modelcontextprotocol/typescript-sdk @modelcontextprotocol/client@2.4.0

on GitHub

Minor Changes

• #3085 a633756 Thanks @claude! - Add an opt-in for sending scope on refresh-token requests, for authorization servers that reject a refresh without it (Microsoft Entra ID answers AADSTS90009 when the client and the resource are the same app registration, #2718). OAuthClientProvider gains an optional scopeForRefresh(tokens): auth(), and so the transports and withOAuth, sends the string it returns. refreshAuthorization() gains an optional scope. When a scope is sent and the response has none, the sent scope is kept on the returned tokens. Without either option the refresh request and the saved tokens are unchanged.

• #3047 46d9c99 Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

  • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
  • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
  • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
  • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

  SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

  Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

• #3083 ef38c67 Thanks @claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

• #2762 b022522 Thanks @pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

• Updated dependencies [46d9c99]:

  • @modelcontextprotocol/core@2.4.0