · agentfront/frontmcp

frontegg-david · 2026-10-21T17:32:18Z

Cherry-pick to main

This PR brings #942 and #943, merged to release/1.10.x, to main as one PR. Each squash commit is picked in order with git cherry-pick -x. It replaces the per-PR cherry-picks the workflow opened (#945 and #946), which I'm closing in favor of this one.

Closes #886
Closes #885

Release PR	Commit on `release/1.10.x`	What it changes
#942	`fd012adb8`	`Client`, `StreamableHTTPClientTransport`, `SSEClientTransport` and `StdioClientTransport` move from `@frontmcp/protocol`'s root to `@frontmcp/protocol/client` (the CommonJS entry still loads the client lazily). Importers in the SDK, `@frontmcp/testing` and the specs moved with them.
#943	`71df5d8dc`	The bundle-size budgets come down to about 1% above the current sizes, and each `create()` bundle fails if acorn, acorn-walk, astring, the MCP SDK client modules or protocol's `client.mjs`/`clients.mjs` contribute any bytes. The skills bundle's js-yaml/vectoriadb pattern is anchored so it matches the metafile's paths.

Both applied without conflicts. The 36 files they change are identical to release/1.10.x, where both PRs passed CI (44 and 45 checks) with CodeRabbit's comments resolved.

Results

esbuild, browser condition, as the bundle-size test measures it:

Bundle	Before	After	New budget
`create()` + one tool	1,309,139 bytes	1,300,483 bytes	1,315,000 (was 1,560,000)
`create()` + WebMcpPlugin + one tool	1,316,452 bytes	1,307,783 bytes	1,322,000 (was 1,570,000)
Vite, initial chunk	948,317 bytes	948,317 bytes	960,000 (was 1,180,000)

Tests

CI runs here on main, on the same files that passed on release/1.10.x.

Summary by CodeRabbit

New Features
- Added a dedicated @frontmcp/protocol/client entry point for client classes and transports.
- Client functionality is now available without loading server-focused protocol code into browser or Worker bundles.
Performance
- Reduced browser bundle-size budgets and added safeguards preventing unnecessary parser and MCP client code from being included.
Documentation
- Updated protocol documentation with the new client import path and export guidance.
Tests
- Added coverage validating client exports and bundle contents.

…p/protocol/client (#942) The package root re-exported #client, so every importer of @frontmcp/protocol pulled in the MCP SDK's client modules: a browser or Worker bundle of a server kept shared/auth.js's OAuth schemas and the client modules' side effects even though an in-process server never builds a client. The client, its Streamable HTTP and SSE transports and the stdio client now come from the @frontmcp/protocol/client subpath, which re-exports #client and so keeps its lazy require() variant. The direct client, the remote-MCP client service, @frontmcp/testing's raw client and the tests import them from there. (cherry picked from commit fd012ad)

… parser and the MCP client out (#943) * test(bundle-size): lower the create() budgets and keep the JavaScript parser and the MCP client out #921 took @enclave-vm/ast's parser (acorn, acorn-walk, astring) out of every browser bundle, and #886 the MCP client, but the suite's budgets still allowed 1.56 MB and 1.57 MB for create() + one tool (+ WebMcpPlugin) and 1.18 MB for a Vite app's initial chunk. The budgets now sit about 1% above the current sizes (1,300,483, 1,307,783 and 948,317 bytes), and a new test fails when the parser or the MCP client's modules contribute any bytes to either bundle, naming the import chain. The skills pattern's node_modules alternative is anchored like the inputs it matches, which are relative to the workspace root. * test(bundle-size): treat the client subpath's entry as part of the MCP client @frontmcp/protocol/client resolves to libs/protocol/dist/esm/clients.mjs, so the never-bundled pattern matches it as well as #client's client.mjs. (cherry picked from commit 71df5d8)

coderabbitai · 2026-10-21T17:32:33Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: agentfront/frontmcp/.coderabbit.yaml
Review profile: CHILL
Plan: Essentials
Run ID: 4dd689f9-32b8-45fc-b549-9383eaa1195f

📥 Commits

Reviewing files that changed from the base of the PR and between 7e69f1d and 847ab12.

