{"schemaVersion":"2026-07-21.signal.v2","id":"live-f2fdfa0b161e9113523e","title":"@modelcontextprotocol/server-legacy@2.3.1","slug":"mcp-typescript-sdk-40modelcontextprotocol-2fserver-legacy-402-3-1-modelcontextprotocol-13523e","url":"https://www.niubiagent.com/signals/mcp-typescript-sdk-40modelcontextprotocol-2fserver-legacy-402-3-1-modelcontextprotocol-13523e","jsonUrl":"https://www.niubiagent.com/api/posts/mcp-typescript-sdk-40modelcontextprotocol-2fserver-legacy-402-3-1-modelcontextprotocol-13523e.json","markdownUrl":"https://www.niubiagent.com/content/mcp-typescript-sdk-40modelcontextprotocol-2fserver-legacy-402-3-1-modelcontextprotocol-13523e","summaryHuman":"@modelcontextprotocol/server-legacy 2.3.1 adds an optional expectedResource parameter to requireBearerAuth to validate audience URLs against AuthInfo.resource.","summaryAgent":"In @modelcontextprotocol/server-legacy@2.3.1, requireBearerAuth receives an optional expectedResource parameter matching behavior from @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0. When set, AuthInfo.resource must match expectedResource (ignoring fragments and a trailing slash), otherwise returning a 401 invalid token with WWW-Authenticate.","category":"agent-infrastructure","tags":["mcp","sdk","typescript"],"sourceName":"MCP TypeScript SDK releases","sourceUrl":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fserver-legacy%402.3.1","publishedAt":"2026-10-05T11:49:40Z","curatedAt":"2026-10-05T12:17:56.745Z","confidence":0.96,"agentUsefulness":77,"sponsorIds":[],"language":"en","contentMode":"release-watch","verifiedAt":"2026-10-06T02:17:46.053Z","changeType":"release","actionItems":["Optionally configure expectedResource in requireBearerAuth with the expected audience (typically the server URL) if token audience verification is needed.","Update @modelcontextprotocol/server-legacy to version 2.3.1."],"body":"The patch release for @modelcontextprotocol/server-legacy updates requireBearerAuth to accept an optional expectedResource configuration, aligning it with the 1.x middleware it mimics as well as recent updates in @modelcontextprotocol/server (2.3.0) and @modelcontextprotocol/sdk (1.32.0). If configured, incoming bearer tokens are validated by comparing expectedResource against AuthInfo.resource as strings (ignoring URL fragments and a single trailing slash). Failure or omission of this resource check returns a 401 invalid token error with a WWW-Authenticate header. If unset, existing behavior is preserved. The package remains otherwise frozen, and dependency @modelcontextprotocol/core is updated to 2.3.1.","sponsors":[]}