1.15.0

What's Changed

Note

This release reverts a breaking change introduced in version 1.13.3.

• Allow custom fetch in SSEClientTransport and StreamableHTTPClientTransport by @cliffhall in #721
• Revert "fix: add type safety for tool output schemas in ToolCallback" by @sushichan044 in #725
• bump version to 1.15.0 by @bhosmer-ant in #730

Full Changelog: 1.14.0...1.15.0

1.14.0

What's Changed

Warning

This introduces breaking changes, which are required to comply with the spec - more details

• Rename reject to decline by @ihrpr in #727
• 1.14.0 by @ihrpr in #728

Full Changelog: 1.13.3...1.14.0

1.13.3

What's Changed

• Implement DNS Rebinding Protections per spec by @ddworken in #565
• fix lint by @ihrpr in #704
• fix: add missing eventsource-parser dependency by @domnit in #424
• fix: add windows env PROGRAMFILES, avoid some exe can not be found by @muzea in #386
• add overloads for registerResource method in McpServer class by @kentcdodds in #661
• fix: extra headers when they are a Headers object by @garciasdos in #571
• fix: missing "properties" property in empty schema by @sinedied in #598
• fix: Expose the MCP child process PID as an accessible property in StdioClientTransport by @XiaofuHuang in #455
• fix: add type safety for tool output schemas in ToolCallback by @sushichan044 in #670
• doc minimum node version requirment by @marcopeg in #463
• docs: add error handling when it fails to start HTTP server by @formulahendry in #371
• Added Sampling Example to README by @RishiNandha in #698
• Returning undefined from discoverOAuthMetadata for CORS errors by @geelen in #717
• Bump version to 1.13.3 by @ihrpr in #719

New Contributors 🙏

• @ddworken made their first contribution in #565
• @domnit made their first contribution in #424
• @muzea made their first contribution in #386
• @kentcdodds made their first contribution in #661
• @garciasdos made their first contribution in #571
• @sinedied made their first contribution in #598
• @XiaofuHuang made their first contribution in #455
• @sushichan044 made their first contribution in #670
• @marcopeg made their first contribution in #463
• @formulahendry made their first contribution in #371
• @RishiNandha made their first contribution in #698

Full Changelog: 1.13.2...1.13.3

1.13.2

What's Changed

• Fix /.well-known/oauth-authorization-server dropping path by @calclavia in #687
• Fallback for /.well-known/oauth-authorization-server dropping path by @ihrpr in #692
• [auth] refactor resource selection to not include resource if PRM is not present by @pcarleton in #693
• fix: skip validation if tool reports error by @Areo-Joe in #655
• feat(shared/auth): support software_statement in OAuthClientMetadata by @chrisdickinson in #696
• Show session id per request in simpleStreamableHttp example server by @cliffhall in #640
• Raw request propagation in tools - passed to callbacks via RequestHandlerExtra<ServerRequest, ServerNotification> by @KKonstantinov in #627
• Update readme file to include a tip to allow mcp-session-id in CORS when using StreamableHTTP by @Achintha444 in #633
• Pr/protocol overwriting transport hooks by @nichtsam in #477
• docs: Add clarifying comments for stateless streamable HTTP endpoints by @dhodun in #542
• Bump formidable from 3.5.2 to 3.5.4 in the npm_and_yarn group across 1 directory by @dependabot in #428
• test(server): add more tests for SSEServerTransport class by @christian-bromann in #391
• Update version of the package to 1.13.2 by @ihrpr in #701

New Contributors 🙏

• @calclavia made their first contribution in #687
• @Areo-Joe made their first contribution in #655
• @KKonstantinov made their first contribution in #627
• @Achintha444 made their first contribution in #633
• @nichtsam made their first contribution in #477
• @dhodun made their first contribution in #542
• @christian-bromann made their first contribution in #391

Full Changelog: 1.13.1...1.13.2

1.13.1

What's Changed

• simpleStreamableHttp: fix example code by @ochafik in #660
• build: add watching script targets for build & simple streamable http server by @ochafik in #663
• feat: remove console statements from SDK code by @ashwin-ant in #668
• [auth] adjust default validation for resource parameter in client flow, and server example by @pcarleton in #664
• fix(client/sse): extract protected resource from eventsource 401 by @chrisdickinson in #675
• 1.13.1 by @ihrpr in #683

Full Changelog: 1.13.0...1.13.1

1.13.0

🚀 Implementation for Spec revision 2025-06-18

https://github.com/modelcontextprotocol/modelcontextprotocol/releases/tag/2025-06-18

• feat: implement MCP-Protocol-Version header requirement for HTTP transport by @ochafik in #614
• Rename ResourceReference to ResourceTemplateReference by @ihrpr in #619
• Adds _meta to additional interface types by @ihrpr in #630
• Add title to tools, resources, prompts by @ihrpr in #631
• Add support for resource link by @ihrpr in #632
• Include context into completions by @ihrpr in #634
• Add missing _meta fields to match spec requirements by @felixweinberger in #636
• Introduce Elicitation capability by @ihrpr in #520
• update _meta usage guidance in types.ts by @bhosmer-ant in #639
• Jerome/fix/dev oauth server required scopes change by @jerome3o-anthropic in #629
• remove hasCustomTitle by @ihrpr in #645
• update latest protocol version by @ihrpr in #643
• change version by @ihrpr in #647
• RFC 8707 Resource Indicators Implementation by @ochafik in #638
• rename decline to reject by @ihrpr in #657

New Contributors 🙏

• @ochafik made their first contribution in #614
• @felixweinberger made their first contribution in #636

Full Changelog: 1.12.3...1.13.0

1.12.3

What's Changed

• 1.12.3 by @ihrpr in #623

Full Changelog: 1.12.2...1.12.3

1.12.2

What's Changed

• fix: Ensure completions capability is registered on setCompletionRequestHandler call by @fredericbarthelet in #546
• fixes metadata for listed resources from resource templates so that they favor their own metadata by @carlpeaslee in #574
• Adding tests to prevent regressions for: fixes metadata for listed resources from resource templates so that they favor their own metadata by @ihrpr in #621

New Contributors

• @carlpeaslee made their first contribution in #574

Full Changelog: 1.12.1...1.12.2

1.12.1

What's Changed

• chore: fix typo by @Skn0tt in #315
• Add request init headers defined on the sse transport on the start phase by @danielgek in #538
• fix: Ensure _meta object is not lost when onprogress option is passed by @daidi in #560

New Contributors

• @Skn0tt made their first contribution in #315
• @danielgek made their first contribution in #538
• @daidi made their first contribution in #560

Full Changelog: 1.12.0...1.12.1

1.12.0

Authorization spec: DRAFT-2025-v2 🔐 🚀

• feat: Add support for separate Authorization Server / Resource server in server flow (spec: DRAFT-2025-v2) by @pcarleton in #503
• Feat: Separate authorization server and resource server on client auth flow by @0Itsuki0 in #416
• Example Auth client by @ihrpr in #526

Other changes

• Add support for message field in progress notifications by @bhosmer-ant in #502
• Fix Ajv import compatibility issue by downgrading to v6 by @bhosmer-ant in #517
• fix: ProxyOAuthServerProvider: redirect_uri missing in token request by @shubham-lohar in #519
• Save existing refresh_token in store if no new refresh_token is returned by @fredericbarthelet in #483
  #527
• Add state param to OAuth provider by @jescalan in #529
• Fix StreamableHttp example for tool calls - have a separate option for testing notifications resumption by @ihrpr in #534

New Contributors

• @0Itsuki0 made their first contribution in #416
• @shubham-lohar made their first contribution in #519
• @jescalan made their first contribution in #529

Full Changelog: 1.11.4...1.12.0