📒 Files selected for processing: 36

apps/e2e/demo-e2e-bundle-size/e2e/browser-bundle-size.e2e.spec.ts
eslint.config.mjs
libs/protocol/README.md
libs/protocol/package.json
libs/protocol/project.json
libs/protocol/src/__tests__/exports.spec.ts
libs/protocol/src/clients.ts
libs/protocol/src/index.ts
libs/sdk/project.json
libs/sdk/src/agent/__tests__/agent-context-wiring.spec.ts
libs/sdk/src/agent/__tests__/agent-streaming.spec.ts
libs/sdk/src/direct/__tests__/connect.spec.ts
libs/sdk/src/direct/__tests__/direct-client.spec.ts
libs/sdk/src/direct/direct-client.ts
libs/sdk/src/remote-mcp/mcp-client.service.ts
libs/sdk/src/remote-mcp/mcp-client.types.ts
libs/sdk/src/skill/__tests__/skill-filter.flow.spec.ts
libs/sdk/src/transport/__tests__/in-memory-server.initialize.spec.ts
libs/sdk/src/transport/in-memory-server.ts
libs/sdk/src/transport/index.ts
libs/sdk/tsconfig.lib.json
libs/testing/src/raw-client/index.ts
libs/testing/tsconfig.lib.json
plugins/plugin-approval/src/__tests__/approval.refusal-result.spec.ts
plugins/plugin-codecall/src/__tests__/codecall-access-control.flow.spec.ts
plugins/plugin-codecall/src/__tests__/codecall-direct-call.flow.spec.ts
plugins/plugin-codecall/src/__tests__/codecall-execute-hardening.flow.spec.ts
plugins/plugin-codecall/src/__tests__/codecall-execute-results.flow.spec.ts
plugins/plugin-codecall/src/__tests__/codecall-invoke-output-schema.flow.spec.ts
plugins/plugin-codecall/src/__tests__/codecall-options.flow.spec.ts
plugins/plugin-codecall/src/__tests__/codecall-skill-filter.flow.spec.ts
plugins/plugin-codecall/src/__tests__/codecall-surface.flow.spec.ts
plugins/plugin-codecall/src/__tests__/script-error-codes.flow.spec.ts
plugins/plugin-skilled-openapi/src/__tests__/skills-surface-before-load.spec.ts
plugins/plugin-skilled-openapi/tsconfig.spec.json
tsconfig.base.json

💤 Files with no reviewable changes: 1

libs/protocol/src/index.ts

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The protocol package now exposes client APIs through @frontmcp/protocol/client rather than its root. SDK and related imports use the subpath. Browser bundle budgets and leak checks were updated.

Changes: Protocol Client Subpath

Layer / File(s)	Summary
Define and publish the client subpath `libs/protocol/src/clients.ts`, `libs/protocol/src/index.ts`, `libs/protocol/package.json`, `libs/protocol/project.json`, `libs/protocol/src/__tests__/exports.spec.ts`, `libs/protocol/README.md`, `tsconfig.base.json`, `libs/sdk/tsconfig.lib.json`, `libs/testing/tsconfig.lib.json`, `plugins/plugin-skilled-openapi/tsconfig.spec.json`, `eslint.config.mjs`	The protocol package adds a `client` entry point and build targets. Client APIs are removed from the root exports and tested under the subpath. Documentation, TypeScript mappings, and the import allowlist identify the new path.
Route client imports through the subpath `libs/sdk/project.json`, `libs/sdk/src/...`, `libs/testing/src/raw-client/index.ts`, `plugins/plugin-approval/src/__tests__/approval.refusal-result.spec.ts`, `plugins/plugin-codecall/src/__tests__/*`, `plugins/plugin-skilled-openapi/src/__tests__/skills-surface-before-load.spec.ts`	SDK, testing, and plugin code and tests import client APIs from `@frontmcp/protocol/client`. SDK builds externalize protocol subpaths.
Enforce browser bundle budgets `apps/e2e/demo-e2e-bundle-size/e2e/browser-bundle-size.e2e.spec.ts`	Browser bundle budgets are lower. The skills dependency matcher covers paths with segments before `node_modules`. A parameterized test checks both browser bundles for parser and MCP client leaks and reports import chains.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Refactor · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 847ab

