From 1681a0deda614d16a94ef39ac237b84390ec8208 Mon Sep 17 00:00:00 2001
From: "D. Michael Piscitelli" <hello@herakles.dev>
Date: Fri, 13 Mar 2026 07:16:02 +0100
Subject: [PATCH] fix: declare bundled runtime dependencies for strict package
 managers

The root package bundles cli/server/client build output via `files` and runs it
through the mcp-inspector bin, but does not declare the runtime deps those bundled
files import (commander, cors, express, express-rate-limit, serve-handler). They
only resolve under default pnpm hoisting; strict resolvers (pnpm hoist=false, Yarn
PnP) fail with ERR_MODULE_NOT_FOUND.

Fixes #873.
---
 package-lock.json | 31 +++++++++++++++++++------------
 package.json      |  5 +++++
 2 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d70bf35ae..85cb3a609 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,9 +18,14 @@
         "@modelcontextprotocol/inspector-client": "^1.0.0",
         "@modelcontextprotocol/inspector-server": "^1.0.0",
         "@modelcontextprotocol/sdk": "^1.25.2",
+        "commander": "^13.1.0",
         "concurrently": "^9.2.0",
+        "cors": "^2.8.5",
+        "express": "^5.2.1",
+        "express-rate-limit": "^8.2.1",
         "node-fetch": "^3.3.2",
         "open": "^10.2.0",
+        "serve-handler": "^6.1.6",
         "shell-quote": "^1.8.4",
         "spawn-rx": "^5.1.2",
         "ts-node": "^10.9.2",
@@ -65,13 +70,6 @@
         "vitest": "^4.1.0"
       }
     },
-    "cli/node_modules/commander": {
-      "version": "13.1.0",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "client": {
       "name": "@modelcontextprotocol/inspector-client",
       "version": "1.0.0",
@@ -5703,13 +5701,12 @@
       }
     },
     "node_modules/commander": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
-      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
-      "dev": true,
+      "version": "13.1.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-13.1.0.tgz",
+      "integrity": "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==",
       "license": "MIT",
       "engines": {
-        "node": ">=20"
+        "node": ">=18"
       }
     },
     "node_modules/concat-map": {
@@ -9352,6 +9349,16 @@
         "url": "https://opencollective.com/lint-staged"
       }
     },
+    "node_modules/lint-staged/node_modules/commander": {
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
+      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/lint-staged/node_modules/picomatch": {
       "version": "4.0.5",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
diff --git a/package.json b/package.json
index 42d3fb904..753a4d789 100644
--- a/package.json
+++ b/package.json
@@ -56,9 +56,14 @@
     "@modelcontextprotocol/inspector-client": "^1.0.0",
     "@modelcontextprotocol/inspector-server": "^1.0.0",
     "@modelcontextprotocol/sdk": "^1.25.2",
+    "commander": "^13.1.0",
     "concurrently": "^9.2.0",
+    "cors": "^2.8.5",
+    "express": "^5.2.1",
+    "express-rate-limit": "^8.2.1",
     "node-fetch": "^3.3.2",
     "open": "^10.2.0",
+    "serve-handler": "^6.1.6",
     "shell-quote": "^1.8.4",
     "spawn-rx": "^5.1.2",
     "ts-node": "^10.9.2",