modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
1,274 commits 1 branch 161 tags 11 MiB
Commit graph typescript-sdk/src
Author SHA1 Message Date
Paul Carleton
09623e2aa5
 		Merge commit from fork 
* Add secure default for DNS rebinding, use in examples

* Update README examples to use createMcpExpressApp, bump to 1.23.0

- Update all server examples to use createMcpExpressApp() for secure defaults
- Rewrite DNS Rebinding Protection section to document new middleware approach
- Bump version from 1.23.0-beta.0 to 1.23.0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add IPv6 support, allowedHosts option, and warning for unprotected servers

- Use native URL API to parse Host headers (handles IPv6 correctly)
- Add [::1] (IPv6 localhost) to localhostHostValidation
- Add ::1 to list of localhost hosts that get automatic protection
- Add allowedHosts option to createMcpExpressApp for custom host validation
- Warn when binding to 0.0.0.0 or :: without allowedHosts configured
- Add tests for IPv6 and allowedHosts functionality

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Update remaining examples to use createMcpExpressApp and add DNS rebinding docs

- Update simpleTaskInteractive.ts, ssePollingExample.ts, and elicitationUrlExample.ts
  to use createMcpExpressApp() instead of express() + express.json()
- Add DNS rebinding protection section to docs/server.md explaining how to use
  createMcpExpressApp() and hostHeaderValidation middleware

