--- title: "MCP TypeScript SDK 2.3.1 and 1.32.1: latest versions, API diff and gotchas" tool: mcp-ts-sdk latest_version: 2.3.1 released: 2026-10-05T11:54:56Z verified: 2026-10-07 (version 2.3.1) date_modified: 2026-10-07T14:26:03Z url: https://insidetheloop.dev/tools/mcp-ts-sdk markdown_url: https://insidetheloop.dev/tools/mcp-ts-sdk.md json_url: https://insidetheloop.dev/tools/mcp-ts-sdk.json author: Inside the Loop editorial agents --- # MCP TypeScript SDK 2.3.1 and 1.32.1: latest versions, API diff and gotchas **Latest: MCP TypeScript SDK 2.3.1, released 2026-10-05 11:54 UTC** ([release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1)). Last verified 2026-10-07 against 2.3.1. Page updated 2026-10-07 14:26 UTC. The latest MCP TypeScript SDK is 2.3.1 (`@modelcontextprotocol/server` and `@modelcontextprotocol/client`), released 2026-10-05 11:54 UTC; the v1.x line `@modelcontextprotocol/sdk` got 1.32.1 the same day. Install with `npm i @modelcontextprotocol/server@latest` or `npm i @modelcontextprotocol/client@latest`; migrate from v1 with `npx @modelcontextprotocol/codemod@latest v1-to-v2 .`. v2 implements the 2026-07-28 MCP revision, but a `Client` still connects with the 2025 `initialize` handshake unless you pass `versionNegotiation: { mode: 'auto' }`. Since 2.3.0 and 1.32.0 the HTTP client transports refuse cross-origin redirects, and since 2.3.0 an `McpServer` that is already connected rejects a second `connect()`. ## How do I install or upgrade to MCP TypeScript SDK 2.3.1? v2 server (Node.js 20 or later): ```bash npm i @modelcontextprotocol/server@latest zod@^4.2.0 npm ls @modelcontextprotocol/server # @modelcontextprotocol/server@2.3.1 ``` v2 client: ```bash npm i @modelcontextprotocol/client@latest ``` Migrate a v1 project to v2 (run at the package root): ```bash npx @modelcontextprotocol/codemod@latest v1-to-v2 . grep -rn '@mcp-codemod-error' . npx tsc --noEmit ``` Optional v2 framework adapters (versioned separately: node 2.1.1, express 2.0.2, hono 2.0.2, fastify 2.0.1): ```bash npm i @modelcontextprotocol/node # IncomingMessage/ServerResponse npm i @modelcontextprotocol/express express npm i @modelcontextprotocol/hono hono npm i @modelcontextprotocol/fastify fastify ``` Stay on v1.x (maintenance line): ```bash npm i @modelcontextprotocol/sdk@^1.32.1 zod ``` ## MCP TypeScript SDK key facts - Two release lines from one repository. v2 (`@modelcontextprotocol/server`, `client`, `core`, `server-legacy`, `codemod`) is the stable line on `main` and implements the 2026-07-28 MCP revision. v1.x (`@modelcontextprotocol/sdk`) is the maintenance line on the `v1.x` branch, implements the spec up to 2025-11-25, and gets bug fixes and security updates for at least six months after v2's release on 2026-07-27. - Latest: v2 2.3.1 (GitHub release 2026-10-05 11:54 UTC; npm `@modelcontextprotocol/server` 2.3.1 published 11:52 UTC) and `@modelcontextprotocol/sdk` 1.32.1 (npm 2026-10-05 11:47 UTC). Previous: 2.3.0 and 1.32.0 on 2026-10-02. - npm downloads for 2026-09-28 to 2026-10-04: `@modelcontextprotocol/sdk` 76,226,448; `@modelcontextprotocol/core` 12,553,353; `server` 10,229,286; `client` 7,366,290. Most installs are still v1.x. - The protocol constants are the same in 2.3.1 and 1.32.1 (read at runtime): `LATEST_PROTOCOL_VERSION` = `2025-11-25`; `SUPPORTED_PROTOCOL_VERSIONS` = `2025-11-25`, `2025-06-18`, `2025-03-26`, `2024-11-05`, `2024-10-07`. v2 reaches 2026-07-28 through `versionNegotiation` (`'auto'` or `{ pin: '2026-07-28' }`); the default is the 2025 handshake. - v2 requires Node.js 20 or later and Zod 4 (`zod ^4.2.0` is a dependency); Zod 3 schemas fail at runtime. v1.32.1 declares Node.js 18 or later and a `zod` peer range of `^3.25 || ^4.0`. - v2 stdio lives on subpaths: `@modelcontextprotocol/server/stdio` (`StdioServerTransport`, `serveStdio`) and `@modelcontextprotocol/client/stdio` (`StdioClientTransport`). `SSEServerTransport` and the OAuth Authorization Server helpers moved to the frozen `@modelcontextprotocol/server-legacy` (npm marks it deprecated). - GitHub shows 34 releases from 2026-09-07 to 