Dependencies

This page documents the dependency management strategy for simap-mcp, including runtime and development dependencies, version constraints, and dependency resolution through npm. For detailed information about specific dependencies, see Runtime Dependencies and Development Dependencies.

Overview

The simap-mcp project maintains a minimal dependency footprint with only two runtime dependencies and eight development dependencies. All dependencies are managed through npm and locked via package-lock.json to ensure reproducible builds across environments.

Sources: package.json54-68

Dependency Categories

The project organizes dependencies into two distinct categories defined in package.json54-68:

Category	Count	Purpose
Runtime (dependencies)	2	Required for server execution in production
Development (devDependencies)	8	Required for development, testing, build, and release processes

System Dependency Mapping

The following diagram maps high-level system components to the specific code entities and packages that implement them.

Sources: package.json11-26 package.json54-68

Version Constraint Strategy

The project uses semantic versioning (semver) ranges to balance stability and updates:

Runtime Dependencies

Both runtime dependencies use caret (^) ranges, allowing minor and patch updates but preventing breaking major version changes:

• @modelcontextprotocol/sdk: ^1.29.0 package.json55 - Allows >=1.29.0 <2.0.0
• zod: ^4.4.3 package.json56 - Allows >=4.4.3 <5.0.0. Note: Zod was bumped to ^4.4.3 in v1.2.4 to improve discriminatedUnion and preprocess handling package.json56

This strategy ensures compatibility with the MCP protocol specification while receiving bug fixes and non-breaking enhancements. For details on how these are used, see Runtime Dependencies.

Development Dependencies

Development dependencies follow similar patterns with caret ranges:

• typescript: ^6.0.3 package.json65
• eslint: ^10.4.0 package.json63
• vitest: ^4.1.7 package.json67
• @types/node: ^25.9.1 package.json62
• @changesets/cli: ^2.31.0 package.json60
• prettier: ^3.8.3 package.json64

For details on configuration, see Development Dependencies.

Sources: package.json54-68

Node.js Engine Requirements

The project specifies a minimum Node.js version in package.json47-49:

This constraint ensures compatibility with:

• Native ESM module support ("type": "module" in package.json6)
• Modern JavaScript features used by dependencies
• CI/CD matrix testing across Node.js 22 and 24 (Node 20 support was dropped in v1.3.0 as it reached end-of-life) package.json48-49

Sources: package.json6 package.json47-49

Dependency Resolution and Lock File

The package-lock.json file (version 3 lockfile format) provides deterministic dependency resolution package-lock.json1-4

The lock file captures exact resolved versions and integrity hashes for all direct and transitive dependencies. It resolves @modelcontextprotocol/sdk and its own requirements to specific versions to ensure consistency across developer machines and CI package-lock.json11-14

Sources: package-lock.json1-14

Transitive Dependency Graph

The runtime environment includes transitive dependencies required by the MCP SDK and development tools:

Sources: package-lock.json11-14 package-lock.json33-36

Dependency Update Strategy

The project uses the following strategy for dependency updates:

1. Lock File Commits: package-lock.json is committed to version control for reproducible builds package-lock.json1-5
2. Semantic Version Ranges: Caret (^) constraints allow automatic patch and minor updates.
3. Manual Major Updates: Major version updates require manual package.json edits and testing.
4. Build Validation: The prepublishOnly script ensures the project builds successfully via tsc before any publication package.json27
5. Update Tooling: Scripts are provided to check for and apply updates using npm-check-updates package.json22-23
6. Release Flow: The project uses changesets for versioning and publishing, ensuring that dependency updates (like the Zod bump to ^4.4.3) are tracked and released package.json24-26

Sources: package.json22-27 package-lock.json1-5

Detailed Dependency Documentation

For in-depth information about specific dependencies:

• Runtime Dependencies — Explain @modelcontextprotocol/sdk (McpServer, StdioServerTransport, JSON-RPC handling) and zod (schema definition, input validation, bumped to ^4.4.3 in v1.2.4 for improved discriminatedUnion and preprocess handling) and their roles in the application.
• Development Dependencies — Document TypeScript, ESLint with typescript-eslint, Prettier, Vitest, and other development tooling including their configuration files.

Sources: package.json54-68