Summary

Restore the adapter's main MCP client and test servers to @modelcontextprotocol/sdk v1. Remove the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5 and @modelcontextprotocol/server@2.0.0-beta.5 packages introduced by #210.

This keeps all independent features and fixes added after the migration. It also keeps the client conformance harness.

Closes #236.

Why

The v2 beta passes its conformance suite, but it breaks interoperability with deployed MCP servers that work with SDK v1:

• Atlassian OAuth issuer metadata fails before consent: [Bug]: RFC 8414 §3.3 issuer mismatch on authv2 blocks strict MCP OAuth clients (IssuerMismatchError) atlassian/atlassian-mcp-server#205
• SDK v1 servers can emit Draft-07 schemas that the v2 default rejects: [SEP-1613 regression] tools/list still emits draft-07 in 1.29.0 — target option missing from mcp.js toJsonSchemaCompat calls modelcontextprotocol/typescript-sdk#2084
• Legacy servers can reject server/discover without reaching classic initialize: v1.18.8 remote MCP fails: server/discover probe rejected by server (-32700), no fallback to classic initialize anomalyco/opencode#39354
• OpenCode recorded additional Xcode startup and ReUI OAuth failures, then reverted its v2 migration: fix(mcp): restore legacy SDK compatibility anomalyco/opencode#39373

The per-server opt-out proposed in #224 addresses only the Atlassian issuer check. It does not address the other startup, schema, and OAuth regressions.

Changes

• Port client, transport, sampling, elicitation, prompt, session-recovery, UI, and Unix-socket integrations to SDK v1 APIs.
• Port stdio fixtures and the interactive visualizer to the SDK v1 server APIs.
• Keep unstamped and explicit JSON Schema 2020-12 validation, plus explicit Draft-07 validation.
• Keep OAuth authorization-server issuer binding and RFC 9207 callback issuer validation outside the SDK v1 types.
• Fail closed if stored client or token issuer bindings differ from the discovered issuer.
• Add a legacy handshake regression that proves classic initialize works without server/discover.
• Keep the conformance harness and isolate its credential store for deterministic runs.
• Document the rollback and the temporary loss of SDK v2-only protocol negotiation.

Security

SDK v1 does not provide the v2 issuer-stamping types. This PR retains equivalent local protection:

• Client registrations and tokens bind to the discovered authorization-server issuer.
• Both stored components are validated before either component is back-stamped.
• Configured client secrets never enter persistent storage.
• Missing or mismatched RFC 9207 callback issuers fail before token exchange.

Compatibility trade-off

This temporarily removes SDK v2-only protocol negotiation. A future v2 migration should wait for a stable client and include deployed-server compatibility tests for legacy initialization, mixed JSON Schema dialects, and OAuth metadata variants.

Verification

• npm ci
• npm run --prefix examples/interactive-visualizer build
• npx tsc --noEmit
• npm test — 82 files, 802 tests passed
• npm run test:oauth — 109 tests passed
• npm run test:conformance — all 26 scenarios passed or matched the reviewed baseline
• npm pack --dry-run — 55 files
• git diff --check

No package version change is included.