@modelcontextprotocol/server@2.1.0

MCP TypeScript SDK releases published @modelcontextprotocol/server@2.1.0. This release-watch entry was generated from the project's official GitHub release feed and is kept separate from human-reviewed editorial analysis. Release notes: Minor Changes 1624 6032170 Thanks @SamMorrowDrums ! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient scope response. requireScopes provides a small helper for static all-of checks. createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The challenge's WWW-Authenticate header is built by the same formatter as the bearer-auth 401/403 answers, and its resource metadata parameter is derived from the verified AuthInfo : requireBearerAuth /…

• Review the official MCP TypeScript SDK releases release notes before upgrading.
• Check compatibility, migration, and security notes against your current agent stack.
• Run focused regression tests before production rollout.