modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
1,313 commits 1 branch 161 tags 11 MiB
Commit graph typescript-sdk/src
Author SHA1 Message Date
Ola Hungerford
12ae856cee
 		[v1.x backport] Use correct schema for client sampling validation when tools are present (#1407) 
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-20 11:15:11 +00:00
Paul Carleton
b392f02ffc
 		fix: prevent ReDoS in UriTemplate regex patterns (v1.x backport) (#1365) 2026-01-07 14:37:11 +00:00
Konstantin Konstantinov
fb07af810b
 		spec types - backwards compatibility changes (#1306) 2025-12-16 15:15:39 +01:00
Matt
67ba7adbb7
 		feat: fetch transport (#1209) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-12-15 17:28:10 +00:00
Dale Seo
1d42547134
 		Add theme property to Icon schema (#1290) 
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
 2025-12-15 18:03:03 +02:00
Henry Mao
54303b4f8c
 		Add optional description field to Implementation schema (#1295) 
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <konstantin@mach5technology.com>
 2025-12-15 17:58:03 +02:00
Felix Weinberger
9941294df9
 		Fix Zod v4 schema description extraction (#1296) 2025-12-15 17:46:11 +02:00
Matt
34c9e165fe
 		Update TypeScript config to ES2020 to fix AJV imports (#1297) 2025-12-15 15:33:10 +00:00
Dale Seo
67d79d45ee
 		Update server examples and docs (#1285) 2025-12-11 11:58:47 +00:00
Felix Weinberger
06a4fd2332
 		Follow-up fixes for PR #1242 (#1274) 2025-12-09 14:21:02 +02:00
Konstantin Konstantinov
a606fb1790
 		SPEC COMPLIANCE: Remove loose/passthrough types not allowed/defined by MCP spec + Task types (#1242) 2025-12-09 11:52:23 +00:00
Matt
fbf5fc9b02
 		Protocol date validation (#1247) 2025-12-08 17:46:34 +00:00
Dale Seo
cd7a055abc
 		fix a typo in examples README (#1246) 2025-12-08 11:52:20 +00:00
Konstantin Konstantinov
5a9de1c638
 		Relocate tests under /test (#1220) 2025-12-05 23:56:12 +00:00
Luca Chang
7655eeb51c
 		Remove type dependency on @cfworker/json-schema (#1229) 
Co-authored-by: Matt Carey <mcarey@cloudflare.com>
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-12-05 19:13:45 +02:00
V
316906aeb8
 		fix: Support updating output schema (#1048) 
Co-authored-by: Konstantin Konstantinov <konstantin@mach5technology.com>
 2025-12-05 11:20:29 +02:00
Cliff Hall
a57303c335
 		No automatic completion support unless needed - Revisited yet again (#1237) 2025-12-05 06:12:16 +02:00
Konstantin Konstantinov
e7ab32f9b5
 		Role - moved from inline to reusable type (#1221) 2025-12-04 21:21:46 +02:00
Matt
b0aac584fb
 		list changed handlers on client constructor (#1206) 
Co-authored-by: ChipGPT <chip@ignission.io>
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
 2025-12-04 21:08:36 +02:00
Felix Weinberger
2f76ac8856
 		fix: skip priming events and closeSSEStream for old protocol versions (#1233) 2025-12-04 15:19:14 +02:00
Matt
0a374fc20a
 		fix: release HTTP connections after POST responses (#1214) 
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
 2025-12-04 11:56:32 +02:00
Wuma
7c9257cdf5
 		refactor: make Server class framework-agnostic by moving express to separate module (#1223) 2025-12-03 11:58:42 +00:00
Vincent Horvath
4b5c25d592
 		feat: add optional resource annotations (#954) 
Co-authored-by: Konstantin Konstantinov <konstantin@mach5technology.com>
 2025-12-03 07:22:20 +02:00
David Soria Parra
600859f105
 		chore: update protocol version to 2025-11-25 (#1218) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-12-02 18:17:57 +00:00
Mattias
bfad917cad
 		fix(streamableHttp): fix infinite retries when maxRetries is set to 0 (#1216) 
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
 2025-12-02 14:39:52 +00:00
Paul Carleton
09623e2aa5
 		Merge commit from fork 
* Add secure default for DNS rebinding, use in examples

* Update README examples to use createMcpExpressApp, bump to 1.23.0

- Update all server examples to use createMcpExpressApp() for secure defaults
- Rewrite DNS Rebinding Protection section to document new middleware approach
- Bump version from 1.23.0-beta.0 to 1.23.0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add IPv6 support, allowedHosts option, and warning for unprotected servers

- Use native URL API to parse Host headers (handles IPv6 correctly)
- Add [::1] (IPv6 localhost) to localhostHostValidation
- Add ::1 to list of localhost hosts that get automatic protection
- Add allowedHosts option to createMcpExpressApp for custom host validation
- Warn when binding to 0.0.0.0 or :: without allowedHosts configured
- Add tests for IPv6 and allowedHosts functionality

