fix(ci): rebuild the MCP bundle so main is green again

[ericlovold]

Why

Every push to main since the dependency batches (#270, #273) fails CI at MCP bundle freshness: the committed packages/sanction-mcp/mcp-server.js no longer matches what npm run build:mcp produces, because the bundled @modelcontextprotocol/sdk changed. All five sprint PRs inherited the red build job from main. Same failure mode as #263.

What

npm run build:mcp, commit the artifact. No source change.

Follow-up worth queuing

Dependabot batches that touch @modelcontextprotocol/sdk (or anything bundled) should rebuild the bundle in the same PR, or the freshness job should run the rebuild and commit it on dependabot branches. Otherwise main goes red after every SDK bump.

🤖 Generated with Claude Code

---

Note

Low Risk
Bundled SDK refresh with stricter stdin buffering and richer validation errors; low risk unless clients send very large stdio payloads or depend on the old single-issue error text.

Overview
Refreshes the committed packages/sanction-mcp/mcp-server.js artifact so it matches npm run build:mcp and CI’s bundle-freshness check passes after the bundled @modelcontextprotocol/sdk moved forward—no app source edits.

The new SDK bits in the bundle add stdio read hardening: ReadBuffer enforces a default 10 MB cap (configurable via transport options), and StdioServerTransport surfaces append failures through onerror and closes the transport. Tool/request validation errors now list all Zod issues with dot-path locations instead of only the first message. setRequestHandler reads the RPC method literal via shared getLiteralValue instead of duplicated Zod v3/v4 extraction.

^{Reviewed by Cursor Bugbot for commit 226feff. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sanction	Ready	Preview	Sep 2, 2026 5:57pm UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: ee5efa68-b5bd-4b3f-bcc1-c09e3b258cf9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3668aec0-3ef2-485c-b402-7fe7684f870b)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_27078a26-9991-48a6-9ab9-6a4a1d5df59f)