fix(mcp): final-review fixes — SERVER_VERSION drift + honest bundle-size verdict

From the final whole-branch code review.

- Phase 4's SERVER_VERSION bump left each server's runServer({version}) literal at
  the old value, so all 10 bumped servers reported the new version in hello output
  but the old version over the MCP handshake (the drift Phase 2 fixed). Replaced
  every runServer version literal with the SERVER_VERSION constant across all 11
  servers (+ dependency-management SBOM generator version) — one source of truth.
- dependency-management estimate_bundle_size no longer reports "acceptable" for
  server-side packages (express: gzipped "N/A (server)" → parseInt NaN → NaN>50
  false); non-numeric sizes now report "not applicable". Test asserts it.

Spine → 2.11.13. All 11 servers build; 1317 MCP tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Author: michelabboud

CHANGELOG.md

@@ -15,6 +15,21 @@ We follow [Semantic Versioning](https://semver.org/) (MAJOR.MINOR.PATCH):
 
 ---
 
+## [2.11.13] - 2026-07-10
+
+Fixes from the final whole-branch code review.
+
+### Fixed
+- **Version drift reintroduced by the Phase 4 bump** — the Phase 4 `SERVER_VERSION` bump did not
+  update the separate hardcoded `version:` literal in each server's `runServer({...})` call, so all
+  10 bumped servers reported the new version in `hello` output but the *old* version over the MCP
+  handshake (the exact drift class Phase 2 fixed). Replaced every `runServer` version literal with the
+  `SERVER_VERSION` constant across all 11 servers (and the `dependency-management` SBOM generator-tool
+  version) so the constant is the single source of truth — future bumps can't desync again.
+- **`dependency-management` bundle-size** reported "Bundle size is acceptable" for server-side packages
+  like `express` whose size is `"N/A (server)"` (`parseInt` → `NaN`, `NaN > 50` → false). Non-numeric
+  sizes now report "not applicable" instead of an unbacked verdict.
+
 ## [2.11.12] - 2026-07-10
 
 Remediation close-out — dependency audit (rule 16).

VERSION

@@ -1 +1 @@
-2.11.12
+2.11.13

component-versions.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
-  "repoVersion": "2.11.12",
-  "generatedAt": "2026-07-10T07:49:37.547Z",
+  "repoVersion": "2.11.13",
+  "generatedAt": "2026-07-10T07:56:53.861Z",
   "components": {
     "agents/code-reviewer": {
       "type": "agent",

mcp-servers/api-specialist-mcp/src/index.ts

@@ -1123,7 +1123,7 @@ function buildHelloVerbose(): string {
 }
 
 // Start server
-runServer({ name: "api-specialist-mcp", version: "1.0.0" }, (instance) => {
+runServer({ name: "api-specialist-mcp", version: SERVER_VERSION }, (instance) => {
   const { server, logger } = instance;
 
 // Tool handlers

mcp-servers/cicd-pipeline/src/index.ts

@@ -683,7 +683,7 @@ function buildHelloVerbose(): string {
   ].join("\n");
 }
 
-runServer({ name: "cicd-pipeline-mcp", version: "1.0.0" }, (instance) => {
+runServer({ name: "cicd-pipeline-mcp", version: SERVER_VERSION }, (instance) => {
 const { server, logger } = instance;
 
 // Tool handlers

mcp-servers/code-review-mcp/src/index.ts

@@ -190,7 +190,7 @@ function buildHelloVerbose(): string {
 // Start server
 runServer({
   name: "code-review-mcp",
-  version: "1.0.0",
+  version: SERVER_VERSION,
   healthChecks: [
     commandHealthCheck("eslint"),
   ],

mcp-servers/database-operations/src/index.ts

@@ -434,7 +434,7 @@ function buildHelloVerbose(): string {
 }
 
 // MCP Server
-runServer({ name: "database-operations", version: "1.0.0" }, (instance) => {
+runServer({ name: "database-operations", version: SERVER_VERSION }, (instance) => {
 const { server, logger } = instance;
 
 // Tool handlers

mcp-servers/dependency-management/src/index.test.ts

@@ -349,11 +349,13 @@ function estimateBundleSize(packageName: string, version?: string): BundleSizeRe
     size,
     alternatives: alternatives.length > 0 ? alternatives : undefined,
     tree_shakeable: ["react", "vue", "lodash-es"].includes(packageName),
-    recommendation: known
-      ? (parseInt(size.gzipped) > 50
+    recommendation: !known
+      ? "Bundle size unknown — check bundlephobia.com or bundle locally to measure"
+      : Number.isNaN(parseInt(size.gzipped))
+        ? "Bundle size not applicable for this package (e.g. server-side only)"
+        : parseInt(size.gzipped) > 50
           ? "Consider using lighter alternative or tree-shaking"
-          : "Bundle size is acceptable")
-      : "Bundle size unknown — check bundlephobia.com or bundle locally to measure",
+          : "Bundle size is acceptable",
   };
 }
 
@@ -1388,6 +1390,8 @@ describe("estimateBundleSize", () => {
     const result = estimateBundleSize("express");
     expect(result.size.minified).toBe("N/A (server)");
     expect(result.size.gzipped).toBe("N/A (server)");
+    // A non-numeric size must NOT be reported as "acceptable" (NaN > 50 = false).
+    expect(result.recommendation).toMatch(/not applicable/i);
   });
 });
 

mcp-servers/dependency-management/src/index.ts

@@ -379,11 +379,13 @@ function estimateBundleSize(packageName: string, version?: string): BundleSizeRe
     size,
     alternatives: alternatives.length > 0 ? alternatives : undefined,
     tree_shakeable: ["react", "vue", "lodash-es"].includes(packageName),
-    recommendation: known
-      ? (parseInt(size.gzipped) > 50
+    recommendation: !known
+      ? "Bundle size unknown — check bundlephobia.com or bundle locally to measure"
+      : Number.isNaN(parseInt(size.gzipped))
+        ? "Bundle size not applicable for this package (e.g. server-side only)"
+        : parseInt(size.gzipped) > 50
           ? "Consider using lighter alternative or tree-shaking"
-          : "Bundle size is acceptable")
-      : "Bundle size unknown — check bundlephobia.com or bundle locally to measure",
+          : "Bundle size is acceptable",
   };
 }
 
@@ -442,7 +444,7 @@ function generateSBOM(deps: Record<string, string>, devDeps: Record<string, stri
       version: 1,
       metadata: {
         timestamp: new Date().toISOString(),
-        tools: [{ vendor: "dependency-management-mcp", name: "sbom-generator", version: "1.0.0" }]
+        tools: [{ vendor: "dependency-management-mcp", name: "sbom-generator", version: SERVER_VERSION }]
       },
       components: [...components, ...devComponents]
     };
@@ -508,7 +510,7 @@ function buildHelloVerbose(): string {
 }
 
 // MCP Server
-runServer({ name: "dependency-management-mcp", version: "1.0.0" }, (instance) => {
+runServer({ name: "dependency-management-mcp", version: SERVER_VERSION }, (instance) => {
 const { server, logger } = instance;
 
 // Tool handlers

mcp-servers/design-system-mcp/src/index.ts

@@ -592,7 +592,7 @@ function buildHelloVerbose(): string {
 }
 
 // Start server with runServer factory
-runServer({ name: "design-system-mcp", version: "1.0.0" }, (instance) => {
+runServer({ name: "design-system-mcp", version: SERVER_VERSION }, (instance) => {
   const { server, logger } = instance;
   // Tool handlers
   server.setRequestHandler(ListToolsRequestSchema, async () => {