Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@modelcontextprotocol/client@2.0.1

Patch Changes

• #2654 03842cd Thanks @pshah19! - Treat request id 0 as a real id. Two guards tested a RequestId for truthiness, so the legal JSON-RPC ids 0 and '' were read as absent. Id 0 is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first sampling/createMessage, elicitation/create, or roots/list a server sends.

  • notifications/cancelled carrying id 0 was ignored, and the in-flight handler ran to completion with its AbortSignal never fired.
  • A notification sent with relatedRequestId: 0 wrongly passed the debounce gate (for methods opted into debouncedNotificationMethods). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.

  Absent is now the only value that means "no id".

• #2668 3e90449 Thanks @KKonstantinov! - Stop sending notifications/cancelled for the initialize handshake. The spec is explicit that a client MUST NOT attempt to cancel its initialize request, but the outbound cancel path fired for any in-flight request: aborting the AbortSignal passed to connect(), or letting the handshake hit its timeout, put a forbidden cancellation on the wire naming the initialize request id.

  The local behaviour is unchanged — the caller's promise still rejects with the same abort/timeout error, and connect() still tears the connection down. Only the wire notification is suppressed. Every other method keeps the existing cancellation path.

• Updated dependencies []:

  • @modelcontextprotocol/core@2.0.1

@modelcontextprotocol/server@2.0.1

Patch Changes

• #2654 03842cd Thanks @pshah19! - Treat request id 0 as a real id. Two guards tested a RequestId for truthiness, so the legal JSON-RPC ids 0 and '' were read as absent. Id 0 is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first sampling/createMessage, elicitation/create, or roots/list a server sends.

  • notifications/cancelled carrying id 0 was ignored, and the in-flight handler ran to completion with its AbortSignal never fired.
  • A notification sent with relatedRequestId: 0 wrongly passed the debounce gate (for methods opted into debouncedNotificationMethods). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.

  Absent is now the only value that means "no id".

• #2668 3e90449 Thanks @KKonstantinov! - Stop sending notifications/cancelled for the initialize handshake. The spec is explicit that a client MUST NOT attempt to cancel its initialize request, but the outbound cancel path fired for any in-flight request: aborting the AbortSignal passed to connect(), or letting the handshake hit its timeout, put a forbidden cancellation on the wire naming the initialize request id.

  The local behaviour is unchanged — the caller's promise still rejects with the same abort/timeout error, and connect() still tears the connection down. Only the wire notification is suppressed. Every other method keeps the existing cancellation path.

• #2590 75dc7ea Thanks @davidpavlovschi! - Reject a modern (2026-07-28) POST that omits the required MCP-Protocol-Version header.

  createMcpHandler accepted a request whose body carried a valid per-request _meta
  envelope but whose MCP-Protocol-Version header was absent: the request was classified
  modern, dispatched, and answered 200 — tool handlers ran. Only the mismatch case
  (header present, disagreeing with the body) was rejected, so of the standard headers
  SEP-2243 requires on a modern POST, presence was enforced for Mcp-Method (and for
  Mcp-Name on the methods that mirror params.name / params.uri) but not for
  MCP-Protocol-Version.

  Such a request is now refused with 400 Bad Request and JSON-RPC -32020
  (HeaderMismatch), matching the shape the sibling missing-header cells already emit and
  echoing the request id — per the Streamable HTTP spec, which requires the header on every
  POST and lists a missing required standard header as a HeaderMismatch failure. The
  spec's allowance to treat a header-less request as 2025-03-26 is available only to a
  server that also serves pre-2025-06-18 clients, and permits routing it to legacy
  handling — never serving it as 2026-07-28; under legacy: 'reject' the requirement is
  unconditional.

  Era classification is deliberately unchanged and stays body-primary: a proxy that strips
  the header still must not change the era, so such a request is still classified modern
  and is refused one rung later, at standard-header-validation — the same rung that
  already answers a missing Mcp-Method. Legacy-era traffic is untouched, notifications
  are unaffected, body-less GET / DELETE session operations are method-routed before
  any header validation, and stdio serving (which has no HTTP headers) is not involved.

  Clients built with this SDK always send the header, so no first-party client is affected;
  hand-rolled clients that omitted it must add it.

• Updated dependencies []:

  • @modelcontextprotocol/core@2.0.1

@modelcontextprotocol/server-legacy@2.0.1

Patch Changes

• Updated dependencies []:
  • @modelcontextprotocol/core@2.0.1

@modelcontextprotocol/codemod@2.0.1

@modelcontextprotocol/core@2.0.1

@modelcontextprotocol/core-internal@2.0.1

Patch Changes

• #2654 03842cd Thanks @pshah19! - Treat request id 0 as a real id. Two guards tested a RequestId for truthiness, so the legal JSON-RPC ids 0 and '' were read as absent. Id 0 is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first sampling/createMessage, elicitation/create, or roots/list a server sends.

  • notifications/cancelled carrying id 0 was ignored, and the in-flight handler ran to completion with its AbortSignal never fired.
  • A notification sent with relatedRequestId: 0 wrongly passed the debounce gate (for methods opted into debouncedNotificationMethods). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.

  Absent is now the only value that means "no id".

• #2668 3e90449 Thanks @KKonstantinov! - Stop sending notifications/cancelled for the initialize handshake. The spec is explicit that a client MUST NOT attempt to cancel its initialize request, but the outbound cancel path fired for any in-flight request: aborting the AbortSignal passed to connect(), or letting the handshake hit its timeout, put a forbidden cancellation on the wire naming the initialize request id.

  The local behaviour is unchanged — the caller's promise still rejects with the same abort/timeout error, and connect() still tears