{
  "tool": "mcp-ts-sdk",
  "name": "MCP TypeScript SDK",
  "long_name": "Model Context Protocol TypeScript SDK (@modelcontextprotocol/server, @modelcontextprotocol/client, @modelcontextprotocol/sdk)",
  "aliases": [
    "mcp-typescript-sdk",
    "typescript-sdk",
    "mcp-sdk",
    "mcp-ts",
    "mcp-sdk-typescript",
    "mcp-typescript",
    "modelcontextprotocol-sdk",
    "modelcontextprotocol-typescript-sdk",
    "modelcontextprotocol-server",
    "modelcontextprotocol-client",
    "modelcontextprotocol-core",
    "modelcontextprotocol-server-legacy",
    "modelcontextprotocol-codemod",
    "model-context-protocol-sdk",
    "model-context-protocol-typescript-sdk"
  ],
  "homepage": "https://github.com/modelcontextprotocol/typescript-sdk",
  "surface_kind": "library",
  "url": "https://insidetheloop.dev/tools/mcp-ts-sdk",
  "markdown_url": "https://insidetheloop.dev/tools/mcp-ts-sdk.md",
  "date_modified": "2026-10-07T14:26:03Z",
  "title": "MCP TypeScript SDK 2.3.1 and 1.32.1: latest versions, API diff and gotchas",
  "description": "MCP TypeScript SDK v2 2.3.1 and v1.x 1.32.1 (2026-10-05 UTC): install commands, our export diff, protocol versions and errors we reproduced.",
  "answer": "The latest MCP TypeScript SDK is 2.3.1 (`@modelcontextprotocol/server` and `@modelcontextprotocol/client`), released 2026-10-05 11:54 UTC; the v1.x line `@modelcontextprotocol/sdk` got 1.32.1 the same day. Install with `npm i @modelcontextprotocol/server@latest` or `npm i @modelcontextprotocol/client@latest`; migrate from v1 with `npx @modelcontextprotocol/codemod@latest v1-to-v2 .`. v2 implements the 2026-07-28 MCP revision, but a `Client` still connects with the 2025 `initialize` handshake unless you pass `versionNegotiation: { mode: 'auto' }`. Since 2.3.0 and 1.32.0 the HTTP client transports refuse cross-origin redirects, and since 2.3.0 an `McpServer` that is already connected rejects a second `connect()`.",
  "latest": {
    "version": "2.3.1",
    "released_at": "2026-10-05T11:54:56Z",
    "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1"
  },
  "upgrade": [
    {
      "label": "v2 server (Node.js 20 or later)",
      "command": "npm i @modelcontextprotocol/server@latest zod@^4.2.0\nnpm ls @modelcontextprotocol/server   # @modelcontextprotocol/server@2.3.1"
    },
    {
      "label": "v2 client",
      "command": "npm i @modelcontextprotocol/client@latest"
    },
    {
      "label": "Migrate a v1 project to v2 (run at the package root)",
      "command": "npx @modelcontextprotocol/codemod@latest v1-to-v2 .\ngrep -rn '@mcp-codemod-error' .\nnpx tsc --noEmit"
    },
    {
      "label": "Optional v2 framework adapters (versioned separately: node 2.1.1, express 2.0.2, hono 2.0.2, fastify 2.0.1)",
      "command": "npm i @modelcontextprotocol/node        # IncomingMessage/ServerResponse\nnpm i @modelcontextprotocol/express express\nnpm i @modelcontextprotocol/hono hono\nnpm i @modelcontextprotocol/fastify fastify"
    },
    {
      "label": "Stay on v1.x (maintenance line)",
      "command": "npm i @modelcontextprotocol/sdk@^1.32.1 zod"
    }
  ],
  "verified": {
    "date": "2026-10-07",
    "version": "2.3.1",
    "lines": {
      "1": "1.32.1",
      "2": "2.3.1"
    },
    "method": "Installed @modelcontextprotocol/server, client, core and server-legacy 2.2.0 and 2.3.1, and @modelcontextprotocol/sdk 1.31.0 and 1.32.1, from npm in throwaway Linux sandboxes (Node.js 24.20.0, TypeScript 6.0.3) with no credentials. Listed every export of every entry point from the type declarations (1,081 symbols for 2.3.1, 1,050 for 1.32.1), read the protocol-version constants at runtime, and ran the client/server scripts behind the gotchas below."