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Update remaining examples to use createMcpExpressApp and add DNS rebinding docs

- Update simpleTaskInteractive.ts, ssePollingExample.ts, and elicitationUrlExample.ts
  to use createMcpExpressApp() instead of express() + express.json()
- Add DNS rebinding protection section to docs/server.md explaining how to use
  createMcpExpressApp() and hostHeaderValidation middleware

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2025-12-02 13:23:06 +00:00
Felix Weinberger
cf51343cc1
 		feat: backwards-compatible createMessage overloads for SEP-1577 (#1212) 2025-12-02 13:18:22 +00:00
Matt
82041262dc
 		fix: allow zod 4 transformations (#1213) 2025-12-02 12:56:38 +00:00
Jacopo Cappellato
608360047d
 		Modify Origin header validation in validateRequestHeaders (streamableHttp.ts and sse.ts) to allow requests without an Origin, as they are not relevant to server DNS rebinding protection. (#1205) 2025-12-02 09:56:09 +00:00
Matt
a6ee2cb3c2
 		fix: normalize null to undefined in ElicitResultSchema content field (#1204) 2025-12-01 17:02:13 +00:00
Felix Weinberger
4b651b8fe1
 		feat: add closeStandaloneSSEStream for GET stream polling (#1203) 2025-12-01 17:01:20 +00:00
marcrasi
5ceabfb3fb
 		fix: normalize headers in sse transport (#856) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
Co-authored-by: Matt Carey <mcarey@cloudflare.com>
 2025-12-01 16:38:19 +00:00
Felix Weinberger
f67fc2ff58
 		fix: improve SSE reconnection behavior (#1191) 2025-12-01 16:31:24 +00:00
Felix Weinberger
fab7e1e9b3
 		feat: add closeSSEStream callback to RequestHandlerExtra (#1166) 2025-12-01 16:18:29 +00:00
Koichi ITO
6c863c8e75
 		[Docs] Fix typo (#1067) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-12-01 16:05:48 +00:00
Konstantin Konstantinov
74ab69ffa0
 		README refactor (#1197) 2025-12-01 18:04:23 +02:00
Matt
ace9b62d3c
 		fix hanging stdio servers (#1200) 
Co-authored-by: Johnny Santos <johnnyadsantos@gmail.com>
Co-authored-by: TomasRup <tomasr@wix.com>
 2025-12-01 14:56:48 +00:00
Filip Bartuska
5aaf6ee67e
 		Fix optional argument handling in prompts for Zod V4 (#1199) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-12-01 12:10:52 +00:00
Konstantin Konstantinov
4fb4d4d55e
 		SEP-1046: Client credentials flow for M2M without user interaction (#1157) 
Co-authored-by: Paul Carleton <paulc@anthropic.com>
 2025-11-28 17:01:15 +00:00
Matt
b37f08ae3a
 		fix: update registerTool signature for proper typed ToolCallback (#1188) 
Co-authored-by: Gavin <gching@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-28 16:14:26 +00:00
Jerome
5e0302fa77
 		Allow HTTP issuer URLs when MCP_DEV_MODE is enabled (#1189) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-11-28 15:53:03 +00:00
Adam Kuhn
b4c6090bf2
 		coerce 'expires_in' to be a number (#1111) 
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <konstantin@mach5technology.com>
 2025-11-28 14:13:49 +00:00
Kazuki Yamada
6b90e1ada8
 		fix(client): use StreamableHTTPError instead of plain Error in send() (#1178) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-11-28 13:09:07 +00:00
Eduardo Gomes
5e97e1a479
 		Add invalid_target oauth error (rfc 8707) (#1183) 
Co-authored-by: Eduardo Gomes <egomes@cloudflare.com>
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-11-28 11:59:59 +00:00
Felix Weinberger
42a2f41f77
 		fix: call tasks/result to deliver side-channel messages (#1185) 2025-11-28 11:46:20 +00:00
Matt
cca6ba05b5
 		feat: eslint rule to prefer node protocols (#1187) 2025-11-28 11:37:25 +00:00
Felix Weinberger
9203091219
 		Fix JSON parse error on SSE events with empty data (#1184) 2025-11-27 21:22:00 +00:00
Luca Chang
b9538a222a
 		SEP-1686: Tasks (#1041) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
 2025-11-27 20:11:25 +00:00
Eduardo Gomes
466483f25d
 		Make sure to consume HTTP error response bodies (#1173) 
Co-authored-by: Eduardo Gomes <egomes@cloudflare.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-26 15:52:56 +00:00
Felix Weinberger
3c50d07e9f
 		feat: implement SEP-1699 SSE polling via server-side disconnect (#1129) 2025-11-25 17:19:40 +00:00