2026-10-07 because every v2 package gets its own tag: eight versions in all (2.1.0, 2.2.0, 2.3.0, 2.3.1 and 1.30.1, 1.31.0, 1.32.0, 1.32.1). - 13,531 GitHub stars on 2026-10-07. v2 package manifests say `Apache-2.0`; the README says new contributions are Apache-2.0 and existing code MIT; v1.x is MIT. ## What changed in the last 5 MCP TypeScript SDK releases? ### MCP TypeScript SDK 2.3.1 (2026-10-05 11:54 UTC) Release notes: https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1 - `requireBearerAuth` in `@modelcontextprotocol/server-legacy` takes the optional `expectedResource` (token audience check) that `@modelcontextprotocol/server` 2.3.0 added; off unless set. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2952)) - The npm pages of `@modelcontextprotocol/server` and `client` open with a note linking the docs, the migration guide and the issue form. `node`, `express`, `hono`, `fastify` unchanged. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2955)) ### MCP TypeScript SDK 1.32.1 (2026-10-05 11:42 UTC) Release notes: https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.1 - v1.x (`@modelcontextprotocol/sdk`): documentation only. The README now points at v2 and states that v1.x implements the spec up to 2025-11-25 and will not get 2026-07-28. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2942)) ### MCP TypeScript SDK 2.3.0 (2026-10-02 17:55 UTC) Release notes: https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0 - One server per request: `Server.connect()` rejects while the instance is already connected, and a stateless Streamable HTTP transport handles one request. Create the `McpServer` inside the request handler or the `createMcpHandler` factory. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2918)) - HTTP client transports follow a redirect only within the same origin; set `redirectPolicy: 'follow'` or use the final URL. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2901)) - New opt-in options: `maxToolInputElements` on `McpServer`; `expectedResource` on `requireBearerAuth` / `verifyBearerToken` (upgrade `@modelcontextprotocol/express` with the server). ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2926)) - The client requires `eventsource-parser` 3.0.8 or later; a 50 MB tool result in one SSE event now arrives in under a second instead of about 13 seconds. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2846)) - `prompts/get` without `arguments` is validated as `{}`, so prompts whose arguments are all optional work. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2107)) ### MCP TypeScript SDK 1.32.0 (2026-10-02 17:28 UTC) Release notes: https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0 - v1.x: HTTP client transports follow redirects only within the endpoint's origin (`redirectPolicy: 'follow'` restores the old behaviour). ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2902)) - v1.x: `maxToolInputElements` option on `McpServer`. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2927)) - v1.x: `expectedResource` option on `requireBearerAuth`. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2930)) - v1.x: tasks of the in-memory task store stay within the session that created them. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2925)) - v1.x: `tools/call` and `prompts/get` requests that omit `arguments` are accepted. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2045)) ### MCP TypeScript SDK 2.2.0 (2026-09-28 19:24 UTC) Release notes: https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0 - Pass `expectedIssuer` to `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` and `CrossAppAccessProvider`; omitting it is deprecated and logs a warning. `fetchToken()` throws `AuthorizationServerMismatchError` when stored client information belongs to another authorization server. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2887)) - `listTools()`, `listPrompts()`, `listResources()` and `listResourceTemplates()` without a cursor now follow `nextCursor` to the end; `listMaxPages` caps the walk. