modelcontextprotocol/typescript-sdk @modelcontextprotocol/express@2.0.0

on GitHub

Patch Changes

• #2402 a400259 Thanks @felixweinberger! - First beta release of SDK v2 with support for the MCP 2026-07-28 specification
  revision. See the migration guides for upgrading from v1
  (docs/migration/upgrade-to-v2.md) and adopting the 2026-07-28 revision
  (docs/migration/support-2026-07-28.md).

• #2405 f172626 Thanks @mattzcarey! - Ship CommonJS builds alongside ESM. Each package now emits both .mjs/.d.mts
  and .cjs/.d.cts (via tsdown format: ['esm', 'cjs']), and its exports map
  adds a require condition so require('@modelcontextprotocol/…') works from
  CommonJS consumers. Output extensions are normalized across all packages
  (@modelcontextprotocol/core moves from .js/.d.ts to .mjs/.d.mts); the
  public import paths are unchanged.

• #2420 7635115 Thanks @felixweinberger! - Add runtime-neutral Bearer authentication to @modelcontextprotocol/server:
  requireBearerAuth gates web-standard fetch(request) hosts (Cloudflare
  Workers, Deno, Bun, Hono), built on the exported verifyBearerToken and
  bearerAuthChallengeResponse pieces, with OAuthTokenVerifier now defined
  here. The Express middleware adapts the same core and is unchanged in
  behavior, except that WWW-Authenticate challenge values are now RFC 7235
  quoted-string sanitized (quotes and backslashes escaped, control and
  non-ASCII characters replaced); @modelcontextprotocol/express re-exports
  OAuthTokenVerifier as before.

• #2422 61866d7 Thanks @felixweinberger! - Add runtime-neutral OAuth discovery serving to @modelcontextprotocol/server:
  oauthMetadataResponse serves the RFC 9728 Protected Resource Metadata and
  RFC 8414 Authorization Server metadata documents from web-standard
  fetch(request) hosts, built on the exported
  buildOAuthProtectedResourceMetadata, with
  getOAuthProtectedResourceMetadataUrl now defined here. The Express metadata
  router adapts the same core and is unchanged in behavior; the insecure-issuer
  escape hatch is an explicit dangerouslyAllowInsecureIssuerUrl option in the
  neutral core instead of a module-scope environment read. The web-standard
  matcher validates lazily so unmatched traffic always falls through, tolerates
  a trailing slash, supports HEAD, and marks reflected CORS preflights with
  Vary.

• Updated dependencies [a400259, 44797d7, 1b90c96, f172626, 561c6d8, ce2f65d, 1480241, 7c49b47, e0a0ab7, 7e69735, 3c7ddaf, 8e1d2e9, e8de519, f413763, 0ab5d14, 24be404, 470678d, f130e1a, 7635115, 61866d7, 3f07a32]:

  • @modelcontextprotocol/server@2.0.0