  },
  "updated_at": "2026-10-07T14:26:03Z",
  "key_facts": [
    "Two release lines from one repository. v2 (`@modelcontextprotocol/server`, `client`, `core`, `server-legacy`, `codemod`) is the stable line on `main` and implements the 2026-07-28 MCP revision. v1.x (`@modelcontextprotocol/sdk`) is the maintenance line on the `v1.x` branch, implements the spec up to 2025-11-25, and gets bug fixes and security updates for at least six months after v2's release on 2026-07-27.",
    "Latest: v2 2.3.1 (GitHub release 2026-10-05 11:54 UTC; npm `@modelcontextprotocol/server` 2.3.1 published 11:52 UTC) and `@modelcontextprotocol/sdk` 1.32.1 (npm 2026-10-05 11:47 UTC). Previous: 2.3.0 and 1.32.0 on 2026-10-02.",
    "npm downloads for 2026-09-28 to 2026-10-04: `@modelcontextprotocol/sdk` 76,226,448; `@modelcontextprotocol/core` 12,553,353; `server` 10,229,286; `client` 7,366,290. Most installs are still v1.x.",
    "The protocol constants are the same in 2.3.1 and 1.32.1 (read at runtime): `LATEST_PROTOCOL_VERSION` = `2025-11-25`; `SUPPORTED_PROTOCOL_VERSIONS` = `2025-11-25`, `2025-06-18`, `2025-03-26`, `2024-11-05`, `2024-10-07`. v2 reaches 2026-07-28 through `versionNegotiation` (`'auto'` or `{ pin: '2026-07-28' }`); the default is the 2025 handshake.",
    "v2 requires Node.js 20 or later and Zod 4 (`zod ^4.2.0` is a dependency); Zod 3 schemas fail at runtime. v1.32.1 declares Node.js 18 or later and a `zod` peer range of `^3.25 || ^4.0`.",
    "v2 stdio lives on subpaths: `@modelcontextprotocol/server/stdio` (`StdioServerTransport`, `serveStdio`) and `@modelcontextprotocol/client/stdio` (`StdioClientTransport`). `SSEServerTransport` and the OAuth Authorization Server helpers moved to the frozen `@modelcontextprotocol/server-legacy` (npm marks it deprecated).",
    "GitHub shows 34 releases from 2026-09-07 to 2026-10-07 because every v2 package gets its own tag: eight versions in all (2.1.0, 2.2.0, 2.3.0, 2.3.1 and 1.30.1, 1.31.0, 1.32.0, 1.32.1).",
    "13,531 GitHub stars on 2026-10-07. v2 package manifests say `Apache-2.0`; the README says new contributions are Apache-2.0 and existing code MIT; v1.x is MIT."
  ],
  "releases": [
    {
      "version": "2.3.1",
      "released_at": "2026-10-05T11:54:56Z",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1",
      "changes": [
        {
          "text": "`requireBearerAuth` in `@modelcontextprotocol/server-legacy` takes the optional `expectedResource` (token audience check) that `@modelcontextprotocol/server` 2.3.0 added; off unless set.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2952"
        },
        {
          "text": "The npm pages of `@modelcontextprotocol/server` and `client` open with a note linking the docs, the migration guide and the issue form. `node`, `express`, `hono`, `fastify` unchanged.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2955"
        }
      ]
    },
    {
      "version": "1.32.1",
      "released_at": "2026-10-05T11:42:59Z",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.1",
      "changes": [
        {
          "text": "v1.x (`@modelcontextprotocol/sdk`): documentation only. The README now points at v2 and states that v1.x implements the spec up to 2025-11-25 and will not get 2026-07-28.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2942"
        }
      ]
    },
    {
      "version": "2.3.0",
      "released_at": "2026-10-02T17:55:03Z",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0",
      "changes": [
        {
          "text": "One server per request: `Server.connect()` rejects while the instance is already connected, and a stateless Streamable HTTP transport handles one request. Create the `McpServer` inside the request handler or the `createMcpHandler` factory.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2918"
        },
        {
          "text": "HTTP client transports follow a redirect only within the same origin; set `redirectPolicy: 'follow'` or use the final URL.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2901"
        },
        {
          "text": "New opt-in options: `maxToolInputElements` on `McpServer`; `expectedResource` on `requireBearerAuth` / `verifyBearerToken` (upgrade `@modelcontextprotocol/express` with the server).",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2926"
        },
        {
          "text": "The client requires `eventsource-parser` 3.0.8 or later; a 50 MB tool result in one SSE event now arrives in under a second instead of about 13 seconds.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2846"
        },
        {
          "text": "`prompts/get` without `arguments` is validated as `{}`, so prompts whose arguments are all optional work.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2107"
