@modelcontextprotocol/server

Upgrade notes

• One server per request. Server.connect() now rejects while the instance is already connected, and a stateless Streamable HTTP transport handles one request. Create the McpServer and the transport inside the request handler (or in the createMcpHandler factory) instead of sharing one instance across requests. Creating a server is cheap since #2889.

• Redirects stay on the same origin. The HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on the transport. In browsers, a redirected request fails unless that option is set.

• New options, both off unless you set them. maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth / verifyBearerToken accepts only tokens issued for this server (the token's audience); with Express, upgrade @modelcontextprotocol/express together with @modelcontextprotocol/server. (#2926, #2929)

• prompts/get without arguments is validated as {}, as tools/call already is. A top-level .optional() or .default(...) on a prompt's argsSchema no longer sees undefined.

• The client requires eventsource-parser 3.0.8 or later. It cuts the time and memory needed to receive a large message sent as a single SSE event: in our test a 100 MB tool result went from about a minute and 1.7 GB of peak memory to under a second and about 0.5 GB.

New

• validateOriginHeader and the allowedOrigins option of the Express, Fastify and Hono app helpers accept <scheme>://* entries such as moz-extension://*, so a server can admit MCP clients that run as a browser extension.

• tasks/get and tasks/cancel of the Tasks extension can be served and called on a 2026-07-28 connection.

Fixes

• A large message received as a single SSE event over Streamable HTTP is fast again: a 50 MB tool result that took about 13 seconds arrives in under a second.

• prompts/get without arguments no longer fails when every argument of the prompt is optional.

• SSEClientTransport refreshes once after a 401 on connect instead of retrying without limit. (#2905, #2934)

• registerTool no longer converts tool schemas up front, so a server built per request stops converting every tool on every request.

• hono is a regular dependency of @modelcontextprotocol/node, so installs with strict peer-dependency checking no longer fail.

• A server/discover probe answered with an unusable 2xx reply now says so instead of reading like a network failure.

• McpServer.registerPrompt() types the callback correctly when no argsSchema is given.

• The license field of the package manifests is Apache-2.0.

Upgrade notes

• deprecated

  Pass expectedIssuer to the machine-to-machine OAuth providers. Constructing ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider or CrossAppAccessProvider without it is deprecated and logs a warning. Set it to the issuer of the authorization server the credentials were registered with.

• fetchToken() checks which authorization server the client information belongs to. It throws AuthorizationServerMismatchError before sending anything when the provider's client information is bound to a different authorization server.

• List calls return the whole list. listTools(), listPrompts(), listResources() and listResourceTemplates() called without a cursor now follow nextCursor until the server stops sending one. listMaxPages still caps the walk.

Fixes

• CommonJS TypeScript projects type-check again: the jose types used by the DPoP API are inlined into the declaration files (regression in 2.1.0).

• Client.listen() no longer lets a rejection escape as a process-level unhandled rejection, and no longer hangs when a send never settles.

• _meta is preserved on input_required results.

• Hostnames ending in .localhost count as loopback for OAuth token endpoints, so host-based multi-tenant local setups work.

• OAuthTokensSchema and OAuthClientInformationSchema accept the optional issuer field, so a provider that reads its storage back through them keeps it.

• createMcpHandler no longer overflows the stack when the factory returns the same server instance for more than one request. Returning a fresh instance per request is still required.

• createMcpHandler ends a subscriptions/listen stream right after the acknowledgement when it honored none of the requested notification types.

• Sending a notification on a closed connection no longer produces a briefly unhandled promise rejection.

• The v1-to-v2 codemod keeps a file's leading comment block and directives above the rewritten imports.

