[Agent Builder] Bump mcp ts sdk (#240794)

## Summary

We are still on the same spec version 2025-06-18 so no logic/protocol
changes. Just sdk bump.

- Bump mcp sdk to latest
- Try unpinning pkce resolution introduced in
#215627


### Validation 

MCP inspector, tested connection, tool discovery, tool call

<img width="1663" height="794" alt="Screenshot 2025-10-27 at 12 59 02"
src="https://github.com/user-attachments/assets/11132f12-0449-4f4b-b912-a3ded04a75ec"
/>

<img width="657" height="628" alt="Screenshot 2025-10-27 at 12 59 13"
src="https://github.com/user-attachments/assets/384ed3d7-fae7-4dec-9c90-1c9c41b9ce47"
/>

---------

Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Elastic Machine <[email protected]>

Author: 3 people

package.json

@@ -105,7 +105,6 @@
     "@xstate5/react/**/xstate": "^5.19.2",
     "apache-arrow": "20.x - 21.x",
     "globby/fast-glob": "^3.3.2",
-    "pkce-challenge": "3.1.0",
     "vega-expression": "5.2.1",
     "vega-interpreter": "1.2.1",
     "vega-util": "1.17.4"
@@ -1164,7 +1163,7 @@
     "@mapbox/mapbox-gl-rtl-text": "0.2.3",
     "@mapbox/mapbox-gl-supported": "2.0.1",
     "@mapbox/vector-tile": "1.3.1",
-    "@modelcontextprotocol/sdk": "^1.13.2",
+    "@modelcontextprotocol/sdk": "^1.20.2",
     "@moonrepo/cli": "1.41.4",
     "@n8n/json-schema-to-zod": "^1.1.0",
     "@openfeature/core": "^1.9.1",

yarn.lock

@@ -9611,16 +9611,17 @@
   dependencies:
     "@types/mdx" "^2.0.0"
 
-"@modelcontextprotocol/sdk@^1.13.2":
-  version "1.13.2"
-  resolved "https://registry.yarnpkg.com/@modelcontextprotocol/sdk/-/sdk-1.13.2.tgz#cb33fb668a03573cc4d3df9d194dc5c73239861f"
-  integrity sha512-Vx7qOcmoKkR3qhaQ9qf3GxiVKCEu+zfJddHv6x3dY/9P6+uIwJnmuAur5aB+4FDXf41rRrDnOEGkviX5oYZ67w==
+"@modelcontextprotocol/sdk@^1.20.2":
+  version "1.20.2"
+  resolved "https://registry.yarnpkg.com/@modelcontextprotocol/sdk/-/sdk-1.20.2.tgz#7c448a073164841814d34ec9c76bcc37f2d6ffdc"
+  integrity sha512-6rqTdFt67AAAzln3NOKsXRmv5ZzPkgbfaebKBqUbts7vK1GZudqnrun5a8d3M/h955cam9RHZ6Jb4Y1XhnmFPg==
   dependencies:
     ajv "^6.12.6"
     content-type "^1.0.5"
     cors "^2.8.5"
     cross-spawn "^7.0.5"
     eventsource "^3.0.2"
+    eventsource-parser "^3.0.0"
     express "^5.0.1"
     express-rate-limit "^7.5.0"
     pkce-challenge "^5.0.0"
@@ -17695,7 +17696,7 @@ crypto-browserify@^3.12.1:
     randombytes "^2.1.0"
     randomfill "^1.0.4"
 
-crypto-js@^4.1.1, crypto-js@^4.2.0:
+crypto-js@^4.2.0:
   version "4.2.0"
   resolved "https://registry.yarnpkg.com/crypto-js/-/crypto-js-4.2.0.tgz#4d931639ecdfd12ff80e8186dba6af2c2e856631"
   integrity sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==
@@ -27638,12 +27639,10 @@ [email protected], pixelmatch@^5.3.0:
   dependencies:
     pngjs "^6.0.0"
 
-[email protected], pkce-challenge@^5.0.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/pkce-challenge/-/pkce-challenge-3.1.0.tgz#c974ee934e62c501f09da817964e75db201ee8bf"
-  integrity sha512-bQ/0XPZZ7eX+cdAkd61uYWpfMhakH3NeteUF1R8GNa+LMqX8QFAkbCLqq+AYAns1/ueACBu/BMWhrlKGrdvGZg==
-  dependencies:
-    crypto-js "^4.1.1"
+pkce-challenge@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/pkce-challenge/-/pkce-challenge-5.0.0.tgz#c3a405cb49e272094a38e890a2b51da0228c4d97"
+  integrity sha512-ueGLflrrnvwB3xuo/uGob5pd5FN7l0MsLf0Z87o/UQmRtwjvfylfc9MurIxRAWywCYTgrvpXBcqjV4OfCYGCIQ==
 
 pkg-dir@^3.0.0:
   version "3.0.0"