package.json

{
  "name": "github-rag-mcp",
  "version": "0.0.1",
  "private": true,
  "license": "Apache-2.0",
  "type": "module",
  "scripts": {
    "dev": "wrangler dev",
    "deploy": "wrangler deploy",
    "test": "vitest run && vitest run --config vitest.workers.config.ts"
  },
  "dependencies": {
    "@cloudflare/workers-oauth-provider": "^0.3.1",
    "@modelcontextprotocol/server": "2.0.0",
    "agents": "^0.20.1",
    "zod": "^4.0.0"
  },
  "devDependencies": {
    "@cloudflare/vitest-pool-workers": "^0.16.18",
    "@cloudflare/workers-types": "4.20260404.1",
    "typescript": "^5.5.0",
    "vitest": "^4.1.9",
    "wrangler": "^4.0.0"
  },
  "comments": {
    "overrides": "Pin @cloudflare/workers-types across the tree to the version the worker code is written against; the vitest-pool-workers toolchain otherwise pulls a newer one whose stricter AI binding types break src/rerank.ts (types-only; runtime unaffected).",
    "@modelcontextprotocol/server": "Exact, not a range: agents@0.20.x declares this package as a non-optional peer at exactly 2.0.0, so a caret here would let npm resolve a newer copy, nest 2.0.0 under agents/, and reproduce the two-copies type mismatch #227 was opened about. Exact makes the coupling loud — an agents bump that moves the peer fails at install time instead of at tsc.",
    "@modelcontextprotocol/sdk": "Deliberately absent. The worker no longer imports SDK v1 anywhere after the 2026-07-28 flip (#224); agents still needs it as a required peer, so npm installs it, but this package declares no range of its own to drift against agents' exact pin. The bridge keeps its own SDK v1 dependency for the Claude Desktop face (mcp-server/package.json).",
    "@modelcontextprotocol/client": "Deliberately absent for the same reason: only the bridge speaks client-side, and it declares its own copy. agents' required peer covers the install here."
  },
  "overrides": {
    "@cloudflare/workers-types": "$@cloudflare/workers-types"
  }
}