diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 67dfa3aa..fe72e0df 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,3 +8,14 @@ updates: interval: "daily" commit-message: prefix: "chore(deps)" + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "daily" + allow: + - dependency-name: "@supabase/mcp-server-supabase" + cooldown: + exclude: + - "@supabase/mcp-server-supabase" + commit-message: + prefix: "chore(deps)" diff --git a/apps/framework/harness/mcp-tools.ts b/apps/framework/harness/mcp-tools.ts index b6977af0..18f7bd87 100644 --- a/apps/framework/harness/mcp-tools.ts +++ b/apps/framework/harness/mcp-tools.ts @@ -1,6 +1,5 @@ export { executorMcpServer, - MCP_SERVER_VERSION, supabaseMcpServer, } from '@supabase-evals/core'; export type { diff --git a/apps/framework/scripts/mcp-demo.ts b/apps/framework/scripts/mcp-demo.ts index 7bc2772a..b784cc16 100644 --- a/apps/framework/scripts/mcp-demo.ts +++ b/apps/framework/scripts/mcp-demo.ts @@ -12,8 +12,10 @@ import { createMCPClient } from '@ai-sdk/mcp'; import { Experimental_StdioMCPTransport as StdioMCPTransport } from '@ai-sdk/mcp/mcp-stdio'; import { openai } from '@ai-sdk/openai'; import { generateText, stepCountIs } from 'ai'; -import { createPlatform } from '@supabase-evals/platform-lite'; -import { MCP_SERVER_VERSION } from '../harness/mcp-tools.js'; +import { + createPlatform, + MCP_SERVER_VERSION, +} from '@supabase-evals/platform-lite'; const ACCESS_TOKEN = 'demo-token'; diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts index 2cfe476f..999ffc4a 100644 --- a/packages/core/src/index.ts +++ b/packages/core/src/index.ts @@ -33,6 +33,7 @@ import { createManagementApiClient, createPlatform, loadFunctionSeeds, + MCP_SERVER_VERSION, type ManagementApiClient, type PgServerHandle, type PlatformHandle, @@ -1415,7 +1416,6 @@ async function getAvailablePort(): Promise { } export const ACCESS_TOKEN = 'eval-token'; -export const MCP_SERVER_VERSION = '0.16.0'; // Well-formed but inert PAT used when a Supabase MCP server is docs-only: the // server requires a token to boot but never authenticates without a platform. const THROWAWAY_ACCESS_TOKEN = `sbp_${'0'.repeat(40)}`; diff --git a/packages/core/src/mcp-server.test.ts b/packages/core/src/mcp-server.test.ts index 21d5ec26..a32d8cde 100644 --- a/packages/core/src/mcp-server.test.ts +++ b/packages/core/src/mcp-server.test.ts @@ -9,7 +9,10 @@ import { } from 'vitest'; import { execFile, execFileSync } from 'node:child_process'; import { promisify } from 'node:util'; -import { createPlatform } from '@supabase-evals/platform-lite'; +import { + createPlatform, + MCP_SERVER_VERSION, +} from '@supabase-evals/platform-lite'; import { rewriteLoopback } from './agents/shared.js'; import { mkdirSync, @@ -21,11 +24,7 @@ import { } from 'node:fs'; import { join, relative } from 'node:path'; import { tmpdir } from 'node:os'; -import { - MCP_SERVER_VERSION, - supabaseMcpServer, - supabaseMcpServerMounts, -} from './index.js'; +import { supabaseMcpServer, supabaseMcpServerMounts } from './index.js'; // Stub (not mutate) env so a pre-existing SUPABASE_MCP_SERVER_PATH is restored // per test. diff --git a/packages/core/src/mcp-version.test.ts b/packages/core/src/mcp-version.test.ts new file mode 100644 index 00000000..5416b839 --- /dev/null +++ b/packages/core/src/mcp-version.test.ts @@ -0,0 +1,18 @@ +import { afterEach, expect, it, vi } from 'vitest'; + +afterEach(() => { + vi.doUnmock('../../platform-lite/package.json'); + vi.resetModules(); +}); + +it('rejects a version range before configuring the MCP server', async () => { + vi.doMock('../../platform-lite/package.json', () => ({ + default: { + devDependencies: { '@supabase/mcp-server-supabase': '^0.16.1' }, + }, + })); + + await expect(import('./index.js')).rejects.toThrow( + 'MCP version must be an exact stable version' + ); +}); diff --git a/packages/platform-lite/package.json b/packages/platform-lite/package.json index a1523dc0..96be10e5 100644 --- a/packages/platform-lite/package.json +++ b/packages/platform-lite/package.json @@ -29,7 +29,7 @@ }, "devDependencies": { "@modelcontextprotocol/server": "^2.4.0", - "@supabase/mcp-server-supabase": "^0.16.0", + "@supabase/mcp-server-supabase": "0.16.1", "@types/node": "catalog:", "openapi-typescript": "^7.8.0", "tsx": "^4.21.0", diff --git a/packages/platform-lite/src/index.ts b/packages/platform-lite/src/index.ts index 02aa0267..13279b73 100644 --- a/packages/platform-lite/src/index.ts +++ b/packages/platform-lite/src/index.ts @@ -1,3 +1,6 @@ +import { z } from 'zod'; +import platformLitePackage from '../package.json' with { type: 'json' }; + export { createPlatform } from './app.js'; export type { PlatformHandle, ServerHandle, PgServerHandle } from './app.js'; export type { @@ -11,3 +14,10 @@ export type { ProjectInstance } from './project/ProjectInstance.js'; export { createManagementApiClient } from './management-api/client.js'; export type { ManagementApiClient } from './management-api/client.js'; export { loadFunctionSeeds } from './seed.js'; +export const MCP_SERVER_VERSION = z + .string() + .regex( + /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/, + 'MCP version must be an exact stable version' + ) + .parse(platformLitePackage.devDependencies['@supabase/mcp-server-supabase']); diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a9f3d97c..2d7dc859 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -377,8 +377,8 @@ importers: specifier: ^2.4.0 version: 2.4.0 '@supabase/mcp-server-supabase': - specifier: ^0.16.0 - version: 0.16.0(@modelcontextprotocol/server@2.4.0)(zod@4.6.7) + specifier: 0.16.1 + version: 0.16.1(@modelcontextprotocol/server@2.4.0)(zod@4.6.7) '@types/node': specifier: 'catalog:' version: 22.19.20 @@ -2182,8 +2182,8 @@ packages: vite: optional: true - '@supabase/mcp-server-supabase@0.16.0': - resolution: {integrity: sha512-wDOkM4h4hMks9XnFDaiUWtBxNXKjR8vHedTkL9NVuSsg9AE+xt7Tc3JoRclXGiSg3a8RxfGO1W7MfoRJ3dBJHg==} + '@supabase/mcp-server-supabase@0.16.1': + resolution: {integrity: sha512-iMKxko3/chtykeaAq2N7YkE0eeWJOv/zPGbhOFSiOKSIqvIHIDtr82fxTVKA3HP+e0yUu7Y4h+YIcHVh1E+EBg==} hasBin: true peerDependencies: '@modelcontextprotocol/server': ^2.0.0 @@ -6434,7 +6434,7 @@ snapshots: - supports-color - typescript - '@supabase/mcp-server-supabase@0.16.0(@modelcontextprotocol/server@2.4.0)(zod@4.6.7)': + '@supabase/mcp-server-supabase@0.16.1(@modelcontextprotocol/server@2.4.0)(zod@4.6.7)': dependencies: '@mjackson/multipart-parser': 0.10.1 '@modelcontextprotocol/node': 2.1.2(@modelcontextprotocol/server@2.4.0)