Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@modelcontextprotocol/server@2.3.0

Minor Changes

• #2907 e55f9ac Thanks @claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

Patch Changes

• #2599 5238fba Thanks @freya0926! - A server can now serve, and a client can now call, tasks/get and tasks/cancel of the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only when ctx.era === 'legacy'.

• #2889 4d94e7b Thanks @claude! - registerTool no longer converts tool schemas up front, so a server built per request stops converting every tool on every request. The warning about an invalid x-mcp-header declaration now appears each time tools are listed, not when the tool is registered.

• #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• #2841 2237555 Thanks @sharziki! - McpServer.registerPrompt() now types the callback correctly when no argsSchema is given: its one parameter is the server context. Before, reading ctx.mcpReq there was a type error although it worked at runtime. Prompts registered with an argsSchema are unchanged.

• Updated dependencies [633dd3e]:

  • @modelcontextprotocol/core@2.3.0

@modelcontextprotocol/client@2.3.0

Patch Changes

• #2599 5238fba Thanks @freya0926! - A server can now serve, and a client can now call, tasks/get and tasks/cancel of the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only when ctx.era === 'legacy'.

• #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• #2903 e765b3b Thanks @claude! - With versionNegotiation in 'auto' or pin mode, a server/discover probe answered with a 2xx that carries no usable reply (a body that
  is not JSON under application/json, a bare 204, a missing or unaccepted content type) still rejects connect() with
  EraNegotiationFailed; an empty SSE stream or a 202 surfaces as the probe timeout instead. The message now says
  the server answered with an unusable reply (...) instead of reading like a network failure. To connect to a 2025 server behind a front that
  answers the probe this way, pass connect(transport, { prior: { kind: 'legacy' } }) or use mode: 'legacy'.

• #2905 c0cd01a Thanks @claude! - SSEClientTransport now retries the SSE connection once after onUnauthorized() resolves, as documented. If the retry is also answered with 401, start() rejects with SdkHttpError (ClientHttpAuthentication) instead of calling onUnauthorized() again. A 401 on a later reconnect of a stream that had opened still gets one refresh.

• Updated dependencies [633dd3e]:

  • @modelcontextprotocol/core@2.3.0

@modelcontextprotocol/codemod@2.3.0

Patch Changes

• #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

@modelcontextprotocol/core@2.3.0

Patch Changes

• #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

@modelcontextprotocol/express@2.0.2

Patch Changes

• #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [5238fba, 4d94e7b, e55f9ac, 633dd3e, 2237555]:

  • @modelcontextprotocol/server@2.3.0

@modelcontextprotocol/fastify@2.0.1

Patch Changes

• #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [5238fba, 4d94e7b, e55f9ac, 633dd3e, 2237555]:

  • @modelcontextprotocol/server@2.3.0

@modelcontextprotocol/hono@2.0.2

Patch Changes

• #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [5238fba, 4d94e7b, e55f9ac, 633dd3e, 2237555]:

  • @modelcontextprotocol/server@2.3.0

@modelcontextprotocol/node@2.1.1

Patch Changes

• #2897 7f4c12a Thanks @claude! - hono is now a regular dependency of @modelcontextprotocol/node, so installs with strict peer-dependency checking no longer fail on the hono peer that @hono/node-server requires. No runtime change.

• #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [5238fba, 4d94e7b, e55f9ac, 633dd3e, 2237555]:

  • @modelcontextprotocol/server@2.3.0

@modelcontextprotocol/server-legacy@2.3.0

Patch Changes

• #2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [633dd3e]:

  • @modelcontextprotocol/core@2.3.0

@modelcontextprotocol/core-internal@2.0.3

Patch Changes

• Updated dependencies [633dd3e]:
  • @modelcontextprotocol/core@2.3.0