@modelcontextprotocol/node@2.1.0
MCP TypeScript SDK (@modelcontextprotocol/node@2.1.0) adds request-time OAuth scope challenges for MCP primitives and introduces body size/batch limits to mitigate denial of service.
原始内容为英文；当前页面提供中文导航与来源说明，具体事实请以原文为准。
为什么值得关注
Minor release @modelcontextprotocol/node@2.1.0 introduces granular OAuth scope challenges across MCP primitives and body/batch constraints on HTTP transports. Key updates include: - Request-Time OAuth Scope Challenges: Tools, resources, resource templates, and prompts can define a scopeChallenge callback taking parsed requests and verified auth info. If scopes are insufficient, createMcpHandler and Streamable HTTP transports return HTTP 403 before execution. A requireScopes helper is provided. The AuthInfo object now contains an optional resourceMetadataUrl . - Streamable HTTP Request Limits: All SDK-owned HTTP body reads now default to a 4 MiB maximum ( DEFAULT MAX REQUEST BODY SIZE ), returning HTTP 413 ( RequestBodyTooLargeError ) when exceeded. This is configurable via maxRequestBodySize . Callers pre-parsing bodies via parsedBody bypass the read limit. - JSON-RPC Batch Limits: Batch arrays are capped at 100 messages, rejecting larger batches with 400 / -32600. - Pre-parsing Security: createMcpHonoApp and createMcpExpressApp now validate Host/Origin headers prior to parsing JSON bodies, returning 403 instead of 400 for unauthorized origins without reading the payload. - Dependency updates: Updated to @modelcontextprotocol/server@2.1.0 .
可执行摘要
The 2.1.0 release introduces OAuth scope challenges (HTTP 403 preflight with WWW-Authenticate) for tools, resources, templates, and prompts via scopeChallenge callbacks and requireScopes. It also enforces a default 4 MiB body read limit across Streamable HTTP transports, a 100-message limit on JSON-RPC batch arrays, and moves Host/Origin validation before body parsing in Hono/Express adapters.
- Agent 实用度
- 82/100
- 可信度
- 96%
- 机器格式
- JSON + Markdown
开发者应核对什么
- Verify whether incoming HTTP payloads exceed the new 4 MiB default body limit, and configure maxRequestBodySize if larger requests are required.
- Ensure batch requests do not exceed 100 JSON-RPC messages to prevent 400 / -32600 errors.
- Adopt scopeChallenge or requireScopes on tools, resources, and prompts where granular OAuth authorization is needed.
- Update custom implementations calling toWebRequest to properly catch RequestBodyTooLargeError.