        }
      ]
    },
    {
      "version": "1.32.0",
      "released_at": "2026-10-02T17:28:24Z",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0",
      "changes": [
        {
          "text": "v1.x: HTTP client transports follow redirects only within the endpoint's origin (`redirectPolicy: 'follow'` restores the old behaviour).",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2902"
        },
        {
          "text": "v1.x: `maxToolInputElements` option on `McpServer`.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2927"
        },
        {
          "text": "v1.x: `expectedResource` option on `requireBearerAuth`.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2930"
        },
        {
          "text": "v1.x: tasks of the in-memory task store stay within the session that created them.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2925"
        },
        {
          "text": "v1.x: `tools/call` and `prompts/get` requests that omit `arguments` are accepted.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2045"
        }
      ]
    },
    {
      "version": "2.2.0",
      "released_at": "2026-09-28T19:24:07Z",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0",
      "changes": [
        {
          "text": "Pass `expectedIssuer` to `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` and `CrossAppAccessProvider`; omitting it is deprecated and logs a warning. `fetchToken()` throws `AuthorizationServerMismatchError` when stored client information belongs to another authorization server.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2887"
        },
        {
          "text": "`listTools()`, `listPrompts()`, `listResources()` and `listResourceTemplates()` without a cursor now follow `nextCursor` to the end; `listMaxPages` caps the walk.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2886"
        },
        {
          "text": "CommonJS TypeScript projects type-check again (the `jose` types are inlined; regression in 2.1.0).",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2883"
        }
      ]
    }
  ],
  "surface": [
    {
      "from": "2.2.0",
      "to": "2.3.1",
      "method": "`bin/tool-snapshot` installed both versions in a throwaway Linux sandbox and listed every export of every package entry point from the type declarations with the TypeScript compiler API (1079 and 1081 exported symbols), then `bin/tool-diff` compared them. In the tables, \"command\" is an exported symbol and \"flags\" are its public members (function parameters in parentheses).",
      "summary": "2 exports added, 0 removed, 4 exports with public members added or removed; 17 declarations changed in any way.",
      "exports_added": [
        "@modelcontextprotocol/server McpServerOptions",
        "@modelcontextprotocol/server VerifyBearerTokenOptions"
      ],
      "exports_removed": [],
      "members": [
        {
          "export": "@modelcontextprotocol/client SSEClientTransportOptions",
          "added": [
            "redirectPolicy"
          ],
          "removed": []
        },
        {
          "export": "@modelcontextprotocol/client StreamableHTTPClientTransportOptions",
          "added": [
            "redirectPolicy"
          ],
          "removed": []
        },
        {
          "export": "@modelcontextprotocol/server-legacy BearerAuthMiddlewareOptions",
          "added": [
            "expectedResource"
          ],
          "removed": []
        },
        {
          "export": "@modelcontextprotocol/server-legacy/auth BearerAuthMiddlewareOptions",
          "added": [
            "expectedResource"
          ],
          "removed": []
        }
      ],
      "notes": [
        "v2 line: `@modelcontextprotocol/server`, `client`, `core` and `server-legacy` at the latest patch of the last two minors (2.2.0 and 2.3.1). 2.3.1 itself changed no export; the members above arrived in 2.3.0.",
        "`McpServerOptions` is `ServerOptions & { maxToolInputElements?: number }`; the `McpServer` constructor now takes it. `VerifyBearerTokenOptions` adds `expectedResource?: URL` and is the new parameter type of `requireBearerAuth` and `verifyBearerToken`.",
        "`redirectPolicy?: 'same-origin' | 'follow'` on both client HTTP transports is the switch for the redirect change below. The declaration text of `Server.connect()` now says it \"rejects while this instance is connected to another one\".",
        "Protocol constants read at runtime are unchanged in both versions: `LATEST_PROTOCOL_VERSION` = `2025-11-25`, `SUPPORTED_PROTOCOL_VERSIONS` = `2025-11-25`, `2025-06-18`, `2025-03-26`, `2024-11-05`, `2024-10-07`. The 2026-07-28 revision is negotiated separately (`versionNegotiation`, see the gotchas)."