• Corrected citations in the JSDoc for OAuth token endpoints and for the registerClient deprecation notice. (#2768, #2729)

Per-package changelogs

client · server · core · server-legacy · codemod

Minor Changes

• Add request-time OAuth scope challenges for tools, resources, resource templates,
  and prompts. Each primitive's scopeChallenge callback receives the parsed
  request and verified authentication info, then either continues or returns the
  exact scope set for an insufficient_scope response. requireScopes provides a
  small helper for static all-of checks.

  createMcpHandler and Streamable HTTP transports return HTTP 403 with an
  insufficient_scope challenge before handler execution or SSE setup. The
  preflight is active whenever a registered primitive carries a scopeChallenge
  callback — there is no handler- or transport-level configuration. The
  challenge's WWW-Authenticate header is built by the same formatter as the
  bearer-auth 401/403 answers, and its resource_metadata parameter is derived
  from the verified AuthInfo: requireBearerAuth / verifyBearerToken now
  stamp their configured resourceMetadataUrl onto the AuthInfo they return
  (new optional AuthInfo.resourceMetadataUrl field), with a fallback to the
  well-known location for an HTTP(S) RFC 8707 resource identifier; the
  parameter is omitted when neither is available.

Patch Changes

• deprecated

  SdkError and SdkHttpError accept standard ErrorOptions as an optional fourth constructor argument and forward it to Error, so a wrapped error is reachable through the standard Error.cause chain. Version-negotiation probe failures (SdkErrorCode.EraNegotiationFailed) now use it: the underlying TypeError: fetch failed and the DNS or socket error beneath it surface via error.cause, so pino, Sentry, and util.inspect render ENOTFOUND / ECONNREFUSED / ETIMEDOUT instead of stopping at the SdkError (#2657). The previous error.data.cause slot is still populated for compatibility but is deprecated and slated for removal; read error.cause instead.

• Treat request id 0 as a real id. Two guards tested a RequestId for truthiness, so the legal JSON-RPC ids 0 and '' were read as absent. Id 0 is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first sampling/createMessage, elicitation/create, or roots/list a server sends.

  • notifications/cancelled carrying id 0 was ignored, and the in-flight handler ran to completion with its AbortSignal never fired.

  • A notification sent with relatedRequestId: 0 wrongly passed the debounce gate (for methods opted into debouncedNotificationMethods). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.

  Absent is now the only value that means "no id".

• Stop sending notifications/cancelled for the initialize handshake. The spec is explicit that a client MUST NOT attempt to cancel its initialize request, but the outbound cancel path fired for any in-flight request: aborting the AbortSignal passed to connect(), or letting the handshake hit its timeout, put a forbidden cancellation on the wire naming the initialize request id.

  The local behaviour is unchanged — the caller's promise still rejects with the same abort/timeout error, and connect() still tears the connection down. Only the wire notification is suppressed. Every other method keeps the existing cancellation path.

• Read Streamable HTTP request bodies with a size limit. Every SDK-owned body read
  WebStandardStreamableHTTPServerTransport (and the Node transport built on it),
  createMcpHandler, toNodeHandler, and createMcpHonoApp's JSON pre-parse — now stops at
  4 MiB by default (the limit the legacy SSE transport already uses; the Express adapter and stdio
  bound their reads too) and answers 413 Payload Too Large before anything is parsed.
  toWebRequest (when it reads the Node stream itself) now rejects once the body exceeds the
  limit with an error whose name is 'RequestBodyTooLargeError' and status is 413, and
  toNodeHandler answers that with 413; hand-wired callers of toWebRequest should handle the
  rejection or pass a pre-parsed body, and isLegacyRequest reports such a request as non-legacy
  so the modern handler answers it. JSON-RPC batch arrays are limited to 100 messages; a longer
  batch is answered 400 / -32600 and none of it is dispatched.

  The limit is configurable with a new maxRequestBodySize option (bytes, default
  DEFAULT_MAX_REQUEST_BODY_SIZE = 4 MiB, exported from @modelcontextprotocol/server) on
  WebStandardStreamableHTTPServerTransportOptions, CreateMcpHandlerOptions (forwarded to its
  stateless legacy leg; isLegacyRequest and legacyStatelessFallback take the same option),
  CreateMcpHonoAppOptions, and ToNodeHandlerOptions / ToWebRequestOptions (the adapter's
  bound applies before the handler's, so raise both). The bounded reader is exported as
  readRequestBody for adapter authors. Hosts that pre-parse the body and pass it as
  parsedBody skip the SDK's read and its size limit entirely; the batch bound applies either way.

  createMcpHonoApp and createMcpExpressApp now run their Host/Origin validation before the
  JSON body parser, so a request from a disallowed Host or Origin with an invalid JSON body is
  answered 403 rather than 400, and its body is not read.

• Reject a modern (2026-07-28) POST that omits the required MCP-Protocol-Version header.

  createMcpHandler accepted a request whose body carried a valid per-request _meta
  envelope but whose MCP-Protocol-Version header was absent: the request was classified
  modern, dispatched, and answered 200 — tool handlers ran. Only the mismatch case
  (header present, disagreeing with the body) was rejected, so of the standard headers
  SEP-2243 requires on a modern POST, presence was enforced for Mcp-Method (and for
  Mcp-Name on the methods that mirror params.name / params.uri) but not for
  MCP-Protocol-Version.

  Such a request is now refused with 400 Bad Request and JSON-RPC -32020
  (HeaderMismatch), matching the shape the sibling missing-header cells already emit and
  echoing the request id — per the Streamable HTTP spec, which requires the header on every
  POST and lists a missing required standard header as a HeaderMismatch failure. The
  spec's allowance to treat a header-less request as 2025-03-26 is available only to a
  server that also serves pre-2025-06-18 clients, and permits routing it to legacy
  handling — never serving it as 2026-07-28; under legacy: 'reject' the requirement is
  unconditional.

  Era classification is deliberately unchanged and stays body-primary: a proxy that strips
  the header still must not change the era, so such a request is still classified modern
  and is refused one rung later, at standard-header-validation — the same rung that
  already answers a missing Mcp-Method. Legacy-era traffic is untouched, notifications
  are unaffected, body-less GET / DELETE session operations are method-routed before
  any header validation, and stdio serving (which has no HTTP headers) is not involved.

  Clients built with this SDK always send the header, so no first-party client is affected;
  hand-rolled clients that omitted it must add it.

• StdioServerTransport now closes itself and fires onclose when its stdin ends or closes. The stdio binding says servers "SHOULD exit promptly when their standard input is closed" — stdin EOF is the primary graceful-shutdown signal, and on some platforms (notably Windows, where no signal is delivered when the parent goes away) the only reliable one. Previously the transport listened only for data and error, so when an MCP client hung up its end of the pipe (window closed, session restarted, host crashed) the server never noticed: onclose never fired, nothing tore down, and server processes accumulated as zombies until killed by hand. The transport now attaches end/close listeners on stdin that close the transport (idempotently — onclose still fires exactly once if close() is also called), so Server/McpServer and serveStdio tear down through the existing onclose chain and a well-behaved server process exits naturally. Requests still in flight when stdin ends are aborted (their handlers observe signal.aborted) and their responses are not written: EOF means the client has hung up and is no longer waiting. A client that wants answers keeps stdin open until it has read them.

• Emit and validate the Mcp-Name header for tasks requests per SEP-2663's Streamable HTTP binding: the client transport now mirrors params.taskId into Mcp-Name on tasks/get / tasks/update / tasks/cancel (previously omitted, causing conforming servers to reject every task poll with -32020 HeaderMismatch), and the server-side standard-header validation cross-checks it via the same shared MCP_NAME_HEADER_SOURCE table.

  On the server, createMcpHandler now answers a modern (2026-07-28) tasks/get / tasks/update / tasks/cancel POST that omits Mcp-Name, or whose header disagrees with params.taskId, with 400 / -32020 (HeaderMismatch) at the standard-header-validation rung, the same treatment tools/call / prompts/get / resources/read already get. Legacy-era (2025-11-25) tasks traffic is unaffected. Clients built with this SDK release send the header; hand-rolled clients that omitted it must add it.

Minor Changes

• Export the Protocol base class and mergeCapabilities from the @modelcontextprotocol/client and @modelcontextprotocol/server package roots, restoring the v1 import for consumers that subclass Protocol (e.g. the MCP Apps SDK). The client and server packages each bundle their own compiled copy of the class, so import it from one package consistently within a process.

  The codemod now rewrites Protocol and mergeCapabilities imports from shared/protocol.js to the client or server package root, like the module's other symbols, instead of dropping them with an action-required marker.

• Move the schema source modules (spec schemas, OAuth schemas, protocol constants) into @modelcontextprotocol/core and resolve them from there as a regular runtime dependency instead of bundling a private copy into each package. An application importing more than one of the packages now evaluates a single shared schema graph with shared object identity. @modelcontextprotocol/core gains a ./internal subpath (SDK-internal contract; may change in any release) and the four packages now version together.

• Align the 2026-07-28 wire with the final revision (spec PR #3002): serverInfo moves from the DiscoverResult body to the result _meta, and the per-request envelope's clientInfo demotes from required to SHOULD.

  Before this change the SDK shipped the pre-#3002 shape in both directions: the client hard-rejected a conforming server's DiscoverResult (missing body serverInfo failed parse, so the probe misclassified the server as legacy and attempted an initialize handshake against it — a hard connect failure against a modern-only server such as go-sdk v1.7.0-pre.3), and the server rejected conforming clients that omit clientInfo.

  Now:

  • The 2026 wire schemas are the final revision exactly: no body serverInfo on DiscoverResult, envelope clientInfo optional (a present-but-malformed value still fails validation).

  • Servers stamp _meta['io.modelcontextprotocol/serverInfo'] on every 2026-era response (spec SHOULD; a handler-authored value wins, the 2025-era wire is untouched). This includes the entry-built subscriptions/listen graceful-close results — the spec's SubscriptionsListenResultMeta extends ResultMetaObject.

  • Clients keep sending clientInfo and read server identity from the discover result's _meta only. A server that stamps no identity is anonymous: getServerVersion() is undefined and the response cache partitions under a per-connection surrogate. A malformed _meta serverInfo value is treated as absent on receive (the spec marks the field self-reported, unverified, and display-only).

  • Breaking type changes: DiscoverResult no longer declares serverInfo; RequestMetaEnvelope's clientInfo is optional. New public constant SERVER_INFO_META_KEY ('io.modelcontextprotocol/serverInfo').

• Allow inputRequired.elicit() to accept a Standard Schema such as a Zod object for requestedSchema. The builder converts it to MCP's restricted form-elicitation JSON Schema, while the same schema can validate and type the response through acceptedContent() on handler re-entry. Zod formats mapping to email, uri, date, and date-time are supported. Shapes the restricted schema cannot express reject before anything is sent — nested objects, .regex() and customized zod format patterns, exclusive number bounds (.positive()/.gt()), literal unions (use z.enum or z.literal(['a', 'b'])), and non-spec root keywords like z.strictObject()'s additionalProperties.

• Add configurable SSE keep-alive comment frames to Streamable HTTP transports and apply createMcpHandler's existing keepAliveMs option to every HTTP SSE stream it serves.

• Add runtime-neutral Bearer authentication to @modelcontextprotocol/server:
  requireBearerAuth gates web-standard fetch(request) hosts (Cloudflare
  Workers, Deno, Bun, Hono), built on the exported verifyBearerToken and
  bearerAuthChallengeResponse pieces, with OAuthTokenVerifier now defined
  here. The Express middleware adapts the same core and is unchanged in
  behavior, except that WWW-Authenticate challenge values are now RFC 7235
  quoted-string sanitized (quotes and backslashes escaped, control and
  non-ASCII characters replaced); @modelcontextprotocol/express re-exports
  OAuthTokenVerifier as before.

