The official MCP TypeScript SDK shipped `@modelcontextprotocol/[email protected]` on 2026-09-23 (npm). Headline: request-time `scopeChallenge` callbacks on tools, resources, resource templates, and prompts that return the exact scope set for an `insufficient_scope` challenge; `createMcpHandler` and Streamable HTTP answer HTTP 403 before handler/SSE setup. Patches add a default **4 MiB** request body limit and JSON-RPC batch cap of 100, treat request id `0` as a real id, stop sending `notifications/cancelled` for `initialize`, and enforce `Mcp-Name` on modern tasks routes. For Agent gateways wiring MCP to OAuth resource servers, this is a permissions + DoS hardening minor.

Key Takeaways

  • ✓Shipped: @modelcontextprotocol/[email protected] on GitHub + npm
  • ✓Auth: scopeChallenge/requireScopes (#1624); 403 insufficient_scope per Authorization spec
  • ✓Hardening: 4MiB body default, batch≤100; request id 0 treated as real
  • ✓Protocol: no cancel notify on initialize; Mcp-Name checked on modern tasks routes
  • ✓Docs: MCP architecture + typescript-sdk repo; npm i @modelcontextprotocol/[email protected]
🔗

Project Links & Resources

Direct Access
Direct access to official project resources and documentation
🐙
GitHub Release @modelcontextprotocol/[email protected]
github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fserver%402.1.0
↗
📖
npm @modelcontextprotocol/server 2.1.0
www.npmjs.com/package/@modelcontextprotocol/server/v/2.1.0
↗
🐙
PR #1624 scopeChallenge
github.com/modelcontextprotocol/typescript-sdk/pull/1624
↗
📖
MCP Authorization Spec
modelcontextprotocol.io/specification/2025-11-25/basic/authorization
↗
📖
MCP Architecture Docs
modelcontextprotocol.io/docs/concepts/architecture
↗
🐙
typescript-sdk repository
github.com/modelcontextprotocol/typescript-sdk
↗
🔬

In-Depth Technical Analysis

Core Background & Industry Pain Points

MCP servers behind enterprise OAuth often need per-tool/resource scopes, not only connection-level bearer checks. Unbounded Streamable HTTP body reads invite DoS; treating JSON-RPC id 0 as falsy broke cancel/debounce for the first server→client request. Gateways need finer auth challenges and hard read limits.

Architecture Highlights & Internals

@modelcontextprotocol/[email protected] adds scopeChallenge / requireScopes via #1624, returning HTTP 403 insufficient_scope before handler/SSE. Default 4 MiB body cap and batch≤100; id 0 is real; no cancel notify on initialize; modern tasks validate Mcp-Name vs params.taskId. See Authorization.

Authoritative Benchmarks & Measured Scores

No public latency/throughput board. Validate 403 challenges, 413 on oversized bodies, cancel-on-id-0, and no initialize cancel notify.

Developer Hands-on Guide

npm i @modelcontextprotocol/[email protected] (npm). Attach scopeChallenge/requireScopes, tune maxRequestBodySize, ensure tasks clients send Mcp-Name. Repo: typescript-sdk.