      ]
    },
    {
      "from": "1.31.0",
      "to": "1.32.1",
      "method": "`bin/tool-snapshot` installed both versions in a throwaway Linux sandbox and listed every export of every package entry point from the type declarations with the TypeScript compiler API (1044 and 1050 exported symbols), then `bin/tool-diff` compared them. In the tables, \"command\" is an exported symbol and \"flags\" are its public members (function parameters in parentheses).",
      "summary": "6 exports added, 0 removed, 3 exports with public members added or removed; 18 declarations changed in any way.",
      "exports_added": [
        "@modelcontextprotocol/sdk/server/mcp.js McpServerOptions",
        "@modelcontextprotocol/sdk/shared/transport.js fetchLeavingRedirects",
        "@modelcontextprotocol/sdk/shared/transport.js fetchWithinOrigin",
        "@modelcontextprotocol/sdk/shared/transport.js followWithinOrigin",
        "@modelcontextprotocol/sdk/shared/transport.js isWithinOrigin",
        "@modelcontextprotocol/sdk/shared/transport.js unfollowedRedirect"
      ],
      "exports_removed": [],
      "members": [
        {
          "export": "@modelcontextprotocol/sdk/client/sse.js SSEClientTransportOptions",
          "added": [
            "redirectPolicy"
          ],
          "removed": []
        },
        {
          "export": "@modelcontextprotocol/sdk/client/streamableHttp.js StreamableHTTPClientTransportOptions",
          "added": [
            "redirectPolicy"
          ],
          "removed": []
        },
        {
          "export": "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js BearerAuthMiddlewareOptions",
          "added": [
            "expectedResource"
          ],
          "removed": []
        }
      ],
      "notes": [
        "v1.x line: `@modelcontextprotocol/sdk` 1.31.0 and 1.32.1, every `exports` entry point including each `./*` deep path (69 entry points). 1.32.1 itself changed no export; the changes arrived in 1.32.0.",
        "The same three options as v2 2.3.0 were backported: `redirectPolicy` on `StreamableHTTPClientTransportOptions` and `SSEClientTransportOptions`, `maxToolInputElements` (new `McpServerOptions`), `expectedResource` on `requireBearerAuth`. The five new `shared/transport.js` functions are the redirect helpers.",
        "`InMemoryTaskStore` methods now use their `sessionId` parameter (it was `_sessionId`, unused): tasks stay in the session that created them (PR #2925).",
        "Protocol constants are the same as v2's: `LATEST_PROTOCOL_VERSION` = `2025-11-25`. v1.x does not implement 2026-07-28 and will not."
