The official MCP TypeScript SDK shipped @modelcontextprotocol/server@2.1.0 on 2026-09-23 (npm). Headline: request-time scopeChallenge callbacks on tools, resources, resource templates, and prompts that return the exact scope set for an insufficient_scope challenge; createMcpHandler and Streamable HTTP answer HTTP 403 before handler/SSE setup. Patches add a default 4 MiB request body limit and JSON-RPC batch cap of 100, treat request id 0 as a real id, stop sending notifications/cancelled for initialize, and enforce Mcp-Name on modern tasks routes. For Agent gateways wiring MCP to OAuth resource servers, this is a permissions + DoS hardening minor.
Key Takeaways
- ✓Shipped: @modelcontextprotocol/server@2.1.0 on GitHub + npm
- ✓Auth: scopeChallenge/requireScopes (#1624); 403 insufficient_scope per Authorization spec
- ✓Hardening: 4MiB body default, batch≤100; request id 0 treated as real
- ✓Protocol: no cancel notify on initialize; Mcp-Name checked on modern tasks routes
- ✓Docs: MCP architecture + typescript-sdk repo; npm i @modelcontextprotocol/server@2.1.0
Key Decision Metrics at a Glance
Turn your technical choice into a development budget
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Core Background & Industry Pain Points
MCP servers behind enterprise OAuth often need per-tool/resource scopes, not only connection-level bearer checks. Unbounded Streamable HTTP body reads invite DoS; treating JSON-RPC id 0 as falsy broke cancel/debounce for the first server→client request. Gateways need finer auth challenges and hard read limits.
Architecture Highlights & Internals
@modelcontextprotocol/server@2.1.0 adds scopeChallenge / requireScopes via #1624, returning HTTP 403 insufficient_scope before handler/SSE. Default 4 MiB body cap and batch≤100; id 0 is real; no cancel notify on initialize; modern tasks validate Mcp-Name vs params.taskId. See Authorization.
Authoritative Benchmarks & Measured Scores
No public latency/throughput board. Validate 403 challenges, 413 on oversized bodies, cancel-on-id-0, and no initialize cancel notify.
Developer Hands-on Guide
npm i @modelcontextprotocol/server@2.1.0 (npm). Attach scopeChallenge/requireScopes, tune maxRequestBodySize, ensure tasks clients send Mcp-Name. Repo: typescript-sdk.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.