fix(build): bundle patched fastmcp for npm installs; send top-level tool titles

[rakshith48]

Why

• npm and npx installs run unpatched fastmcp. Our fastmcp changes live in patches/fastmcp@4.3.2.patch, and only pnpm applies it. The published package imported fastmcp from the registry, so npx firecrawl-mcp users got no canList or beforeValidate hooks. In an AX run, the published 3.26.0 build listed 29 tools, including the deprecated firecrawl_extract, where the patched build lists 27. Only the pnpm-built hosted image had the patch.
• Top-level title was never sent. fastmcp only emits annotations.title. MCP 2025-06-18 added a top-level Tool.title display name, and some clients read only that field. Codex's tool search, for example, indexes the top-level title and ignores annotations.title.

Summary

• fastmcp patch: tools/list copies annotations.title into the top-level title. The title wording is unchanged.
• Bundling: tsup inlines fastmcp (noExternal) and keeps fastmcp's own dependencies external.
• Direct dependencies: the seven packages the bundled code imports (@modelcontextprotocol/sdk, fuse.js, hono, mcp-proxy, undici, uri-templates, xsschema) are now direct dependencies.
  • They were already installed through fastmcp, at the same locked versions.
  • They need to be direct so they resolve under pnpm's non-hoisted layout in the Docker image.
• Tests:
  • tests/build-bundle.test.mjs fails if fastmcp goes back to being external, or if the bundle imports a package without a dependency entry. It checks static, side-effect, dynamic and require imports.
  • The stdio smoke test asserts that every tool's top-level title matches its annotations.title.
• CHANGELOG entries added.

An earlier revision of this PR also rewrote four titles as search keywords. That is reverted: titles are display names, and in the same AX run Codex never called tool_search, so the wording made no difference.

Test Plan

• npm test: 157/157 pass. Run with FIRECRAWL_MCP_SEARCH_PORT set, because port 3001 was taken locally.
• npm pack, then npm install of the tarball into an empty directory: stdio tools/list serves every tool with a top-level title.
• Docker-style pnpm@10.17.1 install --prod --frozen-lockfile --ignore-scripts with dist: same result.

🤖 Generated with Claude Code

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Auto-approved: Sends top-level MCP Tool.title in tools/list via a focused fastmcp patch, retitles four tools to match agent search terms, and adds smoke-test assertions. The change is bounded, additive, and improves Codex tool discoverability without expanding tool exposure.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 5 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

Dismissed because Cubic found issues in a newer review.

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Requires human review: Patches fastmcp to send top-level tool titles for Codex search, rewrites tool titles, and bundles fastmcp so npm/npx installs get the patch. Needs human sign-off on the tools/list response shape change, new display titles, and the bundling/dependency expansion.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Auto-approved: Bundles the pnpm-patched fastmcp for npm installs, adds top-level Tool.title from annotations.title, and adds direct dependencies for bundled imports, all covered by new tests.

Re-trigger cubic</sub>

[Max17190]

lgtm!!

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Auto-approved: Bundles the pnpm-patched fastmcp into the npm build so npx installs get the canList/title behavior, adds top-level Tool.title from annotations.title, promotes external imports to direct dependencies, and pins it with build and stdio tests.

Re-trigger cubic</sub>