feat(remote-mcp-server-descope-auth): migrate to stateless MCP SDK v2 + enable CIMD

[mariamantsurova]

What

Migrates the remote-mcp-server-descope-auth demo from the stateful McpAgent (Durable Object) transport to the stateless MCP SDK v2 handler (createMcpHandler from agents/mcp/server, protocol revision 2026-07-28), and enables Client ID Metadata Document (CIMD) support.

Why

The stateless handler is the current recommended pattern for remote MCP servers on Workers. It removes the Durable Object entirely - no durable_objects binding and no migrations to configure - making the demo simpler to understand and deploy. Auth props that previously lived on this.props are now read per-request via getMcpAuthContext(), sourced fresh from the decrypted bearer token by @cloudflare/workers-oauth-provider.

Changes

• src/index.ts — replace class MyMCP extends McpAgent with a createServer() factory wrapped by createMcpHandler(); read auth via getMcpAuthContext() (helper requireProps()); update tool registration to the SDK v2 registerTool(...) signature; enable CIMD on the OAuthProvider (clientIdMetadataDocumentEnabled: true).
• wrangler.jsonc — remove durable_objects + migrations (no DO anymore); bump compatibility_date to 2026-07-02; add the global_fetch_strictly_public compatibility flag (required for CIMD); rename the worker to remote-mcp-server-descope-auth.
• src/env.d.ts (new) — hand-written type declarations for the Descope secrets, which wrangler types does not emit.
• worker-configuration.d.ts — regenerated via wrangler types.
• package.json — bump agents to ^0.20.1; add @modelcontextprotocol/sdk + @modelcontextprotocol/server (v2); add a type-check script.
• src/descope-utils.ts — narrow the token-response type so type-check passes.
• README.md — add an Architecture section describing the stateless handler.

Testing

• npm run type-check — passes
• npx oxlint — passes (exit 0)
• Verified end-to-end locally with the MCP Inspector (Streamable HTTP → /mcp): DCR registration, full Descope OAuth login, and getUserInfo / getToken tools all work. Confirmed the metadata endpoint reports client_id_metadata_document_supported: true.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4f4bf74

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR