From abbed2360e5e65b8caa68e0d1f944c234f1fbfca Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 10 Nov 2026 13:40:43 +0000 Subject: [PATCH] Version Packages --- .changeset/bundled-fast-uri-3-1-9.md | 6 ----- .../mcp-param-header-non-primitive-body.md | 6 ----- .changeset/protocol-instrumentation.md | 17 ------------- .../skip-offline-access-consent-prompt.md | 5 ---- packages/client/CHANGELOG.md | 24 +++++++++++++++++++ packages/client/package.json | 2 +- packages/codemod/CHANGELOG.md | 2 ++ packages/codemod/package.json | 2 +- packages/core-internal/CHANGELOG.md | 22 +++++++++++++++++ packages/core-internal/package.json | 2 +- packages/core/CHANGELOG.md | 2 ++ packages/core/package.json | 2 +- packages/server-legacy/CHANGELOG.md | 7 ++++++ packages/server-legacy/package.json | 2 +- packages/server/CHANGELOG.md | 24 +++++++++++++++++++ packages/server/package.json | 2 +- 16 files changed, 87 insertions(+), 40 deletions(-) delete mode 100644 .changeset/bundled-fast-uri-3-1-9.md delete mode 100644 .changeset/mcp-param-header-non-primitive-body.md delete mode 100644 .changeset/protocol-instrumentation.md delete mode 100644 .changeset/skip-offline-access-consent-prompt.md diff --git a/.changeset/bundled-fast-uri-3-1-9.md b/.changeset/bundled-fast-uri-3-1-9.md deleted file mode 100644 index 0b1ea3dec6..0000000000 --- a/.changeset/bundled-fast-uri-3-1-9.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@modelcontextprotocol/client': patch -'@modelcontextprotocol/server': patch ---- - -The bundled Ajv validator is now built with fast-uri 3.1.9 (was 3.1.8). A schema no longer compiles when a `$id` or `$ref` has a percent-encoded character before its first colon (`%61:b`), or `{` or `}` in the host of an `http`, `https`, `ws` or `wss` URL (`http://{host}/a`). Relative values keep their leading `..` segments: a `$ref` to a `$id` such as `../a` now resolves, and a `$ref` of only dot segments (`.`, `../`) no longer resolves to the root schema. Plain names, `#/$defs/...` references, other URLs and URNs are not affected. diff --git a/.changeset/mcp-param-header-non-primitive-body.md b/.changeset/mcp-param-header-non-primitive-body.md deleted file mode 100644 index bccc0bcdb0..0000000000 --- a/.changeset/mcp-param-header-non-primitive-body.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@modelcontextprotocol/core-internal': patch -'@modelcontextprotocol/server': patch ---- - -Reject a `tools/call` with `400` / `-32020` (`HeaderMismatch`) when a body argument declared with `x-mcp-header` is an object or array, with or without its `Mcp-Param-*` header, and when the argument is an integer outside the safe range but the header is present. Previously the header check was skipped for these values, so the call reached the tool. diff --git a/.changeset/protocol-instrumentation.md b/.changeset/protocol-instrumentation.md deleted file mode 100644 index 9b72344d43..0000000000 --- a/.changeset/protocol-instrumentation.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@modelcontextprotocol/core-internal': minor -'@modelcontextprotocol/client': minor -'@modelcontextprotocol/server': minor ---- - -`Client`, `Server` and `McpServer` now emit OpenTelemetry spans and `mcp.client.operation.duration` / `mcp.server.operation.duration` histograms for every MCP request and notification except `notifications/message`, following the OpenTelemetry semantic conventions for MCP, and propagate W3C trace context through `params._meta` (SEP-414). There is nothing to configure: register an OpenTelemetry SDK and MCP traffic shows up. Pass `openTelemetry: false` to a `Client`, `Server` or `McpServer` to turn its instrumentation off. Without one, the OpenTelemetry API is a no-op, nothing is recorded and messages are unchanged. - -`@opentelemetry/api` (`^1.9.0`) is a new required peer dependency of `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, so the SDK uses the same copy as the application's OpenTelemetry SDK. npm 7+, pnpm 8+ and Bun install it automatically. Setups that don't install peers must add `@opentelemetry/api` to their dependencies, or importing either package fails: Yarn (classic, and Berry with any linker), `npm --legacy-peer-deps`, and pnpm with `auto-install-peers=false`. - -What changes for applications that already run an OpenTelemetry SDK: - -- MCP spans and metrics appear under the `@modelcontextprotocol/client` and `@modelcontextprotocol/server` instrumentation scopes. If you already trace MCP, pass `openTelemetry: false`, or