MCP endpoint on threeui.netlify.app returns 502 — `sharp` native module fails to load in the Netlify function bundle

Summary

POST https://threeui.netlify.app/api/mcp returns HTTP 502 on every request. The serverless function crashes at cold start because the sharp module has no linux-x64 binary in the deployed bundle, so the MCP server never completes initialization and no MCP client can connect.

The canonical endpoint (https://threeui.com/api/mcp) responds correctly with a 401 authentication_required and valid OAuth discovery, so this appears specific to the bundle deployed at the threeui.netlify.app alias.

Steps to reproduce

curl -i -X POST https://threeui.netlify.app/api/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2025-06-18","capabilities":{},
                 "clientInfo":{"name":"curl","version":"1.0"}}}'

Or from Claude Code:

claude mcp add --transport http threeui https://threeui.netlify.app/api/mcp --scope user
claude mcp list
# threeui: ... - ✘ Failed to connect — HTTP 502

Expected

initialize returns a JSON-RPC result and the MCP handshake completes (or a 401 with OAuth discovery, as threeui.com/api/mcp does).

Actual

HTTP/2 502, content-type: text/plain:

{
  "errorType": "Error",
  "errorMessage": "Could not load the \"sharp\" module using the linux-x64 runtime",
  "trace": [
    "Error: Could not load the \"sharp\" module using the linux-x64 runtime",
    "    at Object.<anonymous> (/var/task/threeui-pro-source-fix.uLTjNe/node_modules/sharp/dist/sharp.cjs:171:9)",
    "    at Module._compile (node:internal/modules/cjs/loader:1871:14)",
    "    at Module.require (node:internal/modules/cjs/loader:1617:12)",
    "    at Object.<anonymous> (/var/task/threeui-pro-source-fix.uLTjNe/node_modules/sharp/dist/constructor.cjs:10:1)"
  ]
}

Netlify request ID: 01M10BF647MXHRF1GM67PZV29R (2026-08-27 00:56 UTC)

Scope of the failure

Request	Result
GET https://threeui.netlify.app/	200 — site itself is fine
GET https://threeui.netlify.app/api/mcp	502
POST .../api/mcp initialize	502
POST .../api/mcp tools/list	502
POST https://threeui.com/api/mcp initialize	401 authentication_required + WWW-Authenticate: Bearer resource_metadata=... (correct)

It fails on every method including GET, which points at module load rather than request handling — sharp is being required at the top of the handler's import graph, so the function dies before it can route anything.

Possible fix

The bundle appears to have been installed without the platform-specific optional dependency:

npm install --include=optional sharp
# or, to pin the Linux binary for the deploy target:
npm install --os=linux --cpu=x64 sharp

If sharp is only needed for image work and not for MCP request handling, moving it behind a lazy await import('sharp') inside the code path that actually uses it would also stop a missing binary from taking down the whole endpoint.

Two follow-on questions

1. Is threeui.netlify.app meant to be publicly reachable? The docs (McpDocumentation.tsx, DEFAULT_MCP_ENDPOINT) point at https://threeui.com/api/mcp, but the raw Netlify alias is live and indexable, so people do find and configure it. If it's not supported, redirecting it to the apex domain would prevent the confusion.
2. Could authenticated requests on threeui.com hit the same crash? The 401 there is returned before the handler runs, so the broken sharp import may be masked for unauthenticated callers and still fire for signed-in Pro users. I don't have a Pro token to confirm — worth checking against a real authenticated initialize.

Environment

• Client: Claude Code, HTTP transport, user-scope MCP config
• Observed: 2026-08-27, consistent across repeated requests

Start by reproducing the curl request against both endpoint URLs and inspect the function's import graph and deployment dependencies for the sharp linux-x64 failure. Review McpDocumentation.tsx and DEFAULT_MCP_ENDPOINT when checking the alias question. Done means the Netlify endpoint no longer returns 502 and initialize reaches the expected handshake or authentication response.