modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
1,278 commits 1 branch 161 tags 11 MiB
Commit graph typescript-sdk/src/server
Author SHA1 Message Date
Vincent Horvath
4b5c25d592
 		feat: add optional resource annotations (#954) 
Co-authored-by: Konstantin Konstantinov <konstantin@mach5technology.com>
 2025-12-03 07:22:20 +02:00
Paul Carleton
09623e2aa5
 		Merge commit from fork 
* Add secure default for DNS rebinding, use in examples

* Update README examples to use createMcpExpressApp, bump to 1.23.0

- Update all server examples to use createMcpExpressApp() for secure defaults
- Rewrite DNS Rebinding Protection section to document new middleware approach
- Bump version from 1.23.0-beta.0 to 1.23.0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add IPv6 support, allowedHosts option, and warning for unprotected servers

- Use native URL API to parse Host headers (handles IPv6 correctly)
- Add [::1] (IPv6 localhost) to localhostHostValidation
- Add ::1 to list of localhost hosts that get automatic protection
- Add allowedHosts option to createMcpExpressApp for custom host validation
- Warn when binding to 0.0.0.0 or :: without allowedHosts configured
- Add tests for IPv6 and allowedHosts functionality

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Update remaining examples to use createMcpExpressApp and add DNS rebinding docs

- Update simpleTaskInteractive.ts, ssePollingExample.ts, and elicitationUrlExample.ts
  to use createMcpExpressApp() instead of express() + express.json()
- Add DNS rebinding protection section to docs/server.md explaining how to use
  createMcpExpressApp() and hostHeaderValidation middleware

