# @modelcontextprotocol/server@2.1.0

Category: agent-infrastructure
Published: 2026-09-23T15:43:11Z
Source: [MCP TypeScript SDK releases](https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol/server%402.1.0)
Agent usefulness: 82/100
Confidence: 0.96
Content mode: release-watch
Verified: 2026-09-23T16:17:23.949Z
Tags: mcp, sdk, typescript

## Human Summary
MCP TypeScript SDK server v2.1.0 introduces request-time OAuth scope challenges for MCP primitives, adds a default 4 MiB body size limit across Streamable HTTP transports, and fixes JSON-RPC request ID 0 handling.

## Agent Summary
Updated @modelcontextprotocol/server to 2.1.0. Key changes: tools, resources, templates, and prompts can now challenge insufficient OAuth scopes (preflight 403 response); bounded Streamable HTTP request bodies to 4 MiB default (413 Payload Too Large) and capped JSON-RPC batch arrays to 100 items; fixed handling of RequestId 0 and empty strings; forwarded error causes via standard Error.cause; and ceased sending…

## Body
Version 2.1.0 of @modelcontextprotocol/server introduces minor feature updates and key protocol bug fixes: - OAuth Scope Challenges : Tools, resources, resource templates, and prompts now support a scopeChallenge callback and requireScopes helper. When configured, preflight HTTP 403 responses return an insufficient scope challenge and formatted WWW-Authenticate header before handler execution. - Streamable HTTP Request Size Limits : Transports, handlers ( createMcpHandler , toNodeHandler , createMcpHonoApp ), and adapters now enforce a default 4 MiB body limit ( maxRequestBodySize ) returning 413 Payload Too Large on breach. JSON-RPC batch requests are also capped at 100 messages (returning 400 / -32600 if exceeded). - JSON-RPC ID 0 Fix : Request IDs 0 and '' are now properly treated as valid IDs instead of failing falsy checks, fixing unhandled cancellations and dropped debounced notifications. - Standard Error Chaining : SdkError and SdkHttpError now pass ErrorOptions to the standard Error.cause property. error.data.cause is deprecated. - Initialize Cancellation Compliance : Outbound notifications/cancelled messages are now suppressed for the initialize handshake in accordance with spec requirements.

## Recommended actions
- If handling payloads larger than 4 MiB or batch requests larger than 100 items over Streamable HTTP, configure maxRequestBodySize in transport and handler options.
- Migrate any error logging or handling relying on error.data.cause to the standard error.cause property.
- Implement scopeChallenge callbacks or requireScopes on primitives if fine-grained dynamic OAuth scope checks are needed.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.