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2025-12-02 13:23:06 +00:00
Felix Weinberger
cf51343cc1
 		feat: backwards-compatible createMessage overloads for SEP-1577 (#1212) 2025-12-02 13:18:22 +00:00
Matt
82041262dc
 		fix: allow zod 4 transformations (#1213) 2025-12-02 12:56:38 +00:00
Jacopo Cappellato
608360047d
 		Modify Origin header validation in validateRequestHeaders (streamableHttp.ts and sse.ts) to allow requests without an Origin, as they are not relevant to server DNS rebinding protection. (#1205) 2025-12-02 09:56:09 +00:00
Matt
a6ee2cb3c2
 		fix: normalize null to undefined in ElicitResultSchema content field (#1204) 2025-12-01 17:02:13 +00:00
Felix Weinberger
4b651b8fe1
 		feat: add closeStandaloneSSEStream for GET stream polling (#1203) 2025-12-01 17:01:20 +00:00
marcrasi
5ceabfb3fb
 		fix: normalize headers in sse transport (#856) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
Co-authored-by: Matt Carey <mcarey@cloudflare.com>
 2025-12-01 16:38:19 +00:00
Felix Weinberger
f67fc2ff58
 		fix: improve SSE reconnection behavior (#1191) 2025-12-01 16:31:24 +00:00
Felix Weinberger
fab7e1e9b3
 		feat: add closeSSEStream callback to RequestHandlerExtra (#1166) 2025-12-01 16:18:29 +00:00
Koichi ITO
6c863c8e75
 		[Docs] Fix typo (#1067) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-12-01 16:05:48 +00:00
Konstantin Konstantinov
74ab69ffa0
 		README refactor (#1197) 2025-12-01 18:04:23 +02:00
Matt
ace9b62d3c
 		fix hanging stdio servers (#1200) 
Co-authored-by: Johnny Santos <johnnyadsantos@gmail.com>
Co-authored-by: TomasRup <tomasr@wix.com>
 2025-12-01 14:56:48 +00:00
Filip Bartuska
5aaf6ee67e
 		Fix optional argument handling in prompts for Zod V4 (#1199) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-12-01 12:10:52 +00:00
Konstantin Konstantinov
4fb4d4d55e
 		SEP-1046: Client credentials flow for M2M without user interaction (#1157) 
Co-authored-by: Paul Carleton <paulc@anthropic.com>
 2025-11-28 17:01:15 +00:00
Matt
b37f08ae3a
 		fix: update registerTool signature for proper typed ToolCallback (#1188) 
Co-authored-by: Gavin <gching@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-28 16:14:26 +00:00
Jerome
5e0302fa77
 		Allow HTTP issuer URLs when MCP_DEV_MODE is enabled (#1189) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-11-28 15:53:03 +00:00
Adam Kuhn
b4c6090bf2
 		coerce 'expires_in' to be a number (#1111) 
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <konstantin@mach5technology.com>
 2025-11-28 14:13:49 +00:00
Kazuki Yamada
6b90e1ada8
 		fix(client): use StreamableHTTPError instead of plain Error in send() (#1178) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-11-28 13:09:07 +00:00
Eduardo Gomes
5e97e1a479
 		Add invalid_target oauth error (rfc 8707) (#1183) 
Co-authored-by: Eduardo Gomes <egomes@cloudflare.com>
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-11-28 11:59:59 +00:00
Felix Weinberger
42a2f41f77
 		fix: call tasks/result to deliver side-channel messages (#1185) 2025-11-28 11:46:20 +00:00
Matt
cca6ba05b5
 		feat: eslint rule to prefer node protocols (#1187) 2025-11-28 11:37:25 +00:00
Felix Weinberger
9203091219
 		Fix JSON parse error on SSE events with empty data (#1184) 2025-11-27 21:22:00 +00:00
Luca Chang
b9538a222a
 		SEP-1686: Tasks (#1041) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
 2025-11-27 20:11:25 +00:00
Eduardo Gomes
466483f25d
 		Make sure to consume HTTP error response bodies (#1173) 
Co-authored-by: Eduardo Gomes <egomes@cloudflare.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-26 15:52:56 +00:00
Felix Weinberger
3c50d07e9f
 		feat: implement SEP-1699 SSE polling via server-side disconnect (#1129) 2025-11-25 17:19:40 +00:00
Felix Weinberger
b59a2bde7d
 		fix: React to upstream RC schema changes for form mode elicitation requests (#1164) 
Co-authored-by: Nate Barbettini <nate@arcade.dev>
 2025-11-25 11:21:07 +00:00
Olivier Chafik
2a55dfd5f2
 		sampling: validate tools, tool_use, tool_result constraints (#1156) 2025-11-22 23:56:59 -05:00
Felix Weinberger
41c6b35e07
 		SEP-1613: use.catchall() on inputSchema/outputSchema to support JSON Schema 2020-12 (#1135) 2025-11-21 13:41:12 +00:00
Nayana Parameswarappa
3485a06f85
 		Support upscoping on insufficient_scope 403 (#1115) 
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
 2025-11-20 19:37:44 +00:00
Nate Barbettini
fc4a6ecb40
 		fix: Connect error in URL elicitation example (#1136) 2025-11-20 18:30:10 +00:00
Nate Barbettini
9df0972774
 		chore: Add deprecated marker to old elicitInput overload (#1142) 2025-11-20 18:26:22 +00:00
Konstantin Konstantinov
43189335a3
 		Follow up: unify v3 and v4 zod types via describe matrix and a test helper (#1141) 2025-11-20 10:10:15 +00:00
Olivier Chafik
9438478aaf
 		Implement SEP-1577 - Sampling With Tools (#1101) 2025-11-19 18:29:46 -05:00
Devin Clark
418b7f9b85
 		feat: zod v4 with backwards compatibility for v3.25+ (#1040) 2025-11-19 20:24:53 +00:00
Matt
7fca1f2b15
 		feat: url based client metadata registration (SEP 991) (#1127) 2025-11-19 16:44:53 +00:00
Paul Carleton
2e67eb552e
 		[auth] Adjust scope management to line up with SEP-835 (#1133) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-18 17:30:50 +00:00
Michael
7e44b10401
 		add none to test and the router. (#1116) 2025-11-18 15:34:31 +00:00
Nate Barbettini
4debc740a5
 		SEP-1036: URL Elicitation (#1105) 2025-11-18 10:53:15 +00:00
David Soria Parra
df56e35322
 		fix: Pass RequestInit options to auth requests (#1066) 
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
 2025-11-17 16:06:21 +00:00
Matt
98df118a4c
 		Migrate to vitest from jest (#1074) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
 2025-11-14 14:08:00 +00:00
Paul Carleton
8019972832
 		[auth] Fix march spec fallback for metadata discovery (#1108) 
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
 2025-11-13 19:31:42 +00:00
Kent C. Dodds
29cb08071a
 		Implementation of SEP-986: Specify Format for Tool Names (#900) 
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-11 18:45:31 +00:00
Konstantin Konstantinov
9f06b6b499
 		SEP-1330: Compatibility with SEP-1034 (#1100) 
Co-authored-by: cliffhall <cliff@futurescale.com>
 2025-11-11 17:03:28 +00:00
Konstantin Konstantinov
ce420f8f94
 		DRAFT: SEP-1034: Default values for Elicitation Schemas (#1096) 2025-11-11 14:11:42 +00:00
Konstantin Konstantinov
f59996ae66
 		SEP-1319: Decouple Request Payloads, Remove passthrough iteration, Typecheck fixes (#1086) 2025-11-07 16:50:20 +00:00
Kenneth Sinder
806d7cf9c0
 		registerTool: accept ZodType<object> for input and output schema (#816) 2025-11-07 16:22:58 +00:00
Matt
4463737330
 		FIX: use a nightly spec.types.ts (#1087) 2025-11-07 14:16:11 +00:00
Matt
11f04e1b0b
 		Check script which typechecks using Typescripts new Go port (#1075) 2025-11-06 18:23:37 +00:00
Matt
9757ace06e
 		move CLI script to dedicated scripts directory (#1073) 2025-11-04 17:52:28 +00:00
Chip
ee9fed28cc
 		fix: Support WWW-Authenticate scope param for SEP-835 (#983) 
Co-authored-by: OtotheA <oscar@otothea.com>
 2025-11-03 15:24:42 +00:00