app-bridge pulls in entire Zod library (~1.4MB pre-minified) - most of it unused

Summary

When importing AppBridge and PostMessageTransport from @modelcontextprotocol/ext-apps/app-bridge, the bundle includes ~1.65MB of dependencies (pre-minified), resulting in a 377KB minified bundle for a minimal host app. The vast majority is Zod code that cannot be tree-shaken.

Reproduction

 // Minimal import - just AppBridge for host-side integration
 import { AppBridge, PostMessageTransport } from '@modelcontextprotocol/ext-apps/app-bridge';

Expected bundle impact: ~50KB (bridge + protocol logic)
Actual bundle impact: ~377KB minified (1.65MB pre-minified)

Bundle Analysis (ext-apps@1.7.1)

Zod Breakdown

The Zod library is the primary culprit at 1,386KB (84% of total):

Why This Happens

• Zod v4 bundles all locales by default - 48 locale files are included even though most apps only need 1-2
• Multiple Zod versions included - v3, v4, v4-classic, v4-mini are all bundled
• Cannot be tree-shaken - The MCP SDK imports from zod which pulls in the full package

Suggested Solutions

• Use Zod v4-mini - If only runtime validation is needed (not JSON schema generation), v4-mini is ~33KB vs ~1MB
• Externalize Zod as peer dependency - Let consumers provide Zod, enabling deduplication and locale subsetting:

"peerDependencies": {
 "zod": "^4.0.0"
}

• Subset locales - Only bundle en locale by default, let consumers add others:

import { z } from 'zod/v4-mini';  // or zod/v4/core with manual locale

• Lazy-load schema validation - If Zod is only needed for certain operations, dynamically import it

  Environment

• @modelcontextprotocol/ext-apps: 1.7.1

• @modelcontextprotocol/sdk: 1.27.1

• zod: 4.3.6

• Bundler: Webpack 5.x (production mode)

  Workaround

• We implemented dynamic import() to lazy-load the app-bridge chunk only when MCP protocol is used, reducing our main bundle from 812KB to 358KB. The MCP chunk (377KB) loads on-demand.

Start at the AppBridge and PostMessageTransport entry points and inspect their dependency graph, focusing on how the MCP SDK imports Zod. Reproduce the Webpack bundle analysis with the minimal import, then verify that the unused Zod versions and locales are no longer included and that the bundle approaches the reported expected size.