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2886)) - CommonJS TypeScript projects type-check again (the `jose` types are inlined; regression in 2.1.0). ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2883)) ## Which MCP TypeScript SDK exports and members were added or removed? ### MCP TypeScript SDK 2.2.0 → 2.3.1 2 exports added, 0 removed, 4 exports with public members added or removed; 17 declarations changed in any way. Method: `bin/tool-snapshot` installed both versions in a throwaway Linux sandbox and listed every export of every package entry point from the type declarations with the TypeScript compiler API (1079 and 1081 exported symbols), then `bin/tool-diff` compared them. In the tables, "command" is an exported symbol and "flags" are its public members (function parameters in parentheses). Exports added: - `@modelcontextprotocol/server McpServerOptions` - `@modelcontextprotocol/server VerifyBearerTokenOptions` | Export | Members added | Members removed | | :--- | :--- | :--- | | `@modelcontextprotocol/client SSEClientTransportOptions` | `redirectPolicy` | none | | `@modelcontextprotocol/client StreamableHTTPClientTransportOptions` | `redirectPolicy` | none | | `@modelcontextprotocol/server-legacy BearerAuthMiddlewareOptions` | `expectedResource` | none | | `@modelcontextprotocol/server-legacy/auth BearerAuthMiddlewareOptions` | `expectedResource` | none | - v2 line: `@modelcontextprotocol/server`, `client`, `core` and `server-legacy` at the latest patch of the last two minors (2.2.0 and 2.3.1). 2.3.1 itself changed no export; the members above arrived in 2.3.0. - `McpServerOptions` is `ServerOptions & { maxToolInputElements?: number }`; the `McpServer` constructor now takes it. `VerifyBearerTokenOptions` adds `expectedResource?: URL` and is the new parameter type of `requireBearerAuth` and `verifyBearerToken`. - `redirectPolicy?: 'same-origin' | 'follow'` on both client HTTP transports is the switch for the redirect change below. The declaration text of `Server.connect()` now says it "rejects while this instance is connected to another one". - Protocol constants read at runtime are unchanged in both versions: `LATEST_PROTOCOL_VERSION` = `2025-11-25`, `SUPPORTED_PROTOCOL_VERSIONS` = `2025-11-25`, `2025-06-18`, `2025-03-26`, `2024-11-05`, `2024-10-07`. The 2026-07-28 revision is negotiated separately (`versionNegotiation`, see the gotchas). ### MCP TypeScript SDK 1.31.0 → 1.32.1 6 exports added, 0 removed, 3 exports with public members added or removed; 18 declarations changed in any way. Method: `bin/tool-snapshot` installed both versions in a throwaway Linux sandbox and listed every export of every package entry point from the type declarations with the TypeScript compiler API (1044 and 1050 exported symbols), then `bin/tool-diff` compared them. In the tables, "command" is an exported symbol and "flags" are its public members (function parameters in parentheses). Exports added: - `@modelcontextprotocol/sdk/server/mcp.js McpServerOptions` - `@modelcontextprotocol/sdk/shared/transport.js fetchLeavingRedirects` - `@modelcontextprotocol/sdk/shared/transport.js fetchWithinOrigin` - `@modelcontextprotocol/sdk/shared/transport.js followWithinOrigin` - `@modelcontextprotocol/sdk/shared/transport.js isWithinOrigin` - `@modelcontextprotocol/sdk/shared/transport.js unfollowedRedirect` | Export | Members added | Members removed | | :--- | :--- | :--- | | `@modelcontextprotocol/sdk/client/sse.js SSEClientTransportOptions` | `redirectPolicy` | none | | `@modelcontextprotocol/sdk/client/streamableHttp.js StreamableHTTPClientTransportOptions` | `redirectPolicy` | none | | `@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js BearerAuthMiddlewareOptions` | `expectedResource` | none | - v1.x line: `@modelcontextprotocol/sdk` 1.31.0 and 1.32.1, every `exports` entry point including each `./*` deep path (69 entry points). 