# What changed in @modelcontextprotocol/sdk

> 18 changes in @modelcontextprotocol/sdk 2 from its official release notes, upgrade guides and advisories: 4 breaking, 2 security, 4 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@modelcontextprotocol/sdk/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @modelcontextprotocol/sdk 2

### Breaking changes

- The client requires version 3.0.8 or later, which reduces time and memory for large messages received as a single SSE event. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- When `arguments` is omitted, validates it as `{}` instead of `undefined`, so top-level optional or default schemas no longer receive `undefined`. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- HTTP client transports follow redirects only on the same origin by default; set `redirectPolicy: 'follow'` to permit cross-origin redirects. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- Rejects connections while the server instance is already connected; create a server per request instead of sharing one across requests. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)

### Security

- Adds `expectedResource` to accept only tokens issued for this server, based on the token's audience. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- Adds `expectedResource` to accept only tokens issued for this server, based on the token's audience. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)

### New APIs and options

- In @modelcontextprotocol/server-legacy, requireBearerAuth accepts the optional expectedResource to accept only tokens issued for this server. It is off unless set. (2.3.1) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.1)
- Adds an `McpServer` option that limits the number of array elements and object members in a tool call's arguments; it is off unless set. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- Can be served and called on a 2026-07-28 connection as part of the Tasks extension. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- Can be served and called on a 2026-07-28 connection as part of the Tasks extension. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)

### Performance

- No longer converts tool schemas up front, avoiding repeated conversion on each request when a server is built per request. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)

### Behavior and default changes

- Express, Fastify, and Hono app helpers accept `<scheme>://*` entries, allowing servers to admit MCP clients running as browser extensions. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- Refreshes once after a 401 on connect instead of retrying without limit. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- Handles one request, so create the server and transport inside the request handler or `createMcpHandler` factory. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- Accepts `<scheme>://*` origin entries, allowing servers to admit MCP clients running as browser extensions. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)

### Fixes and other changes

- Becomes a regular dependency of `@modelcontextprotocol/node`, so installs with strict peer-dependency checking no longer fail. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- Types the callback correctly when no `argsSchema` is given. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)
- Reports when a probe receives an unusable 2xx reply instead of presenting it as a network failure. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.3.0)