      ]
    }
  ],
  "breaking": [
    {
      "version": "2.3.0",
      "change": "`Server.connect()` rejects while the instance is connected to another transport; a stateless Streamable HTTP transport serves one request. A server instance shared across requests or connections now fails.",
      "migrate": "Create the `McpServer` (and its transport) per request, or return a fresh instance from the `createMcpHandler` / `serveStdio` factory. Call `close()` before reconnecting an instance.",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2918"
    },
    {
      "version": "2.3.0 and 1.32.0",
      "change": "The Streamable HTTP and SSE client transports follow a redirect only when it stays on the same origin (scheme, host and port; http to https on the same host is allowed). In browsers a redirected request fails unless the option is set.",
      "migrate": "Configure the final URL as the endpoint, or pass `redirectPolicy: 'follow'` to `StreamableHTTPClientTransport` / `SSEClientTransport`.",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2901"
    },
    {
      "version": "2.2.0",
      "change": "Machine-to-machine OAuth providers without `expectedIssuer` are deprecated (warning). `fetchToken()` throws `AuthorizationServerMismatchError` before sending anything when the stored client information is bound to another authorization server. List calls without a cursor now return the whole list.",
      "migrate": "Set `expectedIssuer` to the `issuer` of the authorization server the credentials were registered with. Pass an explicit cursor or `listMaxPages` if you relied on one page.",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"
    },
    {
      "version": "1.31.0",
      "change": "v1.x: stored OAuth tokens and client information include an `issuer` field; constructing `ClientCredentialsProvider`, `PrivateKeyJwtProvider` or `StaticPrivateKeyJwtProvider` without `expectedIssuer` is deprecated.",
      "migrate": "Let your token storage accept the `issuer` field; pass `expectedIssuer`.",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2888"
    },
    {
      "version": "2.0.0",
      "change": "`@modelcontextprotocol/sdk` was split into `@modelcontextprotocol/server` and `@modelcontextprotocol/client` (plus `core` and optional `node`, `express`, `hono`, `fastify` adapters). Deep `@modelcontextprotocol/sdk/...js` imports do not exist in v2; stdio transports moved to `./stdio` subpaths; `SSEServerTransport` and `WebSocketClientTransport` were removed; Node.js 20 or later is required.",
      "migrate": "`npx @modelcontextprotocol/codemod@latest v1-to-v2 .` at the package root, then fix what `grep -rn '@mcp-codemod-error' .` and `tsc --noEmit` report. A frozen v1 SSE server transport is in `@modelcontextprotocol/server-legacy/sse`.",
      "url": "https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2"
    },
    {
      "version": "2.0.0",
      "change": "Zod 3 is no longer supported (v1's peer range was `^3.25 || ^4.0`). Schemas take any Standard Schema that can produce JSON Schema; raw `{ field: z.string() }` shapes are deprecated.",
      "migrate": "Upgrade to `zod ^4.2.0` and wrap shapes in `z.object()`, or pass plain JSON Schema through `fromJsonSchema()`.",
      "url": "https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2"
    }
  ],
  "gotchas": [
    {
      "title": "A v2 `Client` talks the 2025 protocol unless you opt in, even to a v2 server",
      "version": "2.3.1",
      "command": "// client 2.3.1 over stdio to a server built with @modelcontextprotocol/sdk 1.32.1 and one built with @modelcontextprotocol/server 2.3.1 (serveStdio)\nnew Client(info)                                                  // default\nnew Client(info, { versionNegotiation: { mode: 'auto' } })\nnew Client(info, { versionNegotiation: { mode: { pin: '2026-07-28' } } })\nconsole.log(client.getProtocolEra())",
      "output": "server sdk 1.32.1 | default | era=legacy | Hello, Ada\nserver sdk 1.32.1 | mode: 'auto' | era=legacy | Hello, Ada\nserver sdk 1.32.1 | pin: '2026-07-28' | SdkError ERA_NEGOTIATION_FAILED: Version negotiation failed: the server did not offer pinned protocol version 2026-07-28 via server/discover (no fallback in pin mode)\nserver 2.3.1 (serveStdio) | default | era=legacy | Hello, Ada\nserver 2.3.1 (serveStdio) | mode: 'auto' | era=modern | Hello, Ada\nserver 2.3.1 (serveStdio) | pin: '2026-07-28' | era=modern | Hello, Ada",
