{"id":"src_kqCucfxlVi7mf7xfdWQdq","slug":"mcp-typescript-sdk","name":"TypeScript SDK","type":"github","url":"https://github.com/modelcontextprotocol/typescript-sdk","orgId":"org_8KCcpRQyRim07ckEHrKIu","productId":null,"productSlug":null,"org":{"id":"org_8KCcpRQyRim07ckEHrKIu","slug":"modelcontextprotocol","name":"Model Context Protocol"},"isPrimary":false,"isHidden":false,"discovery":"curated","metadata":"{\"tagDenyPrefixes\":[\"@modelcontextprotocol/\"],\"sourceActor\":{\"nextAlarmAt\":\"2026-10-24T19:04:50.024Z\",\"lastAlarmAt\":\"2026-10-24T15:04:50.929Z\",\"managed\":true},\"wellKnownSweptAt\":\"2026-10-24T06:00:36.005Z\"}","notice":null,"kind":"sdk","stars":13644,"starsFetchedAt":"2026-10-24T15:06:50.149Z","releaseCount":10,"releasesLast30Days":8,"avgReleasesPerWeek":0.8,"latestVersion":"v2.4.0","latestDate":"2026-10-23T18:32:25.000Z","changelogUrl":null,"hasChangelogFile":false,"lastFetchedAt":"2026-10-24T15:06:50.149Z","lastPolledAt":"2026-10-24T15:06:49.432Z","changeDetectedAt":null,"trackingSince":"2026-07-27T17:54:36.000Z","releases":[{"id":"rel_dma349Y2VDWSmPEWCQJQh","version":"v2.4.0","type":"feature","title":"2.4.0","summary":"The client no longer lists tools with an x-mcp-header annotation on a number parameter and servers answer calls to them with -32020, per the 2026-07-28 spec. Also added Skills over MCP (SEP-2640) with loadSkills and SkillsClient, opt-in scopes on token refresh, and changed 2025-11-25 outputSchema results to drop the { result } wrapper.","titleGenerated":"MCP TypeScript SDK v2.4.0 ships Skills over MCP and tightens number header validation","titleShort":"Number x-mcp-header rejected; Skills over MCP ships","breaking":"major","importance":4,"content":"| Package | Version |\r\n|---|---|\r\n| `@modelcontextprotocol/client` | 2.4.0 |\r\n| `@modelcontextprotocol/server` | 2.4.0 |\r\n| `@modelcontextprotocol/core` | 2.4.0 |\r\n| `@modelcontextprotocol/server-legacy` | 2.4.0 |\r\n| `@modelcontextprotocol/codemod` | 2.4.0 |\r\n| `@modelcontextprotocol/node` | 2.1.2 |\r\n| `@modelcontextprotocol/express`, `hono`, `fastify` | unchanged |\r\n\r\n## Upgrade notes\r\n\r\n- **`x-mcp-header` on a `number` parameter is rejected**, as the 2026-07-28 spec requires: the client does not list such a tool, and the server answers a call to it with `-32020`. Use `z.int()` or remove the annotation. (#2762, #2960)\r\n- **`outputSchema` from `z.object(...).meta({ id })`.** On a 2025-11-25 connection the result is no longer wrapped in `{ result }`: read `structuredContent`, not `structuredContent.result`. (#3081)\r\n- **The bundled Ajv validator uses fast-uri 3.1.8.** It rejects a `$id` or `$ref` with an invalid URI scheme, such as `my_tool:output`. (#3083)\r\n\r\n## New\r\n\r\n- **Skills over MCP (SEP-2640).** A server publishes a folder of skills with `loadSkills(folder)` and `skills.attach(server)`; a client lists, reads and verifies them with `SkillsClient`. It works on 2025-11-25 and 2026-07-28. `attach` is experimental and may change in a minor release. (#3047, #3080)\r\n- **Opt-in `scope` on token refresh.** Implement `scopeForRefresh(tokens)` on your `OAuthClientProvider` for an authorization server that rejects a refresh without `scope` (Microsoft Entra ID, `AADSTS90009`). The default request does not change. (#3085)\r\n- `ServerEvent` takes optional `params`, so a gateway can forward change notifications with their `_meta`. (#3057)\r\n- The v1 to v2 upgrade guide is also an installable agent skill. (#2968)\r\n\r\n## Fixes\r\n\r\n- `update({ title })` on a resource or resource template shows up in list responses. (#3005)\r\n- A `Server` connected to a per-request transport at a modern revision binds that revision instead of answering `-32022`. (#3057)\r\n- `createMcpHandler` sends `Allow: POST` on every `405`. (#3002)\r\n- `@modelcontextprotocol/node` accepts `@hono/node-server` 1.x or 2.x; a new install resolves 