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2025-12-02 13:23:06 +00:00
Felix Weinberger
cf51343cc1
 		feat: backwards-compatible createMessage overloads for SEP-1577 (#1212) 2025-12-02 13:18:22 +00:00
Matt
82041262dc
 		fix: allow zod 4 transformations (#1213) 2025-12-02 12:56:38 +00:00
Jacopo Cappellato
608360047d
 		Modify Origin header validation in validateRequestHeaders (streamableHttp.ts and sse.ts) to allow requests without an Origin, as they are not relevant to server DNS rebinding protection. (#1205) 2025-12-02 09:56:09 +00:00
Felix Weinberger
4b651b8fe1
 		feat: add closeStandaloneSSEStream for GET stream polling (#1203) 2025-12-01 17:01:20 +00:00
Felix Weinberger
fab7e1e9b3
 		feat: add closeSSEStream callback to RequestHandlerExtra (#1166) 2025-12-01 16:18:29 +00:00
Koichi ITO
6c863c8e75
 		[Docs] Fix typo (#1067) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-12-01 16:05:48 +00:00
Matt
ace9b62d3c
 		fix hanging stdio servers (#1200) 
Co-authored-by: Johnny Santos <johnnyadsantos@gmail.com>
Co-authored-by: TomasRup <tomasr@wix.com>
 2025-12-01 14:56:48 +00:00
Filip Bartuska
5aaf6ee67e
 		Fix optional argument handling in prompts for Zod V4 (#1199) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-12-01 12:10:52 +00:00
Konstantin Konstantinov
4fb4d4d55e
 		SEP-1046: Client credentials flow for M2M without user interaction (#1157) 
Co-authored-by: Paul Carleton <paulc@anthropic.com>
 2025-11-28 17:01:15 +00:00
Matt
b37f08ae3a
 		fix: update registerTool signature for proper typed ToolCallback (#1188) 
Co-authored-by: Gavin <gching@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-28 16:14:26 +00:00
Jerome
5e0302fa77
 		Allow HTTP issuer URLs when MCP_DEV_MODE is enabled (#1189) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-11-28 15:53:03 +00:00
Eduardo Gomes
5e97e1a479
 		Add invalid_target oauth error (rfc 8707) (#1183) 
Co-authored-by: Eduardo Gomes <egomes@cloudflare.com>
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
 2025-11-28 11:59:59 +00:00
Matt
cca6ba05b5
 		feat: eslint rule to prefer node protocols (#1187) 2025-11-28 11:37:25 +00:00
Luca Chang
b9538a222a
 		SEP-1686: Tasks (#1041) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
 2025-11-27 20:11:25 +00:00
Eduardo Gomes
466483f25d
 		Make sure to consume HTTP error response bodies (#1173) 
Co-authored-by: Eduardo Gomes <egomes@cloudflare.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-26 15:52:56 +00:00
Felix Weinberger
3c50d07e9f
 		feat: implement SEP-1699 SSE polling via server-side disconnect (#1129) 2025-11-25 17:19:40 +00:00
Felix Weinberger
b59a2bde7d
 		fix: React to upstream RC schema changes for form mode elicitation requests (#1164) 
Co-authored-by: Nate Barbettini <nate@arcade.dev>
 2025-11-25 11:21:07 +00:00
Olivier Chafik
2a55dfd5f2
 		sampling: validate tools, tool_use, tool_result constraints (#1156) 2025-11-22 23:56:59 -05:00
Nate Barbettini
9df0972774
 		chore: Add deprecated marker to old elicitInput overload (#1142) 2025-11-20 18:26:22 +00:00
Konstantin Konstantinov
43189335a3
 		Follow up: unify v3 and v4 zod types via describe matrix and a test helper (#1141) 2025-11-20 10:10:15 +00:00
Devin Clark
418b7f9b85
 		feat: zod v4 with backwards compatibility for v3.25+ (#1040) 2025-11-19 20:24:53 +00:00
Paul Carleton
2e67eb552e
 		[auth] Adjust scope management to line up with SEP-835 (#1133) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-18 17:30:50 +00:00
Michael
7e44b10401
 		add none to test and the router. (#1116) 2025-11-18 15:34:31 +00:00
Nate Barbettini
4debc740a5
 		SEP-1036: URL Elicitation (#1105) 2025-11-18 10:53:15 +00:00
Matt
98df118a4c
 		Migrate to vitest from jest (#1074) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
 2025-11-14 14:08:00 +00:00
Kent C. Dodds
29cb08071a
 		Implementation of SEP-986: Specify Format for Tool Names (#900) 
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-11-11 18:45:31 +00:00
Konstantin Konstantinov
9f06b6b499
 		SEP-1330: Compatibility with SEP-1034 (#1100) 
Co-authored-by: cliffhall <cliff@futurescale.com>
 2025-11-11 17:03:28 +00:00
Konstantin Konstantinov
ce420f8f94
 		DRAFT: SEP-1034: Default values for Elicitation Schemas (#1096) 2025-11-11 14:11:42 +00:00
Konstantin Konstantinov
f59996ae66
 		SEP-1319: Decouple Request Payloads, Remove passthrough iteration, Typecheck fixes (#1086) 2025-11-07 16:50:20 +00:00
Kenneth Sinder
806d7cf9c0
 		registerTool: accept ZodType<object> for input and output schema (#816) 2025-11-07 16:22:58 +00:00
Matt
11f04e1b0b
 		Check script which typechecks using Typescripts new Go port (#1075) 2025-11-06 18:23:37 +00:00
Chip
ee9fed28cc
 		fix: Support WWW-Authenticate scope param for SEP-835 (#983) 
Co-authored-by: OtotheA <oscar@otothea.com>
 2025-11-03 15:24:42 +00:00
adam jones
216604720b
 		Add @deprecated annotations to legacy APIs (#1018) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-11-03 15:21:18 +00:00
Konstantin Konstantinov
7387c44bf5
 		Fix: Non-existent tool, disabled tool and inputSchema validation return MCP protocol level instead of CallToolResult with isError: true (#1044) 2025-10-28 15:00:04 +00:00
Paul Carleton
e74a358728
 		Update metadata.ts (#1010) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-10-27 17:40:23 +00:00
Matt
5a8fb39430
 		feat: pluggable JSON schema validator providers (#1012) 2025-10-25 11:56:42 -04:00
Pierre-Élie Fauché
c543095985
 		fix: Zod to JSONSchema pipe strategies (#962) 2025-10-18 08:12:42 +01:00
Inna Harper
1150b1d843
 		run prettier (#995) 2025-10-02 18:21:00 +01:00
Blust.AI
1d475bb3f7
 		fix(auth-router): correct Protected Resource Metadata for pathful RS and add explicit resourceServerUrl (RFC 9728) (#858) 
Co-authored-by: Eugene <eugene@blust.ai>
 2025-09-22 15:32:29 +01:00
Jakub Kopecký
24b3972931
 		fix: prevent streamable http wite after end from crashing the node process (#933) 2025-09-17 10:51:37 +01:00
Cliff Hall
ebf39330f3
 		Fix automatic log level handling for sessionless connections (#917) 2025-09-09 21:35:08 +01:00
Khanh Nguyen
5dd7a2b700
 		feat: add _meta field support to tool definitions (#922) 
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
 2025-09-09 14:39:52 +01:00
Cliff Hall
79d11dc53f
 		Automatic handling of logging level (#882) 
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
 2025-08-27 15:09:07 -04:00
Christian Daguerre
2db0dbebe7
 		fix client id issuance date should only be sent when generated (#775) 2025-07-17 18:51:51 +01:00
Luca Chang
9d2a0aeb7b
 		fix: consistently use consumer-provided fetch function (#767) 2025-07-17 17:57:54 +01:00
Glen Maddern
4b2ad0385d
 		Adding invalidateCredentials() to OAuthClientProvider (#570) 
Co-authored-by: Paul Carleton <paulc@anthropic.com>
 2025-07-14 17:11:52 +01:00
Christian Daguerre
cc9ea7fd21
 		make client side client_id generation configurable in the oauth router (#734) 2025-07-14 17:07:50 +01:00
Daniel Kelleher
5b99c24bda
 		Add OIDC ID token support (#680) 2025-07-14 12:22:04 +00:00