@modelcontextprotocol/server@2.1.0
MCP TypeScript SDK server v2.1.0 introduces request-time OAuth scope challenges for MCP primitives, adds a default 4 MiB body size limit across Streamable HTTP transports, and fixes JSON-RPC request ID 0 handling.
Why this signal matters
Version 2.1.0 of @modelcontextprotocol/server introduces minor feature updates and key protocol bug fixes: - OAuth Scope Challenges : Tools, resources, resource templates, and prompts now support a scopeChallenge callback and requireScopes helper. When configured, preflight HTTP 403 responses return an insufficient scope challenge and formatted WWW-Authenticate header before handler execution. - Streamable HTTP Request Size Limits : Transports, handlers ( createMcpHandler , toNodeHandler , createMcpHonoApp ), and adapters now enforce a default 4 MiB body limit ( maxRequestBodySize ) returning 413 Payload Too Large on breach. JSON-RPC batch requests are also capped at 100 messages (returning 400 / -32600 if exceeded). - JSON-RPC ID 0 Fix : Request IDs 0 and '' are now properly treated as valid IDs instead of failing falsy checks, fixing unhandled cancellations and dropped debounced notifications. - Standard Error Chaining : SdkError and SdkHttpError now pass ErrorOptions to the standard Error.cause property. error.data.cause is deprecated. - Initialize Cancellation Compliance : Outbound notifications/cancelled messages are now suppressed for the initialize handshake in accordance with spec requirements.
Actionable summary
Updated @modelcontextprotocol/server to 2.1.0. Key changes: tools, resources, templates, and prompts can now challenge insufficient OAuth scopes (preflight 403 response); bounded Streamable HTTP request bodies to 4 MiB default (413 Payload Too Large) and capped JSON-RPC batch arrays to 100 items; fixed handling of RequestId 0 and empty strings; forwarded error causes via standard Error.cause; and ceased sending…
- Agent usefulness
- 82/100
- Confidence
- 96%
- Canonical data
- JSON + Markdown
What builders should check
- If handling payloads larger than 4 MiB or batch requests larger than 100 items over Streamable HTTP, configure maxRequestBodySize in transport and handler options.
- Migrate any error logging or handling relying on error.data.cause to the standard error.cause property.
- Implement scopeChallenge callbacks or requireScopes on primitives if fine-grained dynamic OAuth scope checks are needed.