2.x. (#3084)","publishedAt":"2026-10-23T18:32:25.000Z","fetchedAt":"2026-10-23T22:54:11.029Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.4.0","media":[],"coverageCount":0},{"id":"rel_Ici3EzIOixlimBMTJGB3z","version":"1.32.2","type":"feature","title":"1.32.2","summary":"Handlers can now be registered after connect() when the corresponding capability was declared, and Transport optional properties now carry explicit | undefined, backported to v1.x.","titleGenerated":"MCP TypeScript SDK 1.32.2 allows registering after connect when capability declared","titleShort":"Registration allowed after connect(); Transport types fixed","breaking":"none","importance":1,"content":"## What's Changed\r\n* fix: add explicit | undefined to Transport optional properties (v1.x backport of #1766) by @kishormorol in https://github.com/modelcontextprotocol/typescript-sdk/pull/2814\r\n* [v1.x] fix: allow registering after connect() when the capability was declared by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2958\r\n* chore: bump version to 1.32.2 by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/3089\r\n\r\n## New Contributors\r\n* @kishormorol made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/2814\r\n\r\n**Full Changelog**: https://github.com/modelcontextprotocol/typescript-sdk/compare/1.32.1...1.32.2","publishedAt":"2026-10-23T18:06:24.000Z","fetchedAt":"2026-10-23T22:54:11.029Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.2","media":[],"coverageCount":0},{"id":"rel_54sykKVe7YNBYqB4qD8ee","version":"v2.3.1","type":"feature","title":"2.3.1","summary":"requireBearerAuth in @modelcontextprotocol/server-legacy now takes the optional expectedResource parameter added in @modelcontextprotocol/server 2.3.0, accepting only tokens issued for this server's audience; it is off unless set. The npm pages for the server and client packages now open with a note linking the documentation, migration guide, and issue form.","titleGenerated":"MCP TypeScript SDK v2.3.1 adds optional expectedResource audience check to legacy bearer auth","titleShort":"Legacy bearer auth gains opt-in audience check","breaking":"none","importance":2,"content":"| Package | Version |\r\n|---|---|\r\n| `@modelcontextprotocol/client` | 2.3.1 |\r\n| `@modelcontextprotocol/server` | 2.3.1 |\r\n| `@modelcontextprotocol/core` | 2.3.1 |\r\n| `@modelcontextprotocol/server-legacy` | 2.3.1 |\r\n| `@modelcontextprotocol/codemod` | 2.3.1 |\r\n| `@modelcontextprotocol/node`, `express`, `hono`, `fastify` | unchanged |\r\n\r\n## Changes\r\n\r\n- `requireBearerAuth` in `@modelcontextprotocol/server-legacy` takes the optional `expectedResource` that `@modelcontextprotocol/server` 2.3.0 added: it accepts only tokens issued for this server (the token's audience). Off unless you set it. (#2952)\r\n- The npm pages of `@modelcontextprotocol/server` and `@modelcontextprotocol/client` now open with one note that links the documentation, the migration guide and the issue form. (#2955)","publishedAt":"2026-10-05T11:54:56.000Z","fetchedAt":"2026-10-23T22:54:11.029Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1","media":[],"coverageCount":0},{"id":"rel_-JxoIn8ifdLjYVeV6ZcU6","version":"1.32.1","type":"feature","title":"1.32.1","summary":"## What's Changed\r\n* [v1.x] docs: state the principles in CLAUDE.md by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/293...","titleGenerated":"MCP TypeScript SDK 1.32.1 internal release","titleShort":null,"breaking":"none","importance":1,"content":"## What's Changed\r\n* [v1.x] docs: state the principles in CLAUDE.md by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2939\r\n* [v1.x] docs: point the README at v2 and say what v1.x supports by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2942\r\n* chore: bump version to 1.32.1 by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2954\r\n\r\n\r\n**Full Changelog**: https://github.com/modelcontextprotocol/typescript-sdk/compare/1.32.0...1.32.1","publishedAt":"2026-10-05T11:42:59.000Z","fetchedAt":"2026-10-23T22:54:11.231Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.1","media":[],"coverageCount":0},{"id":"rel_hx1rhE8g06zdJUouEsc2k","version":"v2.3.0","type":"feature","title":"2.3.0","summary":"Server.connect() now