ERR_REQUIRE_ESM for pkce-challenge when using @modelcontextprotocol/sdk in a CommonJS project
Using @modelcontextprotocol/sdk (1.7.0 and later) in a CommonJS project such as NestJS, importing @langchain/mcp-adapters crashes at startup with "Error [ERR_REQUIRE_ESM]: require() of ES Module pkce-challenge is not supported in CommonJS modules". The SDK's CJS build uses require() on pkce-challenge, which is ESM-only. How can this be worked around?
Originally asked on GitHub: https://github.com/modelcontextprotocol/typescript-sdk/issues/217
6 answers
Status: the issue was closed as completed. The thread does not state which SDK release contains a final fix, and a fix for the root cause (pkce-challenge PR #32) was submitted to the pkce-challenge repository; the thread does not say it was merged.
Workarounds reported in the thread:
-
Pin pkce-challenge to 5.0.0. A commenter showed a lockfile entry for @modelcontextprotocol/sdk@1.8.0 with
pkce-challenge: 5.0.0as an example of a manual edit. The thread does not confirm that this resolved the error. -
Downgrade the SDK to 1.5.0, which does not depend on pkce-challenge. One commenter used this to get unblocked, noting it is not the best solution.
-
Patch the installed SDK with patch-package. The reporter replaced the
require("pkce-challenge")call indist/cjs/client/auth.jswith a dynamicimport("pkce-challenge")loaded before generating the PKCE challenge. Another commenter used a script to apply the same patch and reported it worked.
Attempts that did not work: importing Client from
@modelcontextprotocol/sdk/dist/esm/clientin a CJS project was reported as not working by one user.General advice: after changing lockfile entries, reinstall and confirm the resolved pkce-challenge version with your package manager before retesting.
Did this work for you?-
What a GitHub user tried on GitHub (Worked)
Reporter patched @modelcontextprotocol/sdk 1.7.0 with patch-package, replacing the CJS require of pkce-challenge in dist/cjs/client/auth.js with a dynamic import() loaded before generating the PKCE challenge.
Source: https://github.com/modelcontextprotocol/typescript-sdk/issues/217 (opens external site)
Did this work for you?What @dimavedenyapin tried on GitHub (Didn't work)
Tried importing Client from @modelcontextprotocol/sdk/dist/esm/client in a CJS project to avoid the CJS build.
Did this work for you?What @heyitsaamir tried on GitHub (Worked)
Downgraded @modelcontextprotocol/sdk to 1.5.0, which does not depend on pkce-challenge.
Did this work for you?What @Aitenry tried on GitHub (Outcome unclear)
Manually set pkce-challenge to 5.0.0 in the lockfile entry for @modelcontextprotocol/sdk@1.8.0 as an example of the change.
Did this work for you?What @Laci21 tried on GitHub (Worked)
Ran a script that applies the same dynamic import() patch to the SDK's CJS auth.js.
Did this work for you?
Related questions
- MCP TypeScript SDK StreamableHttp without sticky sessions in multi-replica deployments?
- MCP stdio server: SyntaxError Unexpected token in deserializeMessage when using console.log
- MCP typescript-sdk: tool inputSchema/outputSchema reject JSON Schema type 'array'?
- Use Zod union/intersection as MCP tool paramsSchema in typescript-sdk?
- MCP Inspector: "Invalid transport type: undefined" when connecting to an SSE server