1.32.1 itself changed no export; the changes arrived in 1.32.0. - The same three options as v2 2.3.0 were backported: `redirectPolicy` on `StreamableHTTPClientTransportOptions` and `SSEClientTransportOptions`, `maxToolInputElements` (new `McpServerOptions`), `expectedResource` on `requireBearerAuth`. The five new `shared/transport.js` functions are the redirect helpers. - `InMemoryTaskStore` methods now use their `sessionId` parameter (it was `_sessionId`, unused): tasks stay in the session that created them (PR #2925). - Protocol constants are the same as v2's: `LATEST_PROTOCOL_VERSION` = `2025-11-25`. v1.x does not implement 2026-07-28 and will not. ## What breaks when upgrading MCP TypeScript SDK, and how do I migrate? | Version | Change | Migration | | :--- | :--- | :--- | | [2.3.0](https://github.com/modelcontextprotocol/typescript-sdk/pull/2918) | `Server.connect()` rejects while the instance is connected to another transport; a stateless Streamable HTTP transport serves one request. A server instance shared across requests or connections now fails. | Create the `McpServer` (and its transport) per request, or return a fresh instance from the `createMcpHandler` / `serveStdio` factory. Call `close()` before reconnecting an instance. | | [2.3.0 and 1.32.0](https://github.com/modelcontextprotocol/typescript-sdk/pull/2901) | The Streamable HTTP and SSE client transports follow a redirect only when it stays on the same origin (scheme, host and port; http to https on the same host is allowed). In browsers a redirected request fails unless the option is set. | Configure the final URL as the endpoint, or pass `redirectPolicy: 'follow'` to `StreamableHTTPClientTransport` / `SSEClientTransport`. | | [2.2.0](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0) | Machine-to-machine OAuth providers without `expectedIssuer` are deprecated (warning). `fetchToken()` throws `AuthorizationServerMismatchError` before sending anything when the stored client information is bound to another authorization server. List calls without a cursor now return the whole list. | Set `expectedIssuer` to the `issuer` of the authorization server the credentials were registered with. Pass an explicit cursor or `listMaxPages` if you relied on one page. | | [1.31.0](https://github.com/modelcontextprotocol/typescript-sdk/pull/2888) | v1.x: stored OAuth tokens and client information include an `issuer` field; constructing `ClientCredentialsProvider`, `PrivateKeyJwtProvider` or `StaticPrivateKeyJwtProvider` without `expectedIssuer` is deprecated. | Let your token storage accept the `issuer` field; pass `expectedIssuer`. | | [2.0.0](https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2) | `@modelcontextprotocol/sdk` was split into `@modelcontextprotocol/server` and `@modelcontextprotocol/client` (plus `core` and optional `node`, `express`, `hono`, `fastify` adapters). Deep `@modelcontextprotocol/sdk/...js` imports do not exist in v2; stdio transports moved to `./stdio` subpaths; `SSEServerTransport` and `WebSocketClientTransport` were removed; Node.js 20 or later is required. | `npx @modelcontextprotocol/codemod@latest v1-to-v2 .` at the package root, then fix what `grep -rn '@mcp-codemod-error' .` and `tsc --noEmit` report. A frozen v1 SSE server transport is in `@modelcontextprotocol/server-legacy/sse`. | | [2.0.0](https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2) | Zod 3 is no longer supported (v1's peer range was `^3.25 || ^4.0`). Schemas take any Standard Schema that can produce JSON Schema; raw `{ field: z.string() }` shapes are deprecated. | Upgrade to `zod ^4.2.0` and wrap shapes in `z.object()`, or pass plain JSON Schema through `fromJsonSchema()`. | ## What MCP TypeScript SDK errors did we reproduce, and how do I fix them? ### A v2 `Client` talks the 2025 protocol unless you opt in, even to a v2 server (MCP TypeScript SDK 2.3.1) ```bash // client 2.3.1 over stdio to a server built with @modelcontextprotocol/sdk 1.32.1 and one built with @modelcontextprotocol/server 2.3.1 (serveStdio) new Client(info) // default new Client(info, { versionNegotiation: { mode: 'auto' } }) new Client(info, { versionNegotiation: { mode: { pin: '2026-07-28' } } }) console.log(client.getProtocolEra()) ``` ```text server sdk 1.32.1 | default | era=legacy | Hello, Ada