feat(all): warn about HTTP framework dependencies during GitHub deployment validation

RuntimeDetector now checks for HTTP framework dependencies (express,
fastify, hono, koa for Node.js; flask, fastapi, uvicorn, starlette,
django for Python) and returns non-blocking warnings in the validation
response. The frontend shows a yellow warning banner in the validation
step when these frameworks are detected, since GitHub deployments only
support stdio transport and HTTP/SSE servers will fail at startup.

Author: Lasim

services/backend/api-spec.json

@@ -15298,6 +15298,12 @@
                         },
                         "commit_sha": {
                           "type": "string"
+                        },
+                        "warnings": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          }
                         }
                       },
                       "required": [

services/backend/api-spec.yaml

@@ -10598,6 +10598,10 @@ paths:
                           type: string
                       commit_sha:
                         type: string
+                      warnings:
+                        type: array
+                        items:
+                          type: string
                     required:
                       - runtime
                       - mcp_sdk

services/backend/src/lib/deployment/runtime-detector.ts

@@ -27,6 +27,7 @@ export interface RuntimeDetectionResult {
     description?: string;
     license?: string;
   };
+  warnings?: string[];
 }
 
 /**
@@ -89,6 +90,20 @@ export class RuntimeDetector {
       const mcpSdk = packageJson.dependencies?.['@modelcontextprotocol/sdk'] ||
                      packageJson.devDependencies?.['@modelcontextprotocol/sdk'];
 
+      // Detect HTTP framework dependencies that suggest non-stdio transport
+      const HTTP_FRAMEWORKS_NODE = ['express', 'fastify', 'hono', 'koa', '@hono/node-server'];
+      const deps = packageJson.dependencies || {};
+      const detectedFrameworks = HTTP_FRAMEWORKS_NODE.filter(fw => fw in deps);
+
+      const warnings: string[] = [];
+      if (detectedFrameworks.length > 0) {
+        warnings.push(
+          `Detected HTTP framework dependencies: ${detectedFrameworks.join(', ')}. ` +
+          `GitHub deployments only support stdio-based MCP servers. ` +
+          `If this server uses HTTP/SSE transport instead of stdio, deployment will fail.`
+        );
+      }
+
       return {
         runtime: 'node',
         mcp_sdk: {
@@ -98,7 +113,8 @@ export class RuntimeDetector {
           runtime: 'node'
         },
         scripts: packageJson.scripts || {},
-        packageJson
+        packageJson,
+        ...(warnings.length > 0 && { warnings })
       };
     } catch {
       return null;  // package.json not found
@@ -116,6 +132,8 @@ export class RuntimeDetector {
   ): Promise<RuntimeDetectionResult | null> {
     // Try requirements.txt first
     let mcpSdkInfo: McpSdkInfo | null = null;
+    const HTTP_FRAMEWORKS_PYTHON = ['flask', 'fastapi', 'uvicorn', 'starlette', 'django'];
+    const detectedPythonFrameworks: string[] = [];
 
     try {
       const { data: file } = await octokit.repos.getContent({
@@ -160,6 +178,17 @@ export class RuntimeDetector {
             runtime: 'python'
           };
         }
+
+        // Detect HTTP framework dependencies
+        for (const fw of HTTP_FRAMEWORKS_PYTHON) {
+          const hasFramework = requirements.some(line => {
+            const trimmed = line.trim().toLowerCase();
+            return trimmed === fw || trimmed.startsWith(`${fw}==`) || trimmed.startsWith(`${fw}>=`) || trimmed.startsWith(`${fw}<=`) || trimmed.startsWith(`${fw}[`);
+          });
+          if (hasFramework) {
+            detectedPythonFrameworks.push(fw);
+          }
+        }
       }
     } catch {
       // Continue to pyproject.toml
@@ -208,6 +237,15 @@ export class RuntimeDetector {
           }
         }
 
+        // Detect HTTP framework dependencies in pyproject.toml
+        if (detectedPythonFrameworks.length === 0) {
+          for (const fw of HTTP_FRAMEWORKS_PYTHON) {
+            if (new RegExp(`["']${fw}["']`).test(content) || new RegExp(`["']${fw}[><=\\[]`).test(content)) {
+              detectedPythonFrameworks.push(fw);
+            }
+          }
+        }
+
         // Extract project metadata from [project] section (always do this)
         const nameMatch = content.match(/^\s*name\s*=\s*["']([^"']+)["']/m);
         const versionProjMatch = content.match(/^\s*version\s*=\s*["']([^"']+)["']/m);
@@ -228,10 +266,19 @@ export class RuntimeDetector {
 
