MCP endpoint on threeui.netlify.app returns 502 — `sharp` native module fails to load in the Netlify function bundle

[soniang-ux]

Summary

POST https://threeui.netlify.app/api/mcp returns HTTP 502 on every request. The serverless function crashes at cold start because the sharp module has no linux-x64 binary in the deployed bundle, so the MCP server never completes initialization and no MCP client can connect.

The canonical endpoint (https://threeui.com/api/mcp) responds correctly with a 401 authentication_required and valid OAuth discovery, so this appears specific to the bundle deployed at the threeui.netlify.app alias.

Steps to reproduce

curl -i -X POST https://threeui.netlify.app/api/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2025-06-18","capabilities":{},
                 "clientInfo":{"name":"curl","version":"1.0"}}}'

Or from Claude Code:

claude mcp add --transport http threeui https://threeui.netlify.app/api/mcp --scope user
claude mcp list
# threeui: ... - ✘ Failed to connect — HTTP 502

Expected

initialize returns a JSON-RPC result and the MCP handshake completes (or a 401 with OAuth discovery, as threeui.com/api/mcp does).

Actual

HTTP/2 502, content-type: text/plain:

{
  "errorType": "Error",
  "errorMessage": "Could not load the \"sharp\" module using the linux-x64 runtime",
  "trace": [
    "Error: Could not load the \"sharp\" module using the linux-x64 runtime",
    "    at Object.<anonymous> (/var/task/threeui-pro-source-fix.uLTjNe/node_modules/sharp/dist/sharp.cjs:171:9)",
    "    at Module._compile (node:internal/modules/cjs/loader:1871:14)",
    "    at Module.require (node:internal/modules/cjs/loader:1617:12)",
    "    at Object.<anonymous> (/var/task/threeui-pro-source-fix.uLTjNe/node_modules/sharp/dist/constructor.cjs:10:1)"
  ]
}

Netlify request ID: 01M10BF647MXHRF1GM67PZV29R (2026-08-27 00:56 UTC)

Scope of the failure

Request	Result
GET https://threeui.netlify.app/	200 — site itself is fine
GET https://threeui.netlify.app/api/mcp	502
POST .../api/mcp initialize	502
POST .../api/mcp tools/list	502
POST https://threeui.com/api/mcp initialize	401 authentication_required + WWW-Authenticate: Bearer resource_metadata=... (correct)

It fails on every method including GET, which points at module load rather than request handling — sharp is being required at the top of the handler's import graph, so the function dies before it can route anything.

Possible fix

The bundle appears to have been installed without the platform-specific optional dependency:

npm install --include=optional sharp
# or, to pin the Linux binary for the deploy target:
npm install --os=linux --cpu=x64 sharp

If sharp is only needed for image work and not for MCP request handling, moving it behind a lazy await import('sharp') inside the code path that actually uses it would also stop a missing binary from taking down the whole endpoint.

Two follow-on questions

1. Is threeui.netlify.app meant to be publicly reachable? The docs (McpDocumentation.tsx, DEFAULT_MCP_ENDPOINT) point at https://threeui.com/api/mcp, but the raw Netlify alias is live and indexable, so people do find and configure it. If it's not supported, redirecting it to the apex domain would prevent the confusion.
2. Could authenticated requests on threeui.com hit the same crash? The 401 there is returned before the handler runs, so the broken sharp import may be masked for unauthenticated callers and still fire for signed-in Pro users. I don't have a Pro token to confirm — worth checking against a real authenticated initialize.

Environment

• Client: Claude Code, HTTP transport, user-scope MCP config
• Observed: 2026-08-27, consistent across repeated requests

[MengTo]

Thanks for the detailed report. You were right: the Netlify deployment you tested had a broken Linux sharp bundle, causing the function to crash before authentication or MCP initialization. We reproduced the same 502 on that immutable deployment.

We have now made https://threeui.com/api/mcp the sole supported MCP endpoint. The raw Netlify MCP route deliberately returns 410 endpoint_retired with the canonical URL, the Netlify site redirects visitors to threeui.com, and production documentation now always shows the canonical endpoint. The canonical endpoint returns the expected OAuth challenge and discovery metadata.

Please update your client to https://threeui.com/api/mcp and let us know whether it connects successfully. We are keeping this issue open until we complete one authenticated production tool call.