      "fix": "Pass `versionNegotiation: { mode: 'auto' }` to reach 2026-07-28 servers and fall back to `initialize` for older ones. Use a pin only where a 2025 connection is unacceptable: it never falls back. The docs advise against `'auto'` as the default of a spawn-per-invocation stdio CLI (each probe spawns an extra server process).",
      "url": "https://ts.sdk.modelcontextprotocol.io/v2/protocol-versions"
    },
    {
      "title": "`client.listen()` fails on a 2025-era connection",
      "version": "2.3.1",
      "command": "const c = new Client({ name: 'probe', version: '1.0.0' });   // default negotiation\nawait c.connect(new StdioClientTransport({ command: 'node', args: ['srv-v2.mjs'] }));\nawait c.listen({ resourceSubscriptions: ['file:///logs/app.log'] });",
      "output": "SdkError METHOD_NOT_SUPPORTED_BY_PROTOCOL_VERSION: subscriptions/listen requires a 2026-07-28-era connection (negotiated: 2025-11-25). On a 2025-era connection, change notifications are delivered unsolicited: use ClientOptions.listChanged and resources/subscribe instead.",
      "fix": "Connect with `versionNegotiation: { mode: 'auto' }` to a server that serves 2026-07-28, or use `ClientOptions.listChanged` and `resources/subscribe` on a 2025-era connection. The error is raised locally; nothing is sent.",
      "url": "https://ts.sdk.modelcontextprotocol.io/v2/troubleshooting"
    },
    {
      "title": "Zod 3 schemas register fine, then `tools/list` fails",
      "version": "2.3.1",
      "command": "npm i @modelcontextprotocol/server@2.3.1 @modelcontextprotocol/client@2.3.1 zod@^3.25.0   # installs zod 3.25.76\n# import { z } from 'zod'; server.registerTool('greet', { inputSchema: z.object({ name: z.string() }) }, ...)\n# then client.listTools(); second run with a raw shape { name: z.string() }",
      "output": "registerTool (z.object): ok\nconnect: ok\nlistTools | ProtocolError -32603: Schema appears to be from zod 3, which the SDK cannot convert to JSON Schema. Upgrade to zod >=4.2.0, or wrap your JSON Schema with fromJsonSchema().\n\nregisterTool (raw shape) | TypeError: Raw-shape inputSchema/outputSchema/argsSchema fields must be Zod v4 schemas. Got a Zod v3 field schema. Import from `zod/v4` (or upgrade your zod import), or wrap with `z.object({...})` yourself.",
      "fix": "Upgrade to `zod ^4.2.0` (check the declared range in `package.json`, not just the installed version) or wrap plain JSON Schema with `fromJsonSchema()`. The upgrade guide says such code type-checks cleanly; in our run `tsc` 6.0.3 with `strict` rejected the `z.object()` call with `error TS2769: No overload matches this call` (`Property 'jsonSchema' is missing`), so a type check may catch it first.",
      "url": "https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2"
    },
    {
      "title": "`StdioServerTransport` and `SSEServerTransport` are not exported from `@modelcontextprotocol/server`",
      "version": "2.3.1",
      "command": "import { SSEServerTransport } from '@modelcontextprotocol/server';\nimport { StdioServerTransport } from '@modelcontextprotocol/server';\n# npx tsc --noEmit --module nodenext --moduleResolution nodenext --strict imports.mts; node imports-rt.mjs",
      "output": "imports.mts(2,10): error TS2305: Module '\"@modelcontextprotocol/server\"' has no exported member 'SSEServerTransport'.\nimports.mts(3,10): error TS2305: Module '\"@modelcontextprotocol/server\"' has no exported member 'StdioServerTransport'.\n\nSyntaxError: The requested module '@modelcontextprotocol/server' does not provide an export named 'StdioServerTransport'",
      "fix": "`import { StdioServerTransport, serveStdio } from '@modelcontextprotocol/server/stdio'` (client side: `@modelcontextprotocol/client/stdio`). For SSE, serve Streamable HTTP instead; the frozen v1 copy is `import { SSEServerTransport } from '@modelcontextprotocol/server-legacy/sse'`.",
      "url": "https://ts.sdk.modelcontextprotocol.io/v2/troubleshooting"
    },
    {
      "title": "`import ... from '@modelcontextprotocol/sdk'` (v1.x package root) fails",
      "version": "1.32.1",
      "command": "import * as sdk from '@modelcontextprotocol/sdk';   # tsc --module nodenext, then node",
      "output": "v1-root.mts(2,22): error TS2307: Cannot find module '@modelcontextprotocol/sdk' or its corresponding type declarations.\n\nError [ERR_MODULE_NOT_FOUND]: Cannot find module '/root/v1/node_modules/@modelcontextprotocol/sdk/dist/esm/index.js' imported from /root/v1/v1-root.mjs",