         // Return if we found MCP SDK (from either requirements.txt or pyproject.toml)
         if (mcpSdkInfo) {
+          const warnings: string[] = [];
+          if (detectedPythonFrameworks.length > 0) {
+            warnings.push(
+              `Detected HTTP framework dependencies: ${detectedPythonFrameworks.join(', ')}. ` +
+              `GitHub deployments only support stdio-based MCP servers. ` +
+              `If this server uses HTTP/SSE transport instead of stdio, deployment will fail.`
+            );
+          }
           return {
             runtime: 'python',
             mcp_sdk: mcpSdkInfo,
-            pyprojectToml
+            pyprojectToml,
+            ...(warnings.length > 0 && { warnings })
           };
         }
       }
@@ -241,9 +288,18 @@ export class RuntimeDetector {
 
     // If we found MCP SDK in requirements.txt but no pyproject.toml, return without metadata
     if (mcpSdkInfo) {
+      const warnings: string[] = [];
+      if (detectedPythonFrameworks.length > 0) {
+        warnings.push(
+          `Detected HTTP framework dependencies: ${detectedPythonFrameworks.join(', ')}. ` +
+          `GitHub deployments only support stdio-based MCP servers. ` +
+          `If this server uses HTTP/SSE transport instead of stdio, deployment will fail.`
+        );
+      }
       return {
         runtime: 'python',
-        mcp_sdk: mcpSdkInfo
+        mcp_sdk: mcpSdkInfo,
+        ...(warnings.length > 0 && { warnings })
       };
     }
 

services/backend/src/routes/teams/deploy/validate.ts

@@ -63,7 +63,11 @@ const VALIDATE_SUCCESS_RESPONSE_SCHEMA = {
           type: 'object',
           additionalProperties: { type: 'string' }
         },
-        commit_sha: { type: 'string' }
+        commit_sha: { type: 'string' },
+        warnings: {
+          type: 'array',
+          items: { type: 'string' }
+        }
       },
       required: ['runtime', 'mcp_sdk', 'commit_sha']
     }

services/backend/src/services/deploymentValidationService.ts

@@ -28,6 +28,9 @@ export interface ValidationMetadata {
 
   // Git metadata
   commit_sha: string;
+
+  // Non-blocking warnings (e.g., HTTP framework detected)
+  warnings?: string[];
 }
 
 export interface ValidationResult {
@@ -320,7 +323,8 @@ export class DeploymentValidationService {
         runtime: runtimeResult.runtime,
         mcp_sdk: runtimeResult.mcp_sdk,
         scripts: runtimeResult.scripts,
-        commit_sha: commitSha
+        commit_sha: commitSha,
+        ...(runtimeResult.warnings?.length && { warnings: runtimeResult.warnings })
       }
     };
   }

services/frontend/src/components/deploy/steps/ValidatingDeploymentStep.vue

@@ -3,7 +3,7 @@ import { computed } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { Spinner } from '@/components/ui/spinner'
 import { Empty, EmptyHeader, EmptyMedia, EmptyTitle, EmptyDescription } from '@/components/ui/empty'
-import { AlertCircle } from 'lucide-vue-next'
+import { AlertCircle, AlertTriangle } from 'lucide-vue-next'
 
 interface Props {
   isLoading: boolean
@@ -24,6 +24,7 @@ interface Props {
       start?: string
       [key: string]: string | undefined
     }
+    warnings?: string[]
   } | null
 }
 
@@ -214,6 +215,23 @@ function getRuntimeLabel(runtime: string) {
             </div>
           </li>
         </ul>
+
+        <!-- Transport Warning -->
+        <div v-if="metadata.warnings?.length" class="mt-4 rounded-md bg-yellow-50 p-4 dark:bg-yellow-950/30">
+          <div class="flex">
+            <div class="flex-shrink-0">
+              <AlertTriangle class="h-5 w-5 text-yellow-400" />
+            </div>
+            <div class="ml-3">
+              <h3 class="text-sm font-medium text-yellow-800 dark:text-yellow-200">
+                {{ t('deployments.wizard.validating.success.warningTitle') }}
+              </h3>
+              <div class="mt-2 text-sm text-yellow-700 dark:text-yellow-300">
+                <p v-for="warning in metadata.warnings" :key="warning">{{ warning }}</p>
+              </div>
+            </div>
+          </div>
+        </div>
       </div>
     </div>
     </div>

services/frontend/src/i18n/locales/en/deployments.ts

@@ -126,6 +126,7 @@ export default {
           buildCommands: 'Build Commands',
           name: 'Name',
           noBuildScripts: 'No build or start scripts detected',
+          warningTitle: 'Warning',
         },
       },
 

services/frontend/src/services/deploymentService.ts

@@ -177,6 +177,7 @@ export class DeploymentService {
         [key: string]: string | undefined
       }
       commit_sha: string
+      warnings?: string[]
     }
     error?: string
     step?: string

services/frontend/src/views/deploy/create.vue

@@ -50,6 +50,7 @@ interface ValidationMetadata {
     [key: string]: string | undefined
   }
   commit_sha: string
+  warnings?: string[]
 }
 
 const formData = ref({