npx @buildinternet/releases get mcp-typescript-sdkThe client no longer lists tools with an x-mcp-header annotation on a number parameter and servers answer calls to them with -32020, per the 2026-07-28 spec. Also added Skills over MCP (SEP-2640) with loadSkills and SkillsClient, opt-in scopes on token refresh, and changed 2025-11-25 outputSchema results to drop the { result } wrapper.
Handlers can now be registered after connect() when the corresponding capability was declared, and Transport optional properties now carry explicit | undefined, backported to v1.x.
requireBearerAuth in @modelcontextprotocol/server-legacy now takes the optional expectedResource parameter added in @modelcontextprotocol/server 2.3.0, accepting only tokens issued for this server's audience; it is off unless set. The npm pages for the server and client packages now open with a note linking the documentation, migration guide, and issue form.
Server.connect() now rejects while the instance is already connected, and stateless Streamable HTTP transport handles one request, so the McpServer and transport must be created inside the request handler or createMcpHandler factory. HTTP client transports follow a redirect only when it stays on the same origin, and the client now requires eventsource-parser 3.0.8 or later.
The HTTP client transports now follow a redirect only when it stays on the same origin, allowing http to https on the same host; deployments redirecting to another host or port must configure the final URL or set redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport, and in browsers a redirected request fails unless that option is set. Adds opt-in maxToolInputElements on McpServer and expectedResource on requireBearerAuth, plus fixes so tools/call and prompts/get requests omitting arguments are accepted and in-memory task-store tasks stay within their creating session.
listTools(), listPrompts(), listResources() and listResourceTemplates() called without a cursor now follow nextCursor until the server stops sending one, with listMaxPages still capping the walk. Constructing the machine-to-machine OAuth providers without expectedIssuer is deprecated and warns, and fetchToken() now throws AuthorizationServerMismatchError when client information is bound to a different authorization server.
Stored OAuth tokens and client information now include an issuer field, binding credentials to the authorization server that issued them; storage rejecting unknown fields must allow it. Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider, or StaticPrivateKeyJwtProvider, since constructing them without it is deprecated.
The server now reads HTTP request bodies with a size limit and bounds JSON-RPC batch length, and auth resource URIs are preserved without trailing-slash rewriting.
Streamable HTTP server transport now sends SSE keep-alive comment frames and fixes the keep-alive timer lifecycle. Content-Type is validated against the parsed media type instead of a substring match, and the release widens @hono/node-server past GHSA-frvp-7c67-39w9.
v2 splits @modelcontextprotocol/sdk into separate @modelcontextprotocol/server and @modelcontextprotocol/client packages, accepts any Standard Schema library for inputSchema and outputSchema, and replaces v1's extra bag with a typed request context. It implements the 2026-07-28 spec's stateless core, multi-round-trip requests, and header-based routing, and ships a v1-to-v2 codemod with v1.x supported for at least 6 months after v2.