      "fix": "v1.x has no root module: `exports[\".\"]` points at `dist/esm/index.js`, which none of the seven published tarballs we checked (1.0.0 to 1.32.1) contains. Import deep paths with `.js`: `@modelcontextprotocol/sdk/server/mcp.js`, `@modelcontextprotocol/sdk/server/stdio.js`, `@modelcontextprotocol/sdk/client/index.js`, `@modelcontextprotocol/sdk/types.js`.",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/blob/1.32.1/README.md"
    },
    {
      "title": "Reusing one `McpServer` for a second connection now rejects",
      "version": "2.3.1",
      "command": "const server = new McpServer({ name: 's', version: '1.0.0' });\nawait server.connect(a);\nawait server.connect(b);   // a, b: InMemoryTransport halves",
      "output": "server 2.2.0: second connect() resolved (no error)\nserver 2.3.1: second connect() | SdkError: Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.",
      "fix": "Build a fresh `McpServer` per connection or per HTTP request (the `createMcpHandler` / `serveStdio` factory does this); call `close()` before reusing an instance.",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2918"
    },
    {
      "title": "HTTP client stops at a redirect to another origin",
      "version": "2.3.1",
      "command": "# :3200 answers every request with 307 to http://127.0.0.1:3100/mcp (createMcpHandler, server 2.3.1)\nawait client.connect(new StreamableHTTPClientTransport(new URL('http://127.0.0.1:3200/mcp')));",
      "output": "@modelcontextprotocol/client 2.2.0: connected through the redirect, tool says: Hello, Ada\n@modelcontextprotocol/client 2.3.1: SdkHttpError CLIENT_HTTP_NOT_IMPLEMENTED: Error POSTing to endpoint: Redirect to http://127.0.0.1:3100/mcp not followed; use that URL as the endpoint if it is the intended server (redirectPolicy: 'same-origin')\n@modelcontextprotocol/sdk 1.31.0: connected through the redirect, tool says: Hello, Ada\n@modelcontextprotocol/sdk 1.32.1: StreamableHTTPError 307: Streamable HTTP error: Error POSTing to endpoint: Redirect to http://127.0.0.1:3100/mcp not followed (redirectPolicy: 'same-origin')",
      "fix": "Use the final URL as the endpoint, or opt back in with `new StreamableHTTPClientTransport(url, { redirectPolicy: 'follow' })`. A different port is a different origin, so local proxies and dev servers on another port trip this too.",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2901"
    }
  ],
  "monthly": [
    {
      "month": "2026-10",
      "versions": "v2 2.3.0 to 2.3.1; v1.x 1.32.0 to 1.32.1 (4 versions to 2026-10-07)",
      "highlights": [
        {
          "text": "2.3.0 and 1.32.0 (2026-10-02): same-origin redirects only, `maxToolInputElements`, `expectedResource`; 2.3.0 also one server instance per connection.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0"
        },
        {
          "text": "2.3.1 and 1.32.1 (2026-10-05): `expectedResource` in `server-legacy`; v1.x README states its 2025-11-25 limit.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1"
        }
      ]
    },
    {
      "month": "2026-09",
      "versions": "v2 2.1.0 to 2.2.0; v1.x 1.30.1 to 1.31.0 (4 versions)",
      "highlights": [
        {
          "text": "2.1.0 (2026-09-23): request-time OAuth scope challenges (`scopeChallenge`, `requireScopes`) on the server; DPoP sender-constrained tokens on the client.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/server%402.1.0"
        },
        {
          "text": "1.30.1 (2026-09-23): HTTP request bodies read with a size limit and JSON-RPC batch length bounded.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2717"
        },
        {
          "text": "2.2.0 and 1.31.0 (2026-09-28): OAuth credentials bound to the issuing authorization server (`expectedIssuer`); v2 list calls follow `nextCursor`.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"
        }
      ]
    },
    {
      "month": "2026-08",
      "versions": "no releases",
      "highlights": [
        {
          "text": "No package was published in August 2026; the next releases were 2.1.0 and 1.30.1 on 2026-09-23.",
          "url": "https://www.npmjs.com/package/@modelcontextprotocol/server?activeTab=versions"
        }
      ]
    },
    {
      "month": "2026-07",
      "versions": "v2 2.0.0-beta.2 to 2.0.0 (stable 2026-07-27); v1.x 1.30.0",
      "highlights": [
        {
          "text": "2.0.0 (2026-07-27): split packages `@modelcontextprotocol/server` / `client` / `core`, Standard Schema, `serveStdio()` and `createMcpHandler()`, the 2026-07-28 revision, and the `v1-to-v2` codemod.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/server%402.0.0"
        },
        {