with Sentry remove its `McpServer` integration, to avoid duplicate spans. Filtering the MCP scopes instead leaves handler spans parented on spans that are never exported. -- Outgoing requests and notifications carry whatever your global propagator writes, in `params._meta`, as HTTP requests carry it in headers: `traceparent` and `tracestate`, plus `baggage` if the propagator includes W3C Baggage (the `NodeSDK` default), so baggage entries reach MCP peers, including third-party servers. Register `W3CTraceContextPropagator` alone to send trace context only. -- Servers that validate a custom method's params with a strict schema need an optional `_meta` member, as they already do for callers that pass `onprogress`. - -Spans do not record tool arguments, tool results or prompt arguments. They do record JSON-RPC error messages, handler exception messages and resource URIs. The span and attribute names are experimental while the MCP semantic conventions are in development. diff --git a/.changeset/skip-offline-access-consent-prompt.md b/.changeset/skip-offline-access-consent-prompt.md deleted file mode 100644 index 268cf233ef..0000000000 --- a/.changeset/skip-offline-access-consent-prompt.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@modelcontextprotocol/client': patch ---- - -Add `OAuthClientProvider.skipOfflineAccessConsentPrompt` (and the matching `startAuthorization()` option) so a client can omit the `prompt=consent` the SDK adds when the requested scope includes `offline_access`. Default behavior is unchanged. This unblocks authorization servers such as Microsoft Entra ID tenants that have user consent disabled and admin consent granted, where a forced consent prompt fails with `AADSTS90095` for non-admin users. diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index 2e6e11ff3b..7b3aa76c1f 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1,5 +1,29 @@ # @modelcontextprotocol/client +## 2.5.0 + +### Minor Changes + +- [#3115](https://github.com/modelcontextprotocol/typescript-sdk/pull/3115) [`1e608ca`](https://github.com/modelcontextprotocol/typescript-sdk/commit/1e608caeb5130b2ad0fa067c84b26a038c1c6e36) Thanks [@mattzcarey](https://github.com/mattzcarey)! - `Client`, `Server` and `McpServer` now emit OpenTelemetry spans and `mcp.client.operation.duration` / `mcp.server.operation.duration` histograms for every MCP request and notification except `notifications/message`, following the OpenTelemetry semantic conventions for MCP, and propagate W3C trace context through `params._meta` (SEP-414). There is nothing to configure: register an OpenTelemetry SDK and MCP traffic shows up. Pass `openTelemetry: false` to a `Client`, `Server` or `McpServer` to turn its instrumentation off. Without one, the OpenTelemetry API is a no-op, nothing is recorded and messages are unchanged. + + `@opentelemetry/api` (`^1.9.0`) is a new required peer dependency of `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, so the SDK uses the same copy as the application's OpenTelemetry SDK. npm 7+, pnpm 8+ and Bun install it automatically. Setups that don't install peers must add `@opentelemetry/api` to their dependencies, or importing either package fails: Yarn (classic, and Berry with any linker), `npm --legacy-peer-deps`, and pnpm with `auto-install-peers=false`. + + What changes for applications that already run an OpenTelemetry SDK: + - MCP spans and metrics appear under the `@modelcontextprotocol/client` and `@modelcontextprotocol/server` instrumentation scopes. If you already trace MCP, pass `openTelemetry: false`, or with Sentry remove its `McpServer` integration, to avoid duplicate spans. Filtering the MCP scopes instead leaves handler spans parented on spans that are never exported. + - Outgoing requests and notifications carry whatever your global propagator writes, in `params._meta`, as HTTP requests carry it in headers: `traceparent` and `tracestate`, plus `baggage` if the propagator includes W3C Baggage (the `NodeSDK` default), so baggage entries reach MCP peers, including third-party servers. Register `W3CTraceContextPropagator` alone to send trace context only. + - Servers that validate a custom method's params with a strict schema need an optional `_meta` member, as they already do for callers that pass `onprogress`. + + Spans do not record tool arguments, tool results or prompt arguments. They do record JSON-RPC error messages, handler exception messages and resource URIs. The span and attribute names are experimental while the MCP semantic conventions are in development. + +### Patch Changes + +- [#3108](https://github.com/modelcontextprotocol/typescript-sdk/pull/3108) [`39ae8e6`](https://github.com/modelcontextprotocol/typescript-sdk/commit/39ae8e6192cf43273aaaf2de4169dfa9f7216e28) Thanks [@claude](https://github.com/apps/claude)! - The bundled Ajv validator is now built with fast-uri 3.1.9 (was 3.1.8). A schema no longer compiles when a `$id` or `$ref` has a percent-encoded character before its first colon (`%61:b`), or `{` or `}` in the host of an `http`, `https`, `ws` or `wss` URL (`http://{host}/a`). Relative values keep their leading `..