Serve MCP 2026-07-28 clients on selfhost and local HTTP

[RhysSullivan]

Third step of MCP spec 2026-07-28 support: the neutral hosts now serve modern clients.

• envelope.ts routes by era after authentication: legacy requests keep the exact McpSessionStore.dispatch path; modern requests hit resource-keyed, process-cached createMcpHandler(..., { legacy: "reject" }) handlers whose per-request factory reads the client capability envelope and builds the v2 server bound to the authenticated (accountId, organizationId) principal.
• mcp-build.ts gains makeMcpBuildServerV2 mirroring the v1 execution stack; executor-app.ts threads the new McpModernServerBuilder seam next to sessions.
• The local app's HTTP surface gets the same routing (principal "local"); stdio deliberately stays legacy-only for now — modern stdio clients fall back via their own probe policy.
• CORS: preflights echo Access-Control-Request-Headers so the era's dynamic Mcp-Param-<name> headers pass (CORS names never glob; * skips credentialed requests).
• requestState signing key is per-process (both hosts are single-process, which the SDK blesses); state does not survive a host restart, matching session behavior today.

Tests: 201 hosts/mcp + 102 selfhost + 72 local; all pre-existing tests unmodified except one CORS assertion that encoded the non-working mcp-param-* literal.

Stacked on #1601.

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	305c3e9	Commit Preview URL Branch Preview URL	Aug 16 2026, 11:59 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	305c3e9	Aug 16 2026, 12:00 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1602

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1602

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1602

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1602

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1602

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1602

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1602

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1602

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1602

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1602

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1602

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1602

executor

npm i https://pkg.pr.new/executor@1602

commit: 305c3e9

[RhysSullivan]

Folded into #1611 (single consolidated PR per review preference).