v1.11.0-rc.1

Release v1.11.0-rc.1

Release type: rc
Release line: 1.11.x
Branch: release/1.11.x

Installation

npm install @frontmcp/sdk@1.11.0-rc.1

Note: This is a pre-release version.

What's Changed

• chore: sync version to v1.10.0 by @github-actions[bot] in #889
• Cherry-pick: fix(sdk): break the schema import cycle that broke multi-entry browser bundles by @github-actions[bot] in #891
• chore: sync version to v1.10.1 by @github-actions[bot] in #892
• Cherry-pick: fix(sdk): name star re-exports in the browser build, which single-file bundles lost by @github-actions[bot] in #894
• chore: sync version to v1.10.2 by @github-actions[bot] in #895
• Cherry-pick: fix(protocol): upgrade @modelcontextprotocol/sdk to 1.32.1 (GHSA-6qxp-vccf-f47h) by @github-actions[bot] in #897
• chore: sync version to v1.10.3 by @github-actions[bot] in #898
• Cherry-pick: fix(nx-plugin): name the docs MCP server's host and tools in new workspaces by @github-actions[bot] in #900
• chore: sync version to v1.10.4 by @github-actions[bot] in #902
• Cherry-pick: feat(sdk): serve MCP 2026-07-28 over stdio alongside the initialize revisions by @github-actions[bot] in #903
• chore: sync version to v1.10.5 by @github-actions[bot] in #904
• Cherry-pick: chore(sdk): describe the package as frontmcp.dev and the repository do by @github-actions[bot] in #906
• chore: sync version to v1.10.6 by @github-actions[bot] in #907
• Cherry-pick: fix(security): upgrade mcp-from-openapi to 2.9.1, and report privately on GitHub by @github-actions[bot] in #909
• chore: sync version to v1.10.7 by @github-actions[bot] in #910
• Cherry-pick: docs(readme): open with what FrontMCP is, in text, and link npm's homepage to frontmcp.dev by @github-actions[bot] in #912
• chore: sync version to v1.10.8 by @github-actions[bot] in #913
• Cherry-pick: perf(sdk): halve the server CPU of a tools/call over Streamable HTTP by @github-actions[bot] in #918
• Cherry-pick: perf: faster cold start and less memory after startup (#919 to #925, #932) by @frontegg-david in #931
• Cherry-pick: perf: load less at startup (#934, #935, #937) by @frontegg-david in #941
• Cherry-pick: perf(protocol): the MCP client from @frontmcp/protocol/client, and tighter bundle-size budgets (#942, #943) by @frontegg-david in #947
• chore: sync version to v1.10.9 by @github-actions[bot] in #952
• Cherry-pick: fix(plugins,edge): declare @enclave-vm/ast ^2.17.0 where the bundled ReDoS check imports it by @github-actions[bot] in #954
• chore: sync version to v1.10.10 by @github-actions[bot] in #955
• Cherry-pick: ci(e2e): pin Verdaccio to 6, since 7 rejects the e2e publish token by @github-actions[bot] in #960
• Cherry-pick: fix(sdk): serve a legacy SSE message post whatever its Accept header says by @github-actions[bot] in #961
• chore: sync version to v1.10.11 by @github-actions[bot] in #962
• Cherry-pick: fix(sdk): release a Worker's per-request MCP server when its streamed reply ends by @github-actions[bot] in #964
• chore: sync version to v1.10.12 by @github-actions[bot] in #965
• Cherry-pick: fix(sdk): answer a malformed request with Invalid params, and log no error for a client's mistake by @github-actions[bot] in #967
• chore: sync version to v1.10.13 by @github-actions[bot] in #968
• Cherry-pick: fix(plugin-cache): skip the cache for a caller with no identity by @github-actions[bot] in #974
• Cherry-pick: fix(plugin-skilled-openapi): connect to the addresses the outbound check resolved by @github-actions[bot] in #975
• chore: sync version to v1.10.14 by @github-actions[bot] in #976
• Cherry-pick: fix(plugin-skilled-openapi): report a 204 or 205 answer as a success by @github-actions[bot] in #978
• chore: sync version to v1.10.15 by @github-actions[bot] in #979
• Cherry-pick: fix(sdk): run Finally hooks on every stage outcome and close spans for refused answers by @github-actions[bot] in #989
• Cherry-pick: fix(sdk): list union output schemas and stop stripping undeclared output keys silently by @github-actions[bot] in #990
• Cherry-pick: fix(sdk): type hook ctx parameters against their flow and add typed flow accessors by @github-actions[bot] in #991
• Cherry-pick: fix(sdk): check Origin on loopback, bind unix sockets owner-only and dispose scopes on stdio shutdown by @github-actions[bot] in #992
• Cherry-pick: fix(sdk): document hook priority order, sort the hook registry in run order and print the resolved order in dev mode by @github-actions[bot] in #993
• Cherry-pick: fix(sdk): send no numeric skill resource annotation and a compact skills line in the instructions by default by @github-actions[bot] in #994
