modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
typescript-sdk/.changeset/sep-2350-scope-step-up.md
Felix Weinberger 1823aae891
 Implement MCP 2026-07-28 (#2286) 
Co-authored-by: Matt <77928207+mattzcarey@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-26 14:01:10 +01:00

776 B
Raw Blame History

@modelcontextprotocol/client
minor

SEP-2350 scope step-up: on 403 insufficient_scope, StreamableHTTPClientTransport now re-authorizes with the union of the previously-requested and challenged scopes (computeScopeUnion), bypassing the refresh-token branch when the union is a strict superset of the current token's granted scope (isStrictScopeSuperset, AuthOptions.forceReauthorization). New onInsufficientScope: 'reauthorize' | 'throw' (default 'reauthorize') and maxStepUpRetries (default 1) on StreamableHTTPClientTransportOptions; 'throw' raises the new InsufficientScopeError. The GET listen-stream open path now applies the same step-up handling. The previous verbatim-header retry guard is replaced by the bounded per-send counter.