rejects while the instance is already connected, and stateless Streamable HTTP transport handles one request, so the McpServer and transport must be created inside the request handler or createMcpHandler factory. HTTP client transports follow a redirect only when it stays on the same origin, and the client now requires eventsource-parser 3.0.8 or later.","titleGenerated":"MCP TypeScript SDK v2.3.0 rejects shared servers and restricts redirects to same origin","titleShort":"One server per request; redirects pinned to same origin","breaking":"major","importance":4,"content":"| Package | Version |\r\n|---|---|\r\n| `@modelcontextprotocol/client` | 2.3.0 |\r\n| `@modelcontextprotocol/server` | 2.3.0 |\r\n| `@modelcontextprotocol/core` | 2.3.0 |\r\n| `@modelcontextprotocol/server-legacy` | 2.3.0 |\r\n| `@modelcontextprotocol/codemod` | 2.3.0 |\r\n| `@modelcontextprotocol/node` | 2.1.1 |\r\n| `@modelcontextprotocol/express`, `hono` | 2.0.2 |\r\n| `@modelcontextprotocol/fastify` | 2.0.1 |\r\n\r\n## Upgrade notes\r\n\r\n- **One server per request.** `Server.connect()` now rejects while the instance is already connected, and a stateless Streamable HTTP transport handles one request. Create the `McpServer` and the transport inside the request handler (or in the `createMcpHandler` factory) instead of sharing one instance across requests. Creating a server is cheap since #2889. (#2918)\r\n- **Redirects stay on the same origin.** The HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets `redirectPolicy: 'follow'` on the transport. In browsers, a redirected request fails unless that option is set. (#2901)\r\n- **New options, both off unless you set them.** `maxToolInputElements` on `McpServer` limits the number of array elements and object members in a tool call's arguments. `expectedResource` on `requireBearerAuth` / `verifyBearerToken` accepts only tokens issued for this server (the token's audience); with Express, upgrade `@modelcontextprotocol/express` together with `@modelcontextprotocol/server`. (#2926, #2929)\r\n- **`prompts/get` without `arguments` is validated as `{}`**, as `tools/call` already is. A top-level `.optional()` or `.default(...)` on a prompt's `argsSchema` no longer sees `undefined`. (#2107)\r\n- **The client requires `eventsource-parser` 3.0.8 or later.** It cuts the time and memory needed to receive a large message sent as a single SSE event: in our test a 100 MB tool result went from about a minute and 1.7 GB of peak memory to under a second and about 0.5 GB. (#2846)\r\n## New\r\n\r\n- `validateOriginHeader` and the `allowedOrigins` option of the Express, Fastify and Hono app helpers accept `<scheme>://*` entries such as `moz-extension://*`, so a server can admit MCP clients that run as a browser extension. (#2907)\r\n- `tasks/get` and `tasks/cancel` of the Tasks extension can be served and called on a 2026-07-28 connection. (#2599)\r\n\r\n## Fixes\r\n\r\n- A large message received as a single SSE event over Streamable HTTP is fast again: a 50 MB tool result that took about 13 seconds arrives in under a second. (#2846)\r\n- `prompts/get` without `arguments` no longer fails when every argument of the prompt is optional. (#2107)\r\n- `SSEClientTransport` refreshes once after a 401 on connect instead of retrying without limit. (#2905, #2934)\r\n- `registerTool` no longer converts tool schemas up front, so a server built per request stops converting every tool on every request. (#2889)\r\n- `hono` is a regular dependency of `@modelcontextprotocol/node`, so installs with strict peer-dependency checking no longer fail. (#2897)\r\n- A `server/discover` probe answered with an unusable 2xx reply now says so instead of reading like a network failure. (#2903)\r\n- `McpServer.registerPrompt()` types the callback correctly when no `argsSchema` is given. (#2841)\r\n- The `license` field of the package manifests is `Apache-2.0`. (#2908)","publishedAt":"2026-10-02T17:55:03.000Z","fetchedAt":"2026-10-23T22:54:11.231Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0","media":[],"coverageCount":0},{"id":"rel_l40lnpXg4Oj9tSkG0Ja06","version":"1.32.0","type":"feature","title":"1.32.0","summary":"The HTTP client transports now follow a redirect only when it stays on the same origin, allowing http to https on the same host; deployments redirecting to another host or port must configure the final URL or set redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport, and in browsers a redirected request fails unless that option is set. Adds opt-in maxToolInputElements on McpServer and expectedResource on requireBearerAuth, plus fixes so tools/call and prompts/get requests omitting arguments are accepted and in-memory task-store tasks stay within their creating session.","titleGenerated":"MCP TypeScript SDK 1.32.0 restricts HTTP redirects to same origin","titleShort":"HTTP redirects now same-origin only; bearer auth gains audience check","breaking":"major","importance":4,"content":"## Upgrade notes\r\n- **Redirects:** the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets `redirectPolicy: 'follow'` on `StreamableHTTPClientTransport` or `SSEClientTransport`. In browsers, a redirected request fails unless that option is set.\r\n- **New options, both off unless you set them:** `maxToolInputElements` on `McpServer` limits the number of array elements and object members in a tool call's arguments. `expectedResource` on `requireBearerAuth` accepts only tokens issued for this server (the token's audience).\r\n\r\n## What's Changed\r\n* [v1.x] fix(client): follow redirects only within the endpoint's origin by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2902\r\n* docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2910\r\n* [v1.x] examples: close idle sessions and cap the session map by @maxisbey in https://github.com/modelcontextprotocol/typescript-sdk/pull/2914\r\n* [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2925\r\n* [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2927\r\n* [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @raashish1601 in https://github.com/modelcontextprotocol/typescript-sdk/pull/2045\r\n* [v1.x] feat(auth): add expectedResource to requireBearerAuth by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2930\r\n* [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2931\r\n* chore: bump version to 1.32.0 by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2935\r\n\r\n## New Contributors\r\n* @raashish1601 made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/2045\r\n\r\n**Full Changelog**: https://github.com/modelcontextprotocol/typescript-sdk/compare/1.31.0...1.32.0","publishedAt":"2026-10-02T17:28:24.000Z","fetchedAt":"2026-10-23T22:54:11.231Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0","media":[],"coverageCount":0},{"id":"rel_I1Mvq2LMQfKqwvP5MqwYO","version":"v2.2.0","type":"feature","title":"2.2.0","summary":"listTools(), listPrompts(), listResources() and listResourceTemplates() called without a cursor now follow nextCursor until the server stops sending one, with listMaxPages still capping the walk. Constructing the machine-to-machine OAuth providers without expectedIssuer is deprecated and warns, and fetchToken() now throws AuthorizationServerMismatchError when client information is bound to a different authorization server.","titleGenerated":"MCP TypeScript SDK 2.2.0 paginates list calls and requires expectedIssuer for OAuth providers","titleShort":"List calls now paginate fully; OAuth providers need expectedIssuer","breaking":"minor","importance":3,"content":"| Package | Version |\r\n|---|---|\r\n| `@modelcontextprotocol/client` | 2.2.0 |\r\n| `@modelcontextprotocol/server` | 2.2.0 |\r\n| `@modelcontextprotocol/core` | 2.2.0 |\r\n| `@modelcontextprotocol/server-legacy` | 2.2.0 |\r\n| `@modelcontextprotocol/codemod` | 2.2.0 |\r\n| `@modelcontextprotocol/node`, `express`, `hono`, `fastify` | unchanged |\r\n\r\n## Upgrade notes\r\n\r\n- **Pass `expectedIssuer` to the machine-to-machine OAuth providers.