• Add runtime-neutral OAuth discovery serving to @modelcontextprotocol/server:
  oauthMetadataResponse serves the RFC 9728 Protected Resource Metadata and
  RFC 8414 Authorization Server metadata documents from web-standard
  fetch(request) hosts, built on the exported
  buildOAuthProtectedResourceMetadata, with
  getOAuthProtectedResourceMetadataUrl now defined here. The Express metadata
  router adapts the same core and is unchanged in behavior; the insecure-issuer
  escape hatch is an explicit dangerouslyAllowInsecureIssuerUrl option in the
  neutral core instead of a module-scope environment read. The web-standard
  matcher validates lazily so unmatched traffic always falls through, tolerates
  a trailing slash, supports HEAD, and marks reflected CORS preflights with
  Vary.

• Add preloadSchemas(), an explicit opt-in to eager wire-schema construction, and call it automatically in the Cloudflare Workers builds. The wire schemas are built lazily by default, which is the right trade on process-per-invocation runtimes — but on isolate platforms that bill request CPU while module evaluation runs during isolate warm-up, laziness moves construction into the first request each fresh isolate serves. Calling preloadSchemas() at module scope (it is synchronous and idempotent) moves that one-time cost back to module evaluation; the packages' workerd export condition now does this automatically, while the Node and browser builds stay lazy. The server package gains a dedicated browser shim for this (its browser condition previously reused the workerd shim), so browser bundles keep lazy construction.

Patch Changes

• First beta release of SDK v2 with support for the MCP 2026-07-28 specification
  revision. See the migration guides for upgrading from v1
  (docs/migration/upgrade-to-v2.md) and adopting the 2026-07-28 revision
  (docs/migration/support-2026-07-28.md).

• Restore the v1 parse tolerance for CallToolResult.content: an inbound legacy-era tools/call result without content defaults to `` instead of failing validation. Deployed servers — accepted by SDK v1 for years — return structuredContent-only (or otherwise content-less) results, and the strict parse turned every such call into an INVALID_RESULT error before application code could run.

  The silent-empty-success hazard the strictness guarded is preserved where it matters: the 2025 era's wire-seam schema refuses to default content for a body carrying another result family's vocabulary (task, inputRequests, requestState — the era is frozen, so the list is complete), and the 2026-era wire schemas stay strict — modern-revision servers have no legacy excuse. Task interop through an explicit result schema is untouched (including bodies that also stamp a foreign resultType), and the server-side authoring normalization refuses the same foreign-family vocabulary.

  Server-side authoring is era-independent: a handler result without content (dynamic/JS callers — the TypeScript surface requires it) is normalized to content: before era validation on every leg, reaching the wire spec-valid.

  Conscious call: the nested sampling ToolResultContentSchema stays spec-strict — v1 had defaulted its content too, but it is params-side (tool results a caller authors into a sampling message), deliberately not restored.

• Fix the CommonJS validators/ajv subpath so reading the exported Ajv class no longer throws ReferenceError: import_ajv is not defined. The subpath now re-exports the bundled provider's concrete Ajv value in CJS output, matching the existing ESM behavior.

• Ship CommonJS builds alongside ESM. Each package now emits both .mjs/.d.mts
  and .cjs/.d.cts (via tsdown format: ['esm', 'cjs']), and its exports map
  adds a require condition so require('@modelcontextprotocol/…') works from
  CommonJS consumers. Output extensions are normalized across all packages
  (@modelcontextprotocol/core moves from .js/.d.ts to .mjs/.d.mts); the
  public import paths are unchanged.

• POSTs whose Content-Type media type is not application/json are now
  rejected with 415 Unsupported Media Type; the header is parsed instead of
  substring-matched. Previously any value merely containing the substring
  passed the check (for example text/plain; a=application/json), case
  variants were wrongly rejected, and the 2026-07-28 entry did not inspect
  Content-Type at all — requests with a missing or non-JSON header that used
  to be served on that path now also answer 415. Values with parameters
  (application/json; charset=utf-8, including malformed parameter sections
  like application/json;) continue to work. SDK clients always send the
  correct header and are unaffected.

  The new isJsonContentType(header) helper is exported for transport and
  framework-adapter authors — custom entries composing the exported building
  blocks (classifyInboundRequest, PerRequestHTTPServerTransport) must apply
  it themselves. The hono adapter's JSON body pre-parse and the client's
  response dispatch now use the same parsed-media-type comparison.

