Issues

• Client auth(): concurrent 401s refresh with the same refresh token, and invalid_grant is rethrown instead of re-authorizing

  modelcontextprotocol/typescript-sdk#2915 · Filter by author seidnerj opened on Oct 1, 2026

• mediaTypeEssence() returns a joined-duplicate Content-Type as the essence instead of no essence

  v1v2
  modelcontextprotocol/typescript-sdk#2895 · Filter by author feiiiiii5 opened on Sep 29, 2026
  1

• [v2][Enhancement][Fix Proposed] McpServer input validation error hook

  v1v2
  modelcontextprotocol/typescript-sdk#2879 · Filter by author CyberStrike opened on Sep 27, 2026

• [v2] createMcpHandler: subscriptions/listen streams have no lifetime bound, so every serverless invocation serving one is killed by the platform

  v2
  modelcontextprotocol/typescript-sdk#2873 · Filter by author mcoleborne opened on Sep 25, 2026
  4

• Unconditional prompt=consent (when offline_access in scope) blocks OAuth in Entra tenants with user consent disabled + admin consent granted

  v1v2
  modelcontextprotocol/typescript-sdk#2867 · Filter by author sonmaximum opened on Sep 25, 2026
  1

• discoverOAuthProtectedResourceMetadata validation errors are silently swallowed, leaving no signal when PRM is malformed

  v1v2
  modelcontextprotocol/typescript-sdk#2866 · Filter by author sonmaximum opened on Sep 25, 2026
  1

• workerd schema preload adds about 10 MiB cold heap in client + server bundle

  v2
  modelcontextprotocol/typescript-sdk#2865 · Filter by author zackbart opened on Sep 25, 2026
  1

• StdioClientTransport: explicit Path in env is ignored on Windows (inherited PATH wins)

  v1v2
  modelcontextprotocol/typescript-sdk#2859 · Filter by author ohad6k opened on Sep 24, 2026
  1

• [v1.x] Unknown custom formats spam console on listTools (e.g. google-duration)

  v1v2
  modelcontextprotocol/typescript-sdk#2855 · Filter by author senorMk opened on Sep 24, 2026
  3

• Ajv defaults: non-standard "format": "json" in third-party schemas (e.g. Notion) warns twice per property — register it like #2601

  v1v2
  modelcontextprotocol/typescript-sdk#2854 · Filter by author Shallow-dusty opened on Sep 24, 2026
  1

• withOAuth attaches the OAuth Bearer token to any request URL (no origin/resource check) -> cross-origin credential disclosure

  v1v2
  modelcontextprotocol/typescript-sdk#2851 · Filter by author bupt-Yy-young opened on Sep 24, 2026

• createMcpHandler is validation-free; bare fetch mounts can skip the Host/Origin guards the framework helpers install |

  v2
  modelcontextprotocol/typescript-sdk#2844 · Filter by author tiagovilasboas opened on Sep 22, 2026
  1

• createMcpExpressApp / createMcpHonoApp: non-loopback host silently skips Host/Origin checks (only 0.0.0.0/:: warn) |

  v1v2
  modelcontextprotocol/typescript-sdk#2843 · Filter by author tiagovilasboas opened on Sep 22, 2026
  3

• PKCE verification: 2025-11-25 requires refusing when code_challenge_methods_supported is absent, which conflicts with the #832 / #992 resolution

  v1v2
  modelcontextprotocol/typescript-sdk#2831 · Filter by author ntotten opened on Sep 18, 2026

• [v2] Server-side hook for subscriptions/listen resource subscriptions (attach/detach per URI)

  enhancement
  modelcontextprotocol/typescript-sdk#2827 · Filter by author j0hanz opened on Sep 17, 2026
  2

• Add first-class SEP-2640 Skills extension APIs

  v1v2
  modelcontextprotocol/typescript-sdk#2798 · Filter by author tobi-oye opened on Sep 12, 2026

• skills/list, skills/get, resources/directory/read always fail: codec strips resultType before re-validating it

  v2
  modelcontextprotocol/typescript-sdk#2789 · Filter by author Sonander opened on Sep 11, 2026
  1

• A handler that throws McpError produces a double-prefixed message on the client

  v1
  modelcontextprotocol/typescript-sdk#2786 · Filter by author chrikrah opened on Sep 10, 2026
  4

• Auth metadata discovery: fallback URL built on resource host instead of authorization-server host

  v1v2
  modelcontextprotocol/typescript-sdk#2784 · Filter by author sahil7886 opened on Sep 10, 2026
  1

• Auth metadata discovery: fallback only triggers on 404, misses 401/403

  v1v2
  modelcontextprotocol/typescript-sdk#2783 · Filter by author sahil7886 opened on Sep 10, 2026
  1

• OAuth client_secret comparison in clientAuth.ts is not constant-time

  v1v2
  modelcontextprotocol/typescript-sdk#2780 · Filter by author Rahul-s-007 opened on Sep 10, 2026

• Where does validation of a peer's declarations belong? Four things the client accepts today

  v1v2
  modelcontextprotocol/typescript-sdk#2777 · Filter by author BerkantACUN opened on Sep 9, 2026
  1

• stderr: 'pipe' deadlocks the session if the consumer never reads transport.stderr

  v1v2
  modelcontextprotocol/typescript-sdk#2776 · Filter by author BerkantACUN opened on Sep 9, 2026
  3

• Transport errors are reported only on onerror; awaiting callers always get "MCP error -32000: Connection closed"

  v1v2
  modelcontextprotocol/typescript-sdk#2775 · Filter by author BerkantACUN opened on Sep 9, 2026
  3

• authorizationHandler drops the OAuth state parameter on error redirects

  v1v2
  modelcontextprotocol/typescript-sdk#2773 · Filter by author Ssavan99 opened on Sep 9, 2026
  1