The MCP TypeScript SDK is the official TypeScript implementation for building Model Context Protocol servers and clients for Node.js, Bun, and Deno. It provides server and client libraries plus optional middleware adapters to wire MCP into runtimes like Node.js HTTP, Express, and Hono. It is useful if you want to expose or consume MCP tools, resources, and prompts from a TypeScript app.
Project status
- Actively maintained: upstream pushed on 2026-10-28, and updates appeared as recently as 2026-10-23.
- Recent updates are frequent, with updates on 2026-10-05 and 2026-10-23, including several package-level changes.
AI summary generated
Recent updates
v2.4.0
Version 2.4.0 releases the v2 package set and adds Skills over MCP, optional OAuth refresh scopes, and additional protocol support. It also documents three compatibility changes and fixes resource listing, transport revision binding, HTTP 405 responses, and Hono adapter compatibility.
BreakingFeatures@modelcontextprotocol/server-legacy@2.4.0
This patch release updates the `@modelcontextprotocol/core` dependency to version 2.4.0. No other changes are described in the release notes.
@modelcontextprotocol/server@2.4.0
This release adds the Skills extension across the server, client, and core packages, and allows subscription notifications to carry additional parameters. It also tightens schema and parameter validation, which can affect existing tools and clients, alongside fixes for protocol negotiation and resource listing.
BreakingFeatures@modelcontextprotocol/node@2.1.2
This patch widens the supported `@hono/node-server` dependency range, allowing new installs to resolve to 2.x while retaining 1.x as a fallback. It also updates the `@modelcontextprotocol/server` dependency to 2.4.0.
@modelcontextprotocol/codemod@2.4.0
Version 2.4.0 of @modelcontextprotocol/codemod was published on 2026-10-23, but the publisher provided no release notes. No specific features, fixes, compatibility changes, or upgrade actions can be identified from the available information.
@modelcontextprotocol/client@2.4.0
Version 2.4.0 adds the Skills extension across the client, server, and core packages, and adds an opt-in way to send scope on OAuth refresh requests. It also updates schema validation behavior and the bundled URI validator, with several additional integration and notification behaviors visible in the diff but not called out in the release notes.
BreakingFeatures@modelcontextprotocol/core@2.4.0
Adds the Skills extension across the server, client, and core packages, with APIs for listing, retrieving, reading, and validating skills. The server attachment mechanism is experimental; the rest of the Skills API is stable.
Features1.32.2
The release notes document two fixes: explicit `undefined` typing for optional `Transport` properties and allowing capability-declared registrations after `connect()`. The supplied diff also contains substantial unmentioned API additions and behavior changes, most notably stricter default redirect handling, OAuth issuer and audience checks, and a default size limit for stdio messages.
BreakingSecurityFeaturesv2.3.1
Release 2.3.1 includes one auth-related API behavior adjustment for `@modelcontextprotocol/server-legacy` and a small docs/help note change for the npm pages. The provided diff, however, shows many additional repository-level changes (documentation site content, CI/workflow updates, and contributor tooling) that are not mentioned in the release notes.
Breaking@modelcontextprotocol/core@2.3.1
No release notes were provided for @modelcontextprotocol/core 2.3.1, so the changes included in this version cannot be determined from the release metadata alone. Developers should review the upstream changelog, compare tags, or inspect the diff between 2.3.0 and 2.3.1 to assess upgrade impact.
@modelcontextprotocol/server-legacy@2.3.1
This patch release updates `@modelcontextprotocol/server-legacy` to support an optional `expectedResource` parameter in `requireBearerAuth`, aligning its behavior with newer `@modelcontextprotocol/server` 2.3.0 and `@modelcontextprotocol/sdk` 1.32.0. It also updates `@modelcontextprotocol/core` to 2.3.1.
SecurityFeatures@modelcontextprotocol/codemod@2.3.1
Release @modelcontextprotocol/codemod version 2.3.1 is published, but the publisher provided no release notes. With no documented changes, there is not enough information here to identify new features, breaking changes, bug fixes, or security updates for upgrade planning.
@modelcontextprotocol/server@2.3.1
This is a patch release for @modelcontextprotocol/server@2.3.1. The only noted change is an update to its dependency on @modelcontextprotocol/core to the matching 2.3.1 version.
@modelcontextprotocol/client@2.3.1
Release @modelcontextprotocol/client@2.3.1 is described as a patch update that only bumps @modelcontextprotocol/core to 2.3.1. The actual diff, however, includes behavioral changes in request authentication handling and updates to expected error handling semantics and tools/call request behavior.
1.32.1
Release 1.32.1 release notes only mention documentation updates and a version bump. However, the code diff included in this release contains multiple functional changes across client auth, transport behavior, and OAuth provider capabilities that are not described anywhere in the release notes.
BreakingFeaturesv2.3.0
Release 2.3.0 introduces multiple documented behavioral changes around server connection lifecycle (one server per request), redirect handling constraints, and new optional configuration for tool input size and bearer token audience checks. It also updates schema validation behavior for `prompts/get` when `arguments` is omitted, and includes client-side performance improvements tied to `eventsource-parser`.
BreakingFeatures@modelcontextprotocol/fastify@2.0.1
This patch changes connection and request concurrency semantics for the MCP Fastify integration. A single reusable `Server` instance or a stateless HTTP transport (with `sessionIdGenerator: undefined`) is no longer safe, and concurrent or repeated requests can fail with `ALREADY_CONNECTED`, 500 responses, or unhandled rejections depending on the host.
Breaking@modelcontextprotocol/node@2.1.1
This patch release fixes installation issues with strict peer-dependency checking by making `hono` a regular dependency of `@modelcontextprotocol/node`. It also introduces a significant behavioral change in the Node HTTP server transport: a `Server` or stateless transport instance can no longer be reused across multiple concurrent requests (and in some cases, not even sequentially), requiring per-request (and per-session) construction.
Breaking@modelcontextprotocol/hono@2.0.2
This patch primarily changes connection and transport reuse semantics for the HTTP streamable server transports. If you reuse a single `McpServer` instance or a stateless transport across multiple HTTP requests, the second request will now fail with `ALREADY_CONNECTED` or a “cannot be reused across requests” error.
Breaking@modelcontextprotocol/core@2.3.0
This patch release updates the `license` field in the package manifest to `Apache-2.0` and ensures the `LICENSE` file shipped in each package includes the full terms (including MIT text for earlier contributions). The release notes explicitly state there is no code change, so runtime behavior and APIs should remain the same.