modelcontextprotocol/typescript-sdk @modelcontextprotocol/fastify@2.0.0-alpha.4

on GitHub

Minor Changes

• #2286 1823aae Thanks @felixweinberger! - Add Origin header validation alongside the existing Host header validation. The server package gains framework-agnostic helpers (validateOriginHeader, localhostAllowedOrigins, originValidationResponse); the Express, Hono and Fastify adapters gain originValidation /
  localhostOriginValidation middleware and a new allowedOrigins option on their app factories, which now arm Origin validation by default for localhost-class binds (mirroring the Host validation ladder; the 0.0.0.0-without-allowlist warning is unchanged). Requests
  without an Origin header pass — non-browser MCP clients are unaffected — while a present Origin that is not allowed or cannot be parsed (including the opaque null origin) is rejected with 403. The Node adapter ships hostHeaderValidation / originValidation
  request guards for plain node:http servers, which previously had no validation helpers.

Patch Changes

• Updated dependencies [1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 801111e, 1823aae, 1823aae, 6cc7b1c, f0bf785, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae]:
  • @modelcontextprotocol/server@2.0.0-alpha.4