` segments: a `$ref` to a `$id` such as `../a` now resolves, and a `$ref` of only dot segments (`.`, `../`) no longer resolves to the root schema. Plain names, `#/$defs/...` references, other URLs and URNs are not affected. + +- [#2877](https://github.com/modelcontextprotocol/typescript-sdk/pull/2877) [`b415e60`](https://github.com/modelcontextprotocol/typescript-sdk/commit/b415e60bdf0e8dd5d6cbe7e6353abfb982b06dd2) Thanks [@dasjideepak](https://github.com/dasjideepak)! - Add `OAuthClientProvider.skipOfflineAccessConsentPrompt` (and the matching `startAuthorization()` option) so a client can omit the `prompt=consent` the SDK adds when the requested scope includes `offline_access`. Default behavior is unchanged. This unblocks authorization servers such as Microsoft Entra ID tenants that have user consent disabled and admin consent granted, where a forced consent prompt fails with `AADSTS90095` for non-admin users. + +- Updated dependencies []: + - @modelcontextprotocol/core@2.5.0 + ## 2.4.0 ### Minor Changes diff --git a/packages/client/package.json b/packages/client/package.json index 636456879d..25832b5249 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@modelcontextprotocol/client", - "version": "2.4.0", + "version": "2.5.0", "description": "Model Context Protocol implementation for TypeScript - Client package", "license": "Apache-2.0", "author": "Anthropic, PBC (https://anthropic.com)", diff --git a/packages/codemod/CHANGELOG.md b/packages/codemod/CHANGELOG.md index 87b2d64580..7994e29c49 100644 --- a/packages/codemod/CHANGELOG.md +++ b/packages/codemod/CHANGELOG.md @@ -1,5 +1,7 @@ # @modelcontextprotocol/codemod +## 2.5.0 + ## 2.4.0 ## 2.3.1 diff --git a/packages/codemod/package.json b/packages/codemod/package.json index f8133d08d3..61d478bc68 100644 --- a/packages/codemod/package.json +++ b/packages/codemod/package.json @@ -1,6 +1,6 @@ { "name": "@modelcontextprotocol/codemod", - "version": "2.4.0", + "version": "2.5.0", "description": "Codemod to migrate MCP TypeScript SDK code from v1 to v2", "license": "Apache-2.0", "author": "Anthropic, PBC (https://anthropic.com)", diff --git a/packages/core-internal/CHANGELOG.md b/packages/core-internal/CHANGELOG.md index 9d9715f70b..b53d60b189 100644 --- a/packages/core-internal/CHANGELOG.md +++ b/packages/core-internal/CHANGELOG.md @@ -1,5 +1,27 @@ # @modelcontextprotocol/core-internal +## 2.1.0 + +### Minor Changes + +- [#3115](https://github.com/modelcontextprotocol/typescript-sdk/pull/3115) [`1e608ca`](https://github.com/modelcontextprotocol/typescript-sdk/commit/1e608caeb5130b2ad0fa067c84b26a038c1c6e36) Thanks [@mattzcarey](https://github.com/mattzcarey)! - `Client`, `Server` and `McpServer` now emit OpenTelemetry spans and `mcp.client.operation.duration` / `mcp.server.operation.duration` histograms for every MCP request and notification except `notifications/message`, following the OpenTelemetry semantic conventions for MCP, and propagate W3C trace context through `params._meta` (SEP-414). There is nothing to configure: register an OpenTelemetry SDK and MCP traffic shows up. Pass `openTelemetry: false` to a `Client`, `Server` or `McpServer` to turn its instrumentation off. Without one, the OpenTelemetry API is a no-op, nothing is recorded and messages are unchanged. + + `@opentelemetry/api` (`^1.9.0`) is a new required peer dependency of `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, so the SDK uses the same copy as the application's OpenTelemetry SDK. npm 7+, pnpm 8+ and Bun install it automatically. Setups that don't install peers must add `@opentelemetry/api` to their dependencies, or importing either package fails: Yarn (classic, and Berry with any linker), `npm --legacy-peer-deps`, and pnpm with `auto-install-peers=false`. + + What changes for applications that already run an OpenTelemetry SDK: + - MCP spans and metrics