fix: call onerror for silently swallowed transport errors

.changeset/README.md

@@ -0,0 +1,6 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works with multi-package repos, or single-package repos to help you version and publish your code. You can find the full documentation for it
+[in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in [our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

.changeset/add-hono-peer-dep.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/node': patch
+---
+
+Add missing `hono` peer dependency to `@modelcontextprotocol/node`. The package already depends on `@hono/node-server` which requires `hono` at runtime, but `hono` was only listed in the workspace root, not as a peer dependency of the package itself.

.changeset/brave-lions-glow.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/node': patch
+---
+
+Prevent Hono from overriding global Response object by passing `overrideGlobalObjects: false` to `getRequestListener()`. This fixes compatibility with frameworks like Next.js whose response classes extend the native Response.

.changeset/busy-weeks-hang.md

@@ -0,0 +1,6 @@
+---
+'@modelcontextprotocol/core': patch
+'@modelcontextprotocol/server': patch
+---
+
+Fix ReDoS vulnerability in UriTemplate regex patterns (CVE-2026-0621)

.changeset/config.json

@@ -0,0 +1,17 @@
+{
+    "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
+    "changelog": ["@changesets/changelog-github", { "repo": "modelcontextprotocol/typescript-sdk" }],
+    "commit": false,
+    "fixed": [],
+    "linked": [],
+    "access": "public",
+    "baseBranch": "main",
+    "updateInternalDependencies": "patch",
+    "ignore": [
+        "@modelcontextprotocol/examples-client",
+        "@modelcontextprotocol/examples-client-quickstart",
+        "@modelcontextprotocol/examples-server",
+        "@modelcontextprotocol/examples-server-quickstart",
+        "@modelcontextprotocol/examples-shared"
+    ]
+}

.changeset/cyan-cycles-pump.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/server': patch
+---
+
+missing change for fix(client): replace body.cancel() with text() to prevent hanging

.changeset/expose-auth-server-discovery.md

@@ -0,0 +1,10 @@
+---
+'@modelcontextprotocol/client': minor
+---
+
+Add `discoverOAuthServerInfo()` function and unified discovery state caching for OAuth
+
+- New `discoverOAuthServerInfo(serverUrl)` export that performs RFC 9728 protected resource metadata discovery followed by authorization server metadata discovery in a single call. Use this for operations like token refresh and revocation that need the authorization server URL outside of `auth()`.
+- New `OAuthDiscoveryState` type and optional `OAuthClientProvider` methods `saveDiscoveryState()` / `discoveryState()` allow providers to persist all discovery results (auth server URL, resource metadata URL, resource metadata, auth server metadata) across sessions. This avoids redundant discovery requests and handles browser redirect scenarios where discovery state would otherwise be lost.
+- New `'discovery'` scope for `invalidateCredentials()` to clear cached discovery state.
+- New `OAuthServerInfo` type exported for the return value of `discoverOAuthServerInfo()`.

.changeset/fix-task-session-isolation.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/core': patch
+---
+
+Fix InMemoryTaskStore to enforce session isolation. Previously, sessionId was accepted but ignored on all TaskStore methods, allowing any session to enumerate, read, and mutate tasks created by other sessions. The store now persists sessionId at creation time and enforces ownership on all reads and writes.

.changeset/funky-baths-attack.md

@@ -0,0 +1,8 @@
+---
+'@modelcontextprotocol/node': patch
+'@modelcontextprotocol/test-integration': patch
+'@modelcontextprotocol/server': patch
+'@modelcontextprotocol/core': patch
+---
+
+remove deprecated .tool, .prompt, .resource method signatures

.changeset/heavy-walls-swim.md

@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/server': patch
+---
+
+reverting application/json in notifications

.changeset/oauth-error-http200.md

@@ -0,0 +1,7 @@
+---
+'@modelcontextprotocol/client': patch
+---
+
+Fix OAuth error handling for servers returning errors with HTTP 200 status
+
+Some OAuth servers (e.g., GitHub) return error responses with HTTP 200 status instead of 4xx. The SDK now checks for an `error` field in the JSON response before attempting to parse it as tokens, providing users with meaningful error messages.

.changeset/respect-capability-negotiation.md

@@ -0,0 +1,14 @@
+---
+'@modelcontextprotocol/client': patch
+---
+
+Respect capability negotiation in list methods by returning empty lists when server lacks capability
+
+The Client now returns empty lists instead of sending requests to servers that don't advertise the corresponding capability:
+
+- `listPrompts()` returns `{ prompts: [] }` if server lacks prompts capability
+- `listResources()` returns `{ resources: [] }` if server lacks resources capability
+- `listResourceTemplates()` returns `{ resourceTemplates: [] }` if server lacks resources capability
+- `listTools()` returns `{ tools: [] }` if server lacks tools capability
+
+This respects the MCP spec requirement that "Both parties SHOULD respect capability negotiation" and avoids unnecessary server warnings and traffic. The existing `enforceStrictCapabilities` option continues to throw errors when set to `true`.