          "text": "1.30.0 (2026-07-27): stdio buffer limit, SSE keep-alive frames on the Streamable HTTP server transport, Content-Type parsed by media type, Zod 3.25 method literals.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.30.0"
        }
      ]
    },
    {
      "month": "2026-06",
      "versions": "v2 prereleases only: 2.0.0-alpha.3, 2.0.0-alpha.4, 2.0.0-beta.1",
      "highlights": [
        {
          "text": "2.0.0-beta.1 (2026-06-30): first v2 beta, built for the 2026-07-28 spec; passes the MCP conformance suite except tasks.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.0.0-beta.1"
        }
      ]
    },
    {
      "month": "2026-05",
      "versions": "no releases",
      "highlights": [
        {
          "text": "No release in May 2026. The last v1 release before it was 1.29.0 (2026-03-30); v2 2.0.0-alpha.2 came out on 2026-04-01.",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v1.29.0"
        }
      ]
    }
  ],
  "sources": [
    {
      "title": "modelcontextprotocol/typescript-sdk releases (GitHub API, three pages)",
      "url": "https://api.github.com/repos/modelcontextprotocol/typescript-sdk/releases",
      "read": "2026-10-07"
    },
    {
      "title": "v2.3.1 release notes",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1",
      "read": "2026-10-07"
    },
    {
      "title": "1.32.1 release notes",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.1",
      "read": "2026-10-07"
    },
    {
      "title": "v2.3.0 release notes (upgrade notes)",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0",
      "read": "2026-10-07"
    },
    {
      "title": "1.32.0 release notes",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0",
      "read": "2026-10-07"
    },
    {
      "title": "v2.2.0 release notes",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0",
      "read": "2026-10-07"
    },
    {
      "title": "1.31.0 release notes",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.31.0",
      "read": "2026-10-07"
    },
    {
      "title": "@modelcontextprotocol/server 2.1.0 and 2.0.0 per-package release notes",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/server%402.1.0",
      "read": "2026-10-07"
    },
    {
      "title": "v2.0.0-beta.1 release notes (v2 overview, 2026-07-28 support)",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.0.0-beta.1",
      "read": "2026-10-07"
    },
    {
      "title": "README at v2.3.1 (packages, v1.x support window)",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/blob/v2.3.1/README.md",
      "read": "2026-10-07"
    },
    {
      "title": "README at 1.32.1 (v1.x implements the spec up to 2025-11-25)",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/blob/1.32.1/README.md",
      "read": "2026-10-07"
    },
    {
      "title": "Protocol versions (docs/protocol-versions.md at v2.3.1)",
      "url": "https://ts.sdk.modelcontextprotocol.io/v2/protocol-versions",
      "read": "2026-10-07"
    },
    {
      "title": "Upgrading from v1.x to v2 (docs/migration/upgrade-to-v2.md at v2.3.1)",
      "url": "https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2",
      "read": "2026-10-07"
    },
    {
      "title": "Troubleshooting (docs/troubleshooting.md at v2.3.1)",
      "url": "https://ts.sdk.modelcontextprotocol.io/v2/troubleshooting",
      "read": "2026-10-07"
    },
    {
      "title": "npm registry: @modelcontextprotocol/server, client, core, server-legacy, sdk (versions, publish times, exports, engines)",
      "url": "https://registry.npmjs.org/@modelcontextprotocol%2Fserver",
      "read": "2026-10-07"
    },
    {
      "title": "npm registry: @modelcontextprotocol/sdk",
      "url": "https://registry.npmjs.org/@modelcontextprotocol%2Fsdk",
      "read": "2026-10-07"
    },
    {
      "title": "npm downloads API, last week (2026-09-28 to 2026-10-04)",
      "url": "https://api.npmjs.org/downloads/point/last-week/@modelcontextprotocol%2Fsdk",
      "read": "2026-10-07"
    },
    {
      "title": "PR #2918: one server instance per connection",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2918",
      "read": "2026-10-07"
    },
    {
      "title": "PR #2901: follow redirects only within the same origin (v2)",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2901",
      "read": "2026-10-07"
    },
    {
      "title": "modelcontextprotocol/typescript-sdk repository (stars, licence)",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk",
      "read": "2026-10-07"
    }
  ],
  "fixes": []
}