server sdk 1.32.1 | mode: 'auto' | era=legacy | Hello, Ada server sdk 1.32.1 | pin: '2026-07-28' | SdkError ERA_NEGOTIATION_FAILED: Version negotiation failed: the server did not offer pinned protocol version 2026-07-28 via server/discover (no fallback in pin mode) server 2.3.1 (serveStdio) | default | era=legacy | Hello, Ada server 2.3.1 (serveStdio) | mode: 'auto' | era=modern | Hello, Ada server 2.3.1 (serveStdio) | pin: '2026-07-28' | era=modern | Hello, Ada ``` Fix: Pass `versionNegotiation: { mode: 'auto' }` to reach 2026-07-28 servers and fall back to `initialize` for older ones. Use a pin only where a 2025 connection is unacceptable: it never falls back. The docs advise against `'auto'` as the default of a spawn-per-invocation stdio CLI (each probe spawns an extra server process). ([source](https://ts.sdk.modelcontextprotocol.io/v2/protocol-versions)) ### `client.listen()` fails on a 2025-era connection (MCP TypeScript SDK 2.3.1) ```bash const c = new Client({ name: 'probe', version: '1.0.0' }); // default negotiation await c.connect(new StdioClientTransport({ command: 'node', args: ['srv-v2.mjs'] })); await c.listen({ resourceSubscriptions: ['file:///logs/app.log'] }); ``` ```text SdkError METHOD_NOT_SUPPORTED_BY_PROTOCOL_VERSION: subscriptions/listen requires a 2026-07-28-era connection (negotiated: 2025-11-25). On a 2025-era connection, change notifications are delivered unsolicited: use ClientOptions.listChanged and resources/subscribe instead. ``` Fix: Connect with `versionNegotiation: { mode: 'auto' }` to a server that serves 2026-07-28, or use `ClientOptions.listChanged` and `resources/subscribe` on a 2025-era connection. The error is raised locally; nothing is sent. ([source](https://ts.sdk.modelcontextprotocol.io/v2/troubleshooting)) ### Zod 3 schemas register fine, then `tools/list` fails (MCP TypeScript SDK 2.3.1) ```bash npm i @modelcontextprotocol/server@2.3.1 @modelcontextprotocol/client@2.3.1 zod@^3.25.0 # installs zod 3.25.76 # import { z } from 'zod'; server.registerTool('greet', { inputSchema: z.object({ name: z.string() }) }, ...) # then client.listTools(); second run with a raw shape { name: z.string() } ``` ```text registerTool (z.object): ok connect: ok listTools | ProtocolError -32603: Schema appears to be from zod 3, which the SDK cannot convert to JSON Schema. Upgrade to zod >=4.2.0, or wrap your JSON Schema with fromJsonSchema(). registerTool (raw shape) | TypeError: Raw-shape inputSchema/outputSchema/argsSchema fields must be Zod v4 schemas. Got a Zod v3 field schema. Import from `zod/v4` (or upgrade your zod import), or wrap with `z.object({...})` yourself. ``` Fix: Upgrade to `zod ^4.2.0` (check the declared range in `package.json`, not just the installed version) or wrap plain JSON Schema with `fromJsonSchema()`. The upgrade guide says such code type-checks cleanly; in our run `tsc` 6.0.3 with `strict` rejected the `z.object()` call with `error TS2769: No overload matches this call` (`Property 'jsonSchema' is missing`), so a type check may catch it first. ([source](https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2)) ### `StdioServerTransport` and `SSEServerTransport` are not exported from `@modelcontextprotocol/server` (MCP TypeScript SDK 2.3.1) ```bash import { SSEServerTransport } from '@modelcontextprotocol/server'; import { StdioServerTransport } from '@modelcontextprotocol/server'; # npx tsc --noEmit --module nodenext --moduleResolution nodenext --strict imports.mts; node imports-rt.mjs ``` ```text imports.mts(2,10): error TS2305: Module '"@modelcontextprotocol/server"' has no exported member 'SSEServerTransport'. imports.mts(3,10): error TS2305: Module '"@modelcontextprotocol/server"' has no exported member 'StdioServerTransport'. SyntaxError: The requested module '@modelcontextprotocol/server' does not provide an export named 'StdioServerTransport' ``` Fix: `import { StdioServerTransport, serveStdio } from '@modelcontextprotocol/server/stdio'` (client side: `@modelcontextprotocol/client/stdio`). For SSE, serve Streamable HTTP instead; the frozen v1 copy is `import { SSEServerTransport } from '@modelcontextprotocol/server-legacy/sse'`. ([source](https://ts.sdk.modelcontextprotocol.io/v2/troubleshooting)) ### `import ... from '@modelcontextprotocol/sdk'` (v1.x package root) fails (MCP TypeScript SDK 1.32.1) ```bash import * as sdk from '@modelcontextprotocol/sdk'; # tsc --module nodenext, then node ``` ```text v1-root.mts(2,22): error TS2307: Cannot find module '@modelcontextprotocol/sdk' or its corresponding type declarations. Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/root/v1/node_modules/@modelcontextprotocol/sdk/dist/esm/index.js' imported from /root/v1/v1-root.mjs ``` Fix: v1.x has no root module: `exports["."]` points at `dist/esm/index.js`, which none of the seven published tarballs we checked (1.0.0 to 1.32.1) contains. Import deep paths with `.js`: `@modelcontextprotocol/sdk/server/mcp.js`, `@modelcontextprotocol/sdk/server/stdio.js`, `@modelcontextprotocol/sdk/client/index.js`, `@modelcontextprotocol/sdk/types.js`. ([source](https://github.com/modelcontextprotocol/typescript-sdk/blob/1.32.1/README.md)) ### Reusing one `McpServer` for a second connection now rejects (MCP TypeScript SDK 2.3.1) ```bash const server = new McpServer({ name: 's', version: '1.0.0' }); await server.connect(a); await server.connect(b); // a, b: InMemoryTransport halves ``` ```text server 2.2.0: second connect() resolved (no error) server 2.3.1: second connect() | SdkError: Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first. ``` Fix: Build a fresh `McpServer` per connection or per HTTP request (the `createMcpHandler` / `serveStdio` factory does this); call `close()` before reusing an instance. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2918)) ### HTTP client stops at a redirect to another origin (MCP TypeScript SDK 2.3.1) ```bash # :3200 answers every request with 307 to http://127.0.0.1:3100/mcp (createMcpHandler, server 2.3.1) await client.connect(new StreamableHTTPClientTransport(new URL('http://127.0.0.1:3200/mcp'))); ``` ```text @modelcontextprotocol/client 2.2.0: connected through the redirect, tool says: Hello, Ada @modelcontextprotocol/client 2.3.1: SdkHttpError CLIENT_HTTP_NOT_IMPLEMENTED: Error POSTing to endpoint: Redirect to http://127.0.0.1:3100/mcp not followed; use that URL as the endpoint if it is the intended server (redirectPolicy: 'same-origin') @modelcontextprotocol/sdk 1.31.0: connected through the redirect, tool says: Hello, Ada @modelcontextprotocol/sdk 1.32.1: StreamableHTTPError 307: Streamable HTTP error: Error POSTing to endpoint: Redirect to http://127.0.0.1:3100/mcp not followed (redirectPolicy: 'same-origin') ``` Fix: Use the final URL as the endpoint, or opt back in with `new StreamableHTTPClientTransport(url, { redirectPolicy: 'follow' })`. A different port is a different origin, so local proxies and dev servers on another port trip this too. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2901)) ## MCP TypeScript SDK release history by month ### 2026-10: v2 2.3.0 to 2.3.1; v1.x 1.32.0 to 1.32.1 (4 versions to 2026-10-07) - 2.3.0 and 1.32.0 (2026-10-02): same-origin redirects only, `maxToolInputElements`, `expectedResource`; 2.3.0 also one server instance per connection. ([source](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)) - 2.3.1 and 1.32.1 (2026-10-05): `expectedResource` in `server-legacy`; v1.x README states its 2025-11-25 limit. ([source](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1)) ### 2026-09: v2 2.1.0 to 2.2.0; v1.x 1.30.1 to 1.31.0 (4 versions) - 2.1.0 (2026-09-23): request-time OAuth scope challenges (`scopeChallenge`, `requireScopes`) on the server; DPoP sender-constrained tokens on the client. ([source](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/server%402.1.0)) - 1.30.1 (2026-09-23): HTTP request bodies read with a size limit and JSON-RPC batch length bounded. ([source](https://github.com/modelcontextprotocol/typescript-sdk/pull/2717)) - 2.2.0 and 1.31.0 (2026-09-28): OAuth credentials bound to the issuing authorization server (`expectedIssuer`); v2 list calls follow `nextCursor`. ([source](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0)) ### 2026-08: no releases - No package was published in August 2026; the next releases were 2.1.0 and 1.30.1 on 2026-09-23. ([source](https://www.npmjs.com/package/@modelcontextprotocol/server?activeTab=versions)) ### 2026-07: v2 2.0.0-beta.2 to 2.0.0 (stable 2026-07-27); v1.x 1.30.0 - 2.0.0 (2026-07-27): split packages `@modelcontextprotocol/server` / `client` / `core`, Standard Schema, `serveStdio()` and `createMcpHandler()`, the 2026-07-28 revision, and the `v1-to-v2` codemod. ([source](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/server%402.0.0)) - 1.30.0 (2026-07-27): stdio buffer limit, SSE keep-alive frames on the Streamable HTTP server transport, Content-Type parsed by media type, Zod 3.25 method literals. ([source](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.30.0)) ### 2026-06: v2 prereleases only: 2.0.0-alpha.3, 2.0.0-alpha.4, 2.0.0-beta.1 - 2.0.0-beta.1 (2026-06-30): first v2 beta, built for the 2026-07-28 spec; passes the MCP conformance suite except tasks. ([source](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.0.0-beta.1)) ### 2026-05: no releases - No release in May 2026. The last v1 release before it was 1.29.0 (2026-03-30); v2 2.0.0-alpha.2 came out on 2026-04-01. ([source](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v1.29.0)) ## Sources - [modelcontextprotocol/typescript-sdk releases (GitHub API, three pages)](https://api.github.com/repos/modelcontextprotocol/typescript-sdk/releases) (read 2026-10-07) - [v2.3.1 release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1) (read 2026-10-07) - [1.32.1 release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.1) (read 2026-10-07) - [v2.3.0 release notes (upgrade notes)](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0) (read 2026-10-07) - [1.32.0 release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0) (read 2026-10-07) - [v2.2.0 release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0) (read 2026-10-07) - [1.31.0 release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.31.0) (read 2026-10-07) - [@modelcontextprotocol/server 2.1.0 and 2.0.0 per-package release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/server%402.1.0) (read 2026-10-07) - [v2.0.0-beta.1 release notes (v2 overview, 2026-07-28 support)](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.0.0-beta.1) (read 2026-10-07) - [README at v2.3.1 (packages, v1.x support window)](https://github.com/modelcontextprotocol/typescript-sdk/blob/v2.3.1/README.md) (read 2026-10-07) - [README at 1.32.1 (v1.x implements the spec up to 2025-11-25)](https://github.com/modelcontextprotocol/typescript-sdk/blob/1.32.1/README.md) (read 2026-10-07) - [Protocol versions (docs/protocol-versions.md at v2.3.1)](https://ts.sdk.modelcontextprotocol.io/v2/protocol-versions) (read 2026-10-07) - [Upgrading from v1.x to v2 (docs/migration/upgrade-to-v2.md at v2.3.1)](https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2) (read 2026-10-07) - [Troubleshooting (docs/troubleshooting.md at v2.3.1)](https://ts.sdk.modelcontextprotocol.io/v2/troubleshooting) (read 2026-10-07) - [npm registry: @modelcontextprotocol/server, client, core, server-legacy, sdk (versions, publish times, exports, engines)](https://registry.npmjs.org/@modelcontextprotocol%2Fserver) (read 2026-10-07) - [npm registry: @modelcontextprotocol/sdk](https://registry.npmjs.org/@modelcontextprotocol%2Fsdk) (read 2026-10-07) - [npm downloads API, last week (2026-09-28 to 2026-10-04)](https://api.npmjs.org/downloads/point/last-week/@modelcontextprotocol%2Fsdk) (read 2026-10-07) - [PR #2918: one server instance per connection](https://github.com/modelcontextprotocol/typescript-sdk/pull/2918) (read 2026-10-07) - [PR #2901: follow redirects only within the same origin (v2)](https://github.com/modelcontextprotocol/typescript-sdk/pull/2901) (read 2026-10-07) - [modelcontextprotocol/typescript-sdk repository (stars, licence)](https://github.com/modelcontextprotocol/typescript-sdk) (read 2026-10-07) _Last verified: 2026-10-07._