.changeset/shy-times-learn.md

@@ -0,0 +1,8 @@
+---
+'@modelcontextprotocol/node': patch
+'@modelcontextprotocol/test-integration': patch
+'@modelcontextprotocol/server': patch
+'@modelcontextprotocol/core': patch
+---
+
+deprecated .tool, .prompt, .resource method removal

.changeset/tender-snails-fold.md

@@ -0,0 +1,6 @@
+---
+'@modelcontextprotocol/client': patch
+'@modelcontextprotocol/server': patch
+---
+
+Initial 2.0.0-alpha.0 client and server package

.github/pages/_config.yml

@@ -0,0 +1,5 @@
+title: '@modelcontextprotocol/sdk'
+
+# Include generated files and directories which may start with underscores
+include:
+    - '_*'

.github/pages/index.html

@@ -0,0 +1,183 @@
+---
+# Jekyll front matter to enable Liquid templating
+---
+
+<!doctype html>
+<html lang="en">
+    <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <title>MCP TypeScript SDK - API Documentation</title>
+        <meta http-equiv="refresh" content="1; url={{ site.data.latest_version }}/" />
+        <link rel="canonical" href="{{ site.data.latest_version }}/" />
+        <style>
+            * {
+                box-sizing: border-box;
+            }
+            body {
+                font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
+                max-width: 800px;
+                margin: 0 auto;
+                padding: 2rem;
+                line-height: 1.6;
+                color: #333;
+            }
+            h1 {
+                color: #1a1a1a;
+                border-bottom: 2px solid #eee;
+                padding-bottom: 0.5rem;
+            }
+            h2 {
+                color: #444;
+                margin-top: 2rem;
+            }
+            a {
+                color: #0066cc;
+                text-decoration: none;
+            }
+            a:hover {
+                text-decoration: underline;
+            }
+            .redirect-notice {
+                background: #f0f7ff;
+                border: 1px solid #cce0ff;
+                border-radius: 6px;
+                padding: 1rem;
+                margin-bottom: 2rem;
+            }
+            .versions-table {
+                width: 100%;
+                border-collapse: collapse;
+                margin: 1rem 0;
+            }
+            .versions-table th,
+            .versions-table td {
+                text-align: left;
+                padding: 0.75rem;
+                border-bottom: 1px solid #eee;
+            }
+            .versions-table th {
+                background: #f5f5f5;
+                font-weight: 600;
+            }
+            .package-versions {
+                display: none;
+                background: #fafafa;
+                border-radius: 6px;
+                padding: 1rem;
+                margin-top: 1rem;
+            }
+            .package-versions.loaded {
+                display: block;
+            }
+            .package-list {
+                list-style: none;
+                padding: 0;
+                margin: 0;
+            }
+            .package-list li {
+                padding: 0.25rem 0;
+                font-family: monospace;
+                font-size: 0.9rem;
+            }
+            .package-name {
+                color: #666;
+            }
+            .package-version {
+                color: #0066cc;
+                font-weight: 500;
+            }
+            @media (prefers-color-scheme: dark) {
+                body {
+                    background: #1a1a1a;
+                    color: #e0e0e0;
+                }
+                h1 {
+                    color: #fff;
+                    border-bottom-color: #333;
+                }
+                h2 {
+                    color: #ccc;
+                }
+                a {
+                    color: #66b3ff;
+                }
+                .redirect-notice {
+                    background: #1a2a3a;
+                    border-color: #2a4a6a;
+                }
+                .versions-table th {
+                    background: #2a2a2a;
+                }
+                .versions-table td,
+                .versions-table th {
+                    border-bottom-color: #333;
+                }
+                .package-versions {
+                    background: #2a2a2a;
+                }
+                .package-name {
+                    color: #999;
+                }
+            }
+        </style>
+    </head>
+    <body>
+        <h1>MCP TypeScript SDK</h1>
+
+        <div class="redirect-notice">
+            <p>Redirecting to <a href="{{ site.data.latest_version }}/">latest documentation ({{ site.data.latest_version }})</a>...</p>
+        </div>
+
+        <h2>Package Versions</h2>
+        <div id="package-versions" class="package-versions">
+            <p>Loading package versions...</p>
+        </div>
+
+        <h2>All Documentation Versions</h2>
+        <p>Select a version to view its API documentation:</p>
+        <ul id="versions-list">
+            <li><a href="{{ site.data.latest_version }}/">{{ site.data.latest_version }}</a> (latest)</li>
+        </ul>
+
+        <script>
+            // Redirect to latest version
+            setTimeout(function () {
+                window.location.href = '{{ site.data.latest_version }}/';
+            }, 1000);
+
+            // Load and display package versions from versions.json
+            fetch('{{ site.data.latest_version }}/versions.json')
+                .then(function (response) {
+                    if (!response.ok) throw new Error('versions.json not found');
+                    return response.json();
+                })
+                .then(function (data) {
+                    var container = document.getElementById('package-versions');
+                    var html = '<p>Packages included in the latest documentation:</p><ul class="package-list">';
+
+                    for (var pkg in data.packages) {
+                        html +=
+                            '<li><span class="package-name">' +
+                            pkg +
+                            '</span>: <span class="package-version">' +
+                            data.packages[pkg] +
+                            '</span></li>';
+                    }
+
+                    html += '</ul>';
+                    html +=
+                        '<p style="font-size: 0.85rem; color: #666; margin-top: 1rem;">Generated from tag: ' +
+                        data.generated_from_tag +
+                        '</p>';
+
+                    container.innerHTML = html;
+                    container.classList.add('loaded');
+                })
+                .catch(function (err) {
+                    // versions.json may not exist for older docs
+                    document.getElementById('package-versions').style.display = 'none';
+                });
+        </script>
+    </body>
+</html>

.github/workflows/claude-code-review.yml

@@ -0,0 +1,31 @@
+# Source: https://github.com/anthropics/claude-code-action/blob/main/docs/code-review.md
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+
+jobs:
+  claude-review:
+    if: github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          plugin_marketplaces: "https://github.com/anthropics/claude-code.git"
+          plugins: "code-review@claude-code-plugins"
+          prompt: "/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}"

.github/workflows/claude.yml

@@ -0,0 +1,41 @@
+# Source: https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          use_commit_signing: true
+          additional_permissions: |
+            actions: read