fix: replace @vercel/mcp-adapter with mcp-handler direct dependency

Remove the deprecated @vercel/mcp-adapter wrapper and import directly
from mcp-handler@1.1.0, which contains the fix for CVE-2026-25536.

Made-with: Cursor

Author: masnwilliams

bun.lock

@@ -37,7 +37,6 @@
     "@onkernel/sdk": "^0.35.0",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/redis": "^4.0.11",
-    "@vercel/mcp-adapter": "^1.0.0",
     "builtin-modules": "^5.0.0",
     "install": "^0.13.0",
     "jose": "^6.0.11",

package.json

@@ -1,7 +1,7 @@
 import {
   createMcpHandler,
   experimental_withMcpAuth as withMcpAuth,
-} from "@vercel/mcp-adapter";
+} from "mcp-handler";
 import { verifyToken } from "@clerk/nextjs/server";
 import { NextRequest } from "next/server";
 import { Kernel } from "@onkernel/sdk";