** Constructing `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or `CrossAppAccessProvider` without it is deprecated and logs a warning. Set it to the `issuer` of the authorization server the credentials were registered with. (#2887)\r\n- **`fetchToken()` checks which authorization server the client information belongs to.** It throws `AuthorizationServerMismatchError` before sending anything when the provider's client information is bound to a different authorization server. (#2887)\r\n- **List calls return the whole list.** `listTools()`, `listPrompts()`, `listResources()` and `listResourceTemplates()` called without a cursor now follow `nextCursor` until the server stops sending one. `listMaxPages` still caps the walk. (#2886)\r\n\r\n## Fixes\r\n\r\n- CommonJS TypeScript projects type-check again: the `jose` types used by the DPoP API are inlined into the declaration files (regression in 2.1.0). (#2883)\r\n- `Client.listen()` no longer lets a rejection escape as a process-level unhandled rejection, and no longer hangs when a send never settles. (#2642)\r\n- `_meta` is preserved on `input_required` results. (#2862)\r\n- Hostnames ending in `.localhost` count as loopback for OAuth token endpoints, so host-based multi-tenant local setups work. (#2597)\r\n- `OAuthTokensSchema` and `OAuthClientInformationSchema` accept the optional `issuer` field, so a provider that reads its storage back through them keeps it. (#2887)\r\n- `createMcpHandler` no longer overflows the stack when the factory returns the same server instance for more than one request. Returning a fresh instance per request is still required. (#2778)\r\n- `createMcpHandler` ends a `subscriptions/listen` stream right after the acknowledgement when it honored none of the requested notification types. (#2651)\r\n- Sending a notification on a closed connection no longer produces a briefly unhandled promise rejection. (#2885)\r\n- The `v1-to-v2` codemod keeps a file's leading comment block and directives above the rewritten imports. (#2582)\r\n- Corrected citations in the JSDoc for OAuth token endpoints and for the `registerClient` deprecation notice. (#2768, #2729)\r\n\r\n## Thanks\r\n\r\n@maxisbey, @web-abin, @SyedTashfin, @arimu1, @axits-lab, @vjymisal0 and @sushantkumar23.\r\n\r\n## Per-package changelogs\r\n\r\n[client](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fclient%402.2.0) · [server](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fserver%402.2.0) · [core](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fcore%402.2.0) · [server-legacy](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fserver-legacy%402.2.0) · [codemod](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fcodemod%402.2.0)","publishedAt":"2026-09-28T19:24:07.000Z","fetchedAt":"2026-10-23T22:54:11.302Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0","media":[],"coverageCount":0},{"id":"rel_zM92GiDSKc-BXoL4vCh-Y","version":"1.31.0","type":"feature","title":"1.31.0","summary":"Stored OAuth tokens and client information now include an issuer field, binding credentials to the authorization server that issued them; storage rejecting unknown fields must allow it. Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider, or StaticPrivateKeyJwtProvider, since constructing them without it is deprecated.","titleGenerated":"MCP TypeScript SDK 1.31.0 binds stored OAuth credentials to their issuer","titleShort":"OAuth credentials bound to issuing auth server; issuer field required","breaking":"minor","importance":3,"content":"## Upgrade notes\r\n- Stored OAuth tokens and client information now include an `issuer` field. Storage that rejects unknown fields needs to allow it.\r\n- Pass `expectedIssuer` when constructing `ClientCredentialsProvider`, `PrivateKeyJwtProvider` or `StaticPrivateKeyJwtProvider`. Constructing them without it is deprecated.