No actionable merge-blocking risk remains from the reviewed change.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies both primary changes: moving the MCP client to `@frontmcp/protocol/client` and tightening bundle-size budgets. It is somewhat long but remains specific and relevant.
Description check		The description explains the cherry-pick purpose, lists the included changes, documents the user-facing package-path change, reports bundle-size results, and identifies the tests run. It does not use …
Linked Issues check		The PR meets the coding requirements for `#886` and `#885`. For `#886`, it adds the `@frontmcp/protocol/client` export, moves SDK and testing runtime imports, updates TypeScript and build configuration, and…
Out of Scope Changes check		The changes remain within `#886` and `#885`. README updates, module-boundary configuration, build entry updates, path aliases, import changes, export tests, and bundle diagnostics directly support the cli…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

Full details: Description check

Explanation

The description explains the cherry-pick purpose, lists the included changes, documents the user-facing package-path change, reports bundle-size results, and identifies the tests run. It does not use every template heading or bullet, but it provides the required information in equivalent sections.

Full details: Linked Issues check

Explanation

The PR meets the coding requirements for #886 and #885. For #886, it adds the @frontmcp/protocol/client export, moves SDK and testing runtime imports, updates TypeScript and build configuration, and adds export tests. The tests verify client exports in the subpath and their absence from the package root. For #885, it lowers the browser bundle budgets and adds NEVER_BUNDLED checks for acorn, acorn-walk, astring, and MCP client modules in both create() bundles. No safe-regex implementation or test changes are reported, so the existing behavior remains unchanged.

Full details: Out of Scope Changes check

Explanation

The changes remain within #886 and #885. README updates, module-boundary configuration, build entry updates, path aliases, import changes, export tests, and bundle diagnostics directly support the client subpath migration or bundle exclusions. No unrelated product behavior is introduced.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 27 files. (8 skipped: 8 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-21T17:45:55Z

Performance Test Results

Status: ✅ All tests passed

Summary

Project	Tests	Passed
✅ demo-e2e-agents	4	4
✅ demo-e2e-cache	11	11
✅ demo-e2e-codecall	4	4
✅ demo-e2e-config	4	4
✅ demo-e2e-direct	3	3
✅ demo-e2e-elicitation	1	1
✅ demo-e2e-errors	4	4
✅ demo-e2e-hooks	3	3
✅ demo-e2e-multiapp	4	4
✅ demo-e2e-notifications	3	3
✅ demo-e2e-openapi	2	2
✅ demo-e2e-providers	4	4
✅ demo-e2e-public	4	4
✅ demo-e2e-redis	15	15
✅ demo-e2e-remember	4	4
✅ demo-e2e-remote	5	5
✅ demo-e2e-serverless	2	2
✅ demo-e2e-skills	15	15
✅ demo-e2e-standalone	2	2
✅ demo-e2e-transport-recreation	3	3
✅ demo-e2e-ui	4	4

Total: 101 tests across 21 projects

📊 View full report in workflow run

Generated at: 2026-10-21T17:45:54.158Z
Commit: 062172d7

frontegg-david added 2 commits October 21, 2026 20:32

This was referenced Oct 21, 2026

Cherry-pick: test(bundle-size): lower the create() budgets and keep the JavaScript parser and the MCP client out #946

Closed

Cherry-pick: perf(protocol): serve the MCP client and its transports from @frontmcp/protocol/client #945

Closed

frontegg-david merged commit 922a488 into main Oct 21, 2026
44 checks passed

frontegg-david deleted the perf/1.10.x-942-943-cherry-pick-main branch October 21, 2026 17:46

coderabbitai Bot mentioned this pull request Oct 25, 2026

fix(sdk): serve a legacy SSE message post whatever its Accept header says #958

Merged

coderabbitai Bot mentioned this pull request Nov 2, 2026

perf(sdk): cut first-request and ESM startup costs that come from dependencies #1007

Merged

Navigation Menu

Repository navigation

Cherry-pick: perf(protocol): the MCP client from @frontmcp/protocol/client, and tighter bundle-size budgets (#942, #943) - #947

Cherry-pick: perf(protocol): the MCP client from @frontmcp/protocol/client, and tighter bundle-size budgets (#942, #943)#947
frontegg-david merged 2 commits into
mainfrom
perf/1.10.x-942-943-cherry-pick-main

frontegg-david commented Oct 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

frontegg-david commented Oct 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Cherry-pick to main

Results

Tests

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 21, 2026

Performance Test Results

Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

frontegg-david commented Oct 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading