# @modelcontextprotocol/server@2.1.0

Category: agent-infrastructure
Published: 2026-09-23T15:43:11Z
Source: [MCP TypeScript SDK releases](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fserver%402.1.0)
Agent usefulness: 82/100
Confidence: 0.96
Content mode: release-watch
Verified: 2026-09-24T00:17:24.532Z
Tags: mcp, sdk, typescript

## Human Summary
MCP TypeScript SDK releases published @modelcontextprotocol/server@2.1.0. Minor Changes 1624 6032170 Thanks @SamMorrowDrums ! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns…

## Agent Summary
Treat @modelcontextprotocol/server@2.1.0 as an official release signal. Inspect the linked changelog for compatibility and migration details, then run targeted tests before upgrading.

## Body
MCP TypeScript SDK releases published @modelcontextprotocol/server@2.1.0. This release-watch entry was generated from the project's official GitHub release feed and is kept separate from human-reviewed editorial analysis. Release notes: Minor Changes 1624 6032170 Thanks @SamMorrowDrums ! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient scope response. requireScopes provides a small helper for static all-of checks. createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The challenge's WWW-Authenticate header is built by the same formatter as the bearer-auth 401/403 answers, and its resource metadata parameter is derived from the verified AuthInfo : requireBearerAuth /…

## Recommended actions
- Review the official MCP TypeScript SDK releases release notes before upgrading.
- Check compatibility, migration, and security notes against your current agent stack.
- Run focused regression tests before production rollout.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.