appear under the `@modelcontextprotocol/client` and `@modelcontextprotocol/server` instrumentation scopes. If you already trace MCP, pass `openTelemetry: false`, or with Sentry remove its `McpServer` integration, to avoid duplicate spans. Filtering the MCP scopes instead leaves handler spans parented on spans that are never exported. + - Outgoing requests and notifications carry whatever your global propagator writes, in `params._meta`, as HTTP requests carry it in headers: `traceparent` and `tracestate`, plus `baggage` if the propagator includes W3C Baggage (the `NodeSDK` default), so baggage entries reach MCP peers, including third-party servers. Register `W3CTraceContextPropagator` alone to send trace context only. + - Servers that validate a custom method's params with a strict schema need an optional `_meta` member, as they already do for callers that pass `onprogress`. + + Spans do not record tool arguments, tool results or prompt arguments. They do record JSON-RPC error messages, handler exception messages and resource URIs. The span and attribute names are experimental while the MCP semantic conventions are in development. + +### Patch Changes + +- [#3167](https://github.com/modelcontextprotocol/typescript-sdk/pull/3167) [`919bb8e`](https://github.com/modelcontextprotocol/typescript-sdk/commit/919bb8ea88b6e10e72c2f8b6218fad4cfdc40b2c) Thanks [@mattzcarey](https://github.com/mattzcarey)! - Reject a `tools/call` with `400` / `-32020` (`HeaderMismatch`) when a body argument declared with `x-mcp-header` is an object or array, with or without its `Mcp-Param-*` header, and when the argument is an integer outside the safe range but the header is present. Previously the header check was skipped for these values, so the call reached the tool. + +- Updated dependencies []: + - @modelcontextprotocol/core@2.5.0 + ## 2.0.5 ### Patch Changes diff --git a/packages/core-internal/package.json b/packages/core-internal/package.json index 5e7612b729..a149e00b02 100644 --- a/packages/core-internal/package.json +++ b/packages/core-internal/package.json @@ -1,7 +1,7 @@ { "name": "@modelcontextprotocol/core-internal", "private": true, - "version": "2.0.5", + "version": "2.1.0", "description": "Model Context Protocol implementation for TypeScript - Core package", "license": "Apache-2.0", "author": "Anthropic, PBC (https://anthropic.com)", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index 704b717ef8..39150d1cc8 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,7 @@ # @modelcontextprotocol/core +## 2.5.0 + ## 2.4.0 ### Minor Changes diff --git a/packages/core/package.json b/packages/core/package.json index fbcf2818d9..aed507165f 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@modelcontextprotocol/core", - "version": "2.4.0", + "version": "2.5.0", "description": "Model Context Protocol for TypeScript — public Zod schemas (spec + OAuth/OpenID)", "license": "Apache-2.0", "author": "Anthropic, PBC (https://anthropic.com)", diff --git a/packages/server-legacy/CHANGELOG.md b/packages/server-legacy/CHANGELOG.md index abc7280e80..ae1ee05076 100644 --- a/packages/server-legacy/CHANGELOG.md +++ b/packages/server-legacy/CHANGELOG.md @@ -1,5 +1,12 @@ # @modelcontextprotocol/server-legacy +## 2.5.0 + +### Patch Changes + +- Updated dependencies []: + - @modelcontextprotocol/core@2.5.0 + ## 2.4.0 ### Patch Changes diff --git a/packages/server-legacy/package.json b/packages/server-legacy/package.json index 039c771922..98d05d2f02 100644 --- a/packages/server-legacy/package.json +++ b/packages/server-legacy/package.json @@ -1,7 +1,7 @@ { "name": "@modelcontextprotocol/server-legacy", "private": false, - "version": "2.4.0", + "version": "2.5.0", "description": "Frozen v1 SSE transport and OAuth Authorization Server helpers for the Model Context Protocol TypeScript SDK. Deprecated; use StreamableHTTP and a dedicated OAuth server in production.", "deprecated": "This package is a frozen copy of v1's SSE transport and OAuth Authorization Server helpers for migration purposes only. Use StreamableHTTP from @modelcontextprotocol/server and a dedicated OAuth server in production. Will not receive new features.", "license": "Apache-2.0", diff --git a/packages/server/CHANGELOG.md b/packages/server/CHANGELOG.md index be1dcf91cb..b4bbb805b8 100644 --- a/packages/server/CHANGELOG.md +++ b/packages/server/CHANGELOG.md @@ -1,5 +1,29 @@ # @modelcontextprotocol/server +## 2.5.0 + +### Minor Changes + +- [#3115](https://github.com/modelcontextprotocol/typescript-sdk/pull/3115) [`1e608ca`](https://github.com/modelcontextprotocol/typescript-sdk/commit/1e608caeb5130b2ad0fa067c84b26a038c1c6e36) Thanks [@mattzcarey](https://github.com/mattzcarey)! - `Client`, `Server` and `McpServer` now emit OpenTelemetry spans and `mcp.client.operation.duration` / `mcp.server.operation.duration` histograms for every MCP request and notification except `notifications/message`, following the OpenTelemetry semantic conventions for MCP, and propagate W3C trace context through `params._meta` (SEP-414). There is nothing to configure: register an OpenTelemetry SDK and MCP traffic shows up. Pass `openTelemetry: false` to a `Client`, `Server` or `McpServer` to turn its instrumentation off. Without one, the OpenTelemetry API is a no-op, nothing is recorded and messages are unchanged. + + `@opentelemetry/api` (`^1.9.0`) is a new required peer dependency of `@modelcontextprotocol/client` and `@modelcontextprotocol/server`, so the SDK uses the same copy as the application's OpenTelemetry SDK. npm 7+, pnpm 8+ and Bun install it automatically. Setups that don't install peers must add `@opentelemetry/api` to their dependencies, or importing either package fails: Yarn (classic, and Berry with any linker), `npm --legacy-peer-deps`, and pnpm with `auto-install-peers=false`. + + What changes for applications that already run an OpenTelemetry SDK: + - MCP spans and metrics appear under the `@modelcontextprotocol/client` and `@modelcontextprotocol/server` instrumentation scopes. If you already trace MCP, pass `openTelemetry: false`, or with Sentry remove its `McpServer` integration, to avoid duplicate spans. Filtering the MCP scopes instead leaves handler spans parented on spans that are never exported. + - Outgoing requests and notifications carry whatever your global propagator writes, in `params._meta`, as HTTP requests carry it in headers: `traceparent` and `tracestate`, plus `baggage` if the propagator includes W3C Baggage (the `NodeSDK` default), so baggage entries reach MCP peers, including third-party servers. Register `W3CTraceContextPropagator` alone to send trace context only. + - Servers that validate a custom method's params with a strict schema need an optional `_meta` member, as they already do for callers that pass `onprogress`. + + Spans do not record tool arguments, tool results or prompt arguments. They do record JSON-RPC error messages, handler exception messages and resource URIs. The span and attribute names are experimental while the MCP semantic conventions are in development. + +### Patch Changes + +- [#3108](https://github.com/modelcontextprotocol/typescript-sdk/pull/3108) [`39ae8e6`](https://github.com/modelcontextprotocol/typescript-sdk/commit/39ae8e6192cf43273aaaf2de4169dfa9f7216e28) Thanks [@claude](https://github.com/apps/claude)! - The bundled Ajv validator is now built with fast-uri 3.1.9 (was 3.1.8). A schema no longer compiles when a `$id` or `$ref` has a percent-encoded character before its first colon (`%61:b`), or `{` or `}` in the host of an `http`, `https`, `ws` or `wss` URL (`http://{host}/a`). Relative values keep their leading `..` segments: a `$ref` to a `$id` such as `../a` now resolves, and a `$ref` of only dot segments (`.`, `../`) no longer resolves to the root schema. Plain names, `#/$defs/...` references, other URLs and URNs are not affected. + +- [#3167](https://github.com/modelcontextprotocol/typescript-sdk/pull/3167) [`919bb8e`](https://github.com/modelcontextprotocol/typescript-sdk/commit/919bb8ea88b6e10e72c2f8b6218fad4cfdc40b2c) Thanks [@mattzcarey](https://github.com/mattzcarey)! - Reject a `tools/call` with `400` / `-32020` (`HeaderMismatch`) when a body argument declared with `x-mcp-header` is an object or array, with or without its `Mcp-Param-*` header, and when the argument is an integer outside the safe range but the header is present. Previously the header check was skipped for these values, so the call reached the tool. + +- Updated dependencies []: + - @modelcontextprotocol/core@2.5.0 + ## 2.4.0 ### Minor Changes diff --git a/packages/server/package.json b/packages/server/package.json index b61acddc68..3982812070 100644 --- a/packages/server/package.json +++ b/packages/server/package.json @@ -1,6 +1,6 @@ { "name": "@modelcontextprotocol/server", - "version": "2.4.0", + "version": "2.5.0", "description": "Model Context Protocol implementation for TypeScript - Server package", "license": "Apache-2.0", "author": "Anthropic, PBC (https://anthropic.com)",