• Cherry-pick: fix(sdk): derive a provider's name from its token and add a CommonJS unit Jest preset by @github-actions[bot] in #995
• chore: sync version to v1.10.16 by @github-actions[bot] in #998
• feat(sdk): provider lifecycle hooks (onBootstrap, onReady, onShutdown) and createContainer() by @frontegg-david in #988
• feat(storage): a local SQLite store several processes can share by @frontegg-david in #996
• feat(utils): a process supervision kit, and stdio servers that exit when orphaned by @frontegg-david in #999
• feat(sdk): tool aliases, and refusals that carry a remedy by @frontegg-david in #1000
• feat(sdk): answer budget, client profiles, an answer cost meter and forwarded headers by @frontegg-david in #1001
• feat(plugins): a result handles plugin that folds large answers behind a handle by @frontegg-david in #1003
• feat(sdk): a live surface — entries that turn on and off while sessions are connected by @frontegg-david in #1004
• feat(sdk): hook ordering with HookPhase bands and before/after, an observer chain, a dev hook trace and appliesTo: 'all-apps' by @frontegg-david in #1005
• feat(sdk,testing,cli): record client calls and replay them against a new version by @frontegg-david in #1006
• feat(sdk): offload CPU-heavy work to a worker-thread pool by @frontegg-david in #1009
• fix(plugins): import @frontmcp/utils from plugin-cache, plugin-dashboard and edge instead of bundling it by @frontegg-david in #1002
• perf(sdk): cut first-request and ESM startup costs that come from dependencies by @frontegg-david in #1007
• perf(lazy-zod): add internalZ, which also builds leaf schemas on first use by @frontegg-david in #1011
• perf(sdk,auth,utils): build FrontMCP's own zod schemas on first use by @frontegg-david in #1010
• feat(observability,cli): name the calls behind event-loop stalls, and stream dev events from frontmcp dev by @frontegg-david in #1013
• feat(sdk): duties — periodic work that exactly one process on a machine or workspace runs by @frontegg-david in #1014
• feat(sdk): materialized resources — stored values that announce their own changes, from any process by @frontegg-david in #1015
• feat(cli,sdk): a build manifest for every target, an instructions budget, and skills exported from the server's entry by @frontegg-david in #1017
• feat(sdk): durable jobs on a local store — cancel, timeouts, cleanup, admission and run handles by @frontegg-david in #1018
• feat(sdk,utils,auth): a shared local server that several stdio sessions attach to, after it proves its identity by @frontegg-david in #1019
• feat(sdk,auth): a web host — @HttpRoute pages and SSE routes through a hookable http:route flow, with loopback-token sign-in by @frontegg-david in #1020
• feat(sdk,utils): run, upgrade and fall back from a shared local server by @frontegg-david in #1023
• feat(sdk): job runners — inline, worker-thread and detached runs that outlive the server by @frontegg-david in #1024
• feat(sdk): lazy apps — listed from the build manifest, imported on their first call by @frontegg-david in #1025
• feat(sdk,auth,cli): persistent questions — asked once, answered from an inbox, delivered exactly once by @frontegg-david in #1026
• perf(sdk): set up jobs, workflows, channels, remote MCP, the ESM loader and OAuth flows on first use by @frontegg-david in #1016
• perf(lazy-zod): keep less per stand-in, so startup retains less heap by @frontegg-david in #1021
• fix(sdk): load the transport, job/tools and workflow/tools subpaths at runtime by @frontegg-david in #1027
• feat(sdk): jobs.store: false, and no Redis or SQLite store in a browser build by @frontegg-david in #1028
• perf(utils,auth,sdk): keep server-only code out of browser builds by @frontegg-david in #1030
• fix(sdk): CLI mode validates jobs and the top-level sqlite as the server does by @frontegg-david in #1036
• fix(sdk,plugins): plugin stores refuse Redis or SQLite in a browser build by @frontegg-david in #1037
• fix(utils,auth,protocol): a browser Web Worker gets the browser variants; Node variants go to workerd by @frontegg-david in #1038
• fix(sdk): the browser build imports no Node built-in, so webpack 5 builds it without fallbacks by @frontegg-david in #1039
• fix(sdk): CLI tasks honour every redis form, and a build opens none of a server's stores by @frontegg-david in #1040
• fix(sdk,cli): a build reads a @FrontMcp server without validating its stores, which the server validates when it starts by @frontegg-david in #1042
• fix(sdk,cli,auth,plugins): 1.11 follow-ups — CLI config checks, one browser store refusal, no stores opened by a build, steadier tests by @frontegg-david in #1043

Full Changelog: v1.10.16...v1.11.0-rc.1