• instanceof on the SDK error classes (ProtocolError and its typed subclasses, SdkError/SdkHttpError, OAuthError, and the client's SseError, UnauthorizedError, and OAuth-client-flow error family — OAuthClientFlowError and its subclasses) now works across separately bundled copies of the SDK. The classes match by a stable brand (via Symbol.hasInstance and a registry symbol) instead of prototype identity, so a process that uses both @modelcontextprotocol/client and @modelcontextprotocol/server - a gateway, host, or in-process test - can check errors constructed by either package against the class re-exported by the other. Ordinary prototype-based instanceof is preserved as a fallback; user-defined subclasses keep plain prototype semantics. Notes: cross-bundle matching requires both copies to be at or after this release; brands assert identity, not field shape, across versions - keep reading fields defensively. As a side effect, a foreign-bundle SdkError used as an abort reason is now rethrown as-is instead of being wrapped as a RequestTimeout. Branded hierarchies additionally expose an explicit static guard, X.isInstance(value), that reads the same brand and narrows in TypeScript — an alternative for codebases that prefer predicate-style checks over instanceof. Also: UnauthorizedError now sets error.name to 'UnauthorizedError' (previously 'Error'), and per-package conformance tests enforce that every exported error class participates in branding. Version-negotiation probing now recognizes UnauthorizedError (previously a dead name-string check) and propagates it unchanged, so connect() on an auth-gated server rejects with the original UnauthorizedError (previously wrapped as the cause of an SdkError(EraNegotiationFailed)) — run finishAuth() and reconnect, and the retry probes with the token.

• Construct the default Ajv validation engine lazily on first validation. Creating a Client or Server no longer pays the ajv + ajv-formats instantiation cost at startup when no JSON Schema validation ever runs.

• Build protocol-revision wire schemas lazily on first validation instead of at import. Each revision's schema set is now constructed by a module-level memoized factory, so importing the client or server package no longer pays the construction cost of both frozen wire-schema graphs up front. Method membership in the revision registries stays static, the schemas themselves are unchanged, and registry lookups keep returning reference-identical schema objects.

• Return JSON-RPC Invalid Params with the original URI and an invalid_uri reason when resources/read receives a syntactically malformed URI.

• Return HTTP 400 for a MissingRequiredClientCapabilityError (-32021) produced after dispatch. The spec mandates 400 Bad Request for this error with no condition on where it arose, but only the pre-dispatch capability gate honored that; the post-handler emission — the input_required gate rejecting an embedded request whose required capability the caller did not declare — surfaced in-band on HTTP 200. The JSON-RPC error body is unchanged, every other error code (including a handler relaying a downstream peer's -32020/-32022) keeps the origin-keyed in-band behavior, and the mapping only applies while the response is uncommitted: an exchange that already streamed — or one hosted with responseMode: 'sse', which opens its stream at dispatch end — keeps its committed 200 and carries the error in-stream.

• Stop advertising validator provider classes from the root client/server type declarations. The provider classes remain available from the explicit validator subpaths.

• Strip RFC 9110 optional whitespace around inbound MCP-Protocol-Version, Mcp-Method, and Mcp-Name values before classifying and validating modern HTTP requests. This keeps valid requests portable across Fetch runtimes that expose raw leading or trailing SP/HTAB through Headers.get().

• The default validator now honors declared 2019-09 and draft-07/06 dialects instead of rejecting them: a schema stamped "$schema": "http://json-schema.org/draft-07/schema#" (zod-to-json-schema's default output) validates with draft-07 semantics, and a 2019-09 stamp (zod-to-json-schema's 2019-09/openAi targets) with 2019-09 semantics, on both the Ajv and Cloudflare Workers providers (with known engine differences documented in the migration guide). Schemas with no $schema still validate as 2020-12, and unknown dialects still produce the typed error (now listing the supported dialects: 2020-12, 2019-09, draft-07, draft-06).