\r\n\r\n## What's Changed\r\n* [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @maxisbey in https://github.com/modelcontextprotocol/typescript-sdk/pull/2888\r\n* chore: bump version to 1.31.0 by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2890\r\n\r\n\r\n**Full Changelog**: https://github.com/modelcontextprotocol/typescript-sdk/compare/1.30.1...1.31.0","publishedAt":"2026-09-28T18:52:02.000Z","fetchedAt":"2026-10-23T22:54:11.302Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.31.0","media":[],"coverageCount":0},{"id":"rel_TsOeu34C25OXhNZeBYxmY","version":"1.30.1","type":"feature","title":"1.30.1","summary":"The server now reads HTTP request bodies with a size limit and bounds JSON-RPC batch length, and auth resource URIs are preserved without trailing-slash rewriting.","titleGenerated":"MCP TypeScript SDK 1.30.1 caps HTTP body size and JSON-RPC batch length","titleShort":"HTTP body size limits; auth resource URI keeps trailing slash","breaking":"none","importance":2,"content":"## What's Changed\r\n* [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @maxisbey in https://github.com/modelcontextprotocol/typescript-sdk/pull/2717\r\n* fix(auth): preserve resource URI without trailing slash (#1968) by @MukundaKatta in https://github.com/modelcontextprotocol/typescript-sdk/pull/1972\r\n* chore: bump version to 1.30.1 by @claude[bot] in https://github.com/modelcontextprotocol/typescript-sdk/pull/2848\r\n\r\n## New Contributors\r\n* @MukundaKatta made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1972\r\n\r\n**Full Changelog**: https://github.com/modelcontextprotocol/typescript-sdk/compare/1.30.0...1.30.1","publishedAt":"2026-09-23T15:59:38.000Z","fetchedAt":"2026-10-23T22:54:11.302Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.30.1","media":[],"coverageCount":0},{"id":"rel_-SnyY4rq8l3hiz5tAk8T1","version":"1.30.0","type":"feature","title":"1.30.0","summary":"Streamable HTTP server transport now sends SSE keep-alive comment frames and fixes the keep-alive timer lifecycle. Content-Type is validated against the parsed media type instead of a substring match, and the release widens @hono/node-server past GHSA-frvp-7c67-39w9.","titleGenerated":"MCP TypeScript SDK 1.30.0 fixes SSE keep-alive and validates Content-Type","titleShort":"SSE keep-alive fixed; Content-Type validated by media type","breaking":"none","importance":2,"content":"## What's Changed\r\n* fix(server): prioritize zod issues and format them by @mozmo15 in https://github.com/modelcontextprotocol/typescript-sdk/pull/1503\r\n* chore(ci): switch publish to OIDC trusted publishing by @felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/1839\r\n* Add end-to-end test suite by @felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/2167\r\n* v1 stdio buffer limit by @KKonstantinov in https://github.com/modelcontextprotocol/typescript-sdk/pull/2239\r\n* fix: support Zod 3.25 method literals by @mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/2368\r\n* Validate Content-Type by parsed media type instead of substring match (v1.x) by @felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/2444\r\n* fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @mattzcarey in https://github.com/modelcontextprotocol/typescript-sdk/pull/2538\r\n* fix(deps): widen @hono/node-server past GHSA-frvp-7c67-39w9 by @arimu1 in https://github.com/modelcontextprotocol/typescript-sdk/pull/2549\r\n* Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/2547\r\n* chore: bump version to 1.30.0 by @felixweinberger in https://github.com/modelcontextprotocol/typescript-sdk/pull/2563\r\n\r\n## New Contributors\r\n* @mozmo15 made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/1503\r\n* @arimu1 made their first contribution in https://github.com/modelcontextprotocol/typescript-sdk/pull/2549\r\n\r\n**Full Changelog**: https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0","publishedAt":"2026-07-27T17:54:36.000Z","fetchedAt":"2026-10-23T22:54:11.373Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.30.0","media":[],"coverageCount":0}],"pagination":{"nextCursor":null,"limit":20},"summaries":{"rolling":null,"monthly":[]}}