unstale

npm / @modelcontextprotocol/sdk

@modelcontextprotocol/sdk

What changed in @modelcontextprotocol/sdk 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

4 breaking2 security4 new APIs and options1 performance4 behavior and defaults3 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@modelcontextprotocol/sdk 218 changes

Breaking changes 4

  • The client requires version 3.0.8 or later, which reduces time and memory for large messages received as a single SSE event.

    2.3.0release notes

  • When arguments is omitted, validates it as {} instead of undefined, so top-level optional or default schemas no longer receive undefined.

    2.3.0release notes

  • HTTP client transports follow redirects only on the same origin by default; set redirectPolicy: 'follow' to permit cross-origin redirects.

    2.3.0release notes

  • Rejects connections while the server instance is already connected; create a server per request instead of sharing one across requests.

    2.3.0release notes

Security 2

  • Adds expectedResource to accept only tokens issued for this server, based on the token's audience.

    2.3.0release notes

  • Adds expectedResource to accept only tokens issued for this server, based on the token's audience.

    2.3.0release notes

New APIs and options 4

  • In @modelcontextprotocol/server-legacy, requireBearerAuth accepts the optional expectedResource to accept only tokens issued for this server. It is off unless set.

    2.3.1release notes

  • Adds an McpServer option that limits the number of array elements and object members in a tool call's arguments; it is off unless set.

    2.3.0release notes

  • Can be served and called on a 2026-07-28 connection as part of the Tasks extension.

    2.3.0release notes

  • Can be served and called on a 2026-07-28 connection as part of the Tasks extension.

    2.3.0release notes

Performance 1

  • No longer converts tool schemas up front, avoiding repeated conversion on each request when a server is built per request.

    2.3.0release notes

Behavior and default changes 4

  • Express, Fastify, and Hono app helpers accept <scheme>://* entries, allowing servers to admit MCP clients running as browser extensions.

    2.3.0release notes

  • Refreshes once after a 401 on connect instead of retrying without limit.

    2.3.0release notes

  • Handles one request, so create the server and transport inside the request handler or createMcpHandler factory.

    2.3.0release notes

  • Accepts <scheme>://* origin entries, allowing servers to admit MCP clients running as browser extensions.

    2.3.0release notes

Fixes and other changes 3

  • Becomes a regular dependency of @modelcontextprotocol/node, so installs with strict peer-dependency checking no longer fail.

    2.3.0release notes

  • Types the callback correctly when no argsSchema is given.

    2.3.0release notes

  • Reports when a probe receives an unusable 2xx reply instead of presenting it as a network failure.

    2.3.0release notes