modelcontextprotocol/sdk should be a peerDependency

[nealeu]

Command

other

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

Given how impossible it is in npm to exclude a transitive dependency, there is good reason for the @modelcontextprotocol/sdk to be a peer dependency.

• It is for an experimental feature (see docs at https://github.com/angular/angular/blob/3f13db87e27f6ffc207fc642979776606a71fcec/adev/src/content/ai/develop-with-ai.md?plain=1#L34C1-L34C41).
• It involves code to start a local server so is inherently more risky.
• It requires specific setup outside of the Angular CLI (a given local AI tool needs the MCP endpoint configuring)

Please change this so that we reduce bloat and security related overhead unless we choose to actually use it.

Minimal Reproduction

npm audit -> mcp related CVEs fail a check despite it not being used

Exception or Error

Your Environment

Angular CLI       : 21.0.5
Angular           : 21.0.8
Node.js           : 22.20.0
Package Manager   : npm 10.9.3
Operating System  : linux x64

┌───────────────────────────────────┬───────────────────┬───────────────────┐
│ Package                           │ Installed Version │ Requested Version │
├───────────────────────────────────┼───────────────────┼───────────────────┤
│ @angular/animations               │ 21.0.8            │ 21.0.8            │
│ @angular/build                    │ 21.0.5            │ ^21.0.5           │
│ @angular/cdk                      │ 21.0.6            │ 21.0.6            │
│ @angular/cli                      │ 21.0.5            │ 21.0.5            │
│ @angular/common                   │ 21.0.8            │ 21.0.8            │
│ @angular/compiler                 │ 21.0.8            │ 21.0.8            │
│ @angular/compiler-cli             │ 21.0.8            │ 21.0.8            │
│ @angular/core                     │ 21.0.8            │ 21.0.8            │
│ @angular/forms                    │ 21.0.8            │ 21.0.8            │
│ @angular/language-service         │ 21.0.8            │ 21.0.8            │
│ @angular/localize                 │ 21.0.8            │ 21.0.8            │
│ @angular/platform-browser         │ 21.0.8            │ 21.0.8            │
│ @angular/platform-browser-dynamic │ 21.0.8            │ 21.0.8            │
│ @angular/router                   │ 21.0.8            │ 21.0.8            │
│ rxjs                              │ 7.8.2             │ 7.8.2             │
│ typescript                        │ 5.9.3             │ 5.9.3             │
│ zone.js                           │ 0.16.0            │ 0.16.0            │
└───────────────────────────────────┴───────────────────┴───────────────────┘

Anything else relevant?

No response

[clydin]

Thank you for pointing out an error in the documentation. The MCP server within the Angular CLI is stable as of v21.
The MCP server is also stdio-based and not local network server-based.
The Angular CLI contains a variety of optional features of which MCP is now an integral and growing component. There are no current plans to bifurcate the feature at this time. The @angular/cli package is also commonly run/installed globally as such peer dependencies are not a viable option.

Additionally, all current patch versions of the supported major Angular versions do not contain any npm audit vulnerabilities with a newly created project. Please ensure you are using the latest version and that the project's package lock file has been updated if the project is reporting a vulnerability.