@modelcontextprotocol/sdk

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.

• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin

• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them

• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments

• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments

• [v1.x] feat(auth): add expectedResource to requireBearerAuth

Upgrade notes

• Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.

• deprecated

  Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

• [v1.x] Bind stored OAuth credentials to the authorization server that issued them

What's Changed

• [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length

• auth: preserve resource URI without trailing slash

What's Changed

• server: prioritize zod issues and format them

• Add end-to-end test suite

• v1 stdio buffer limit

• support Zod 3.25 method literals

• Validate Content-Type by parsed media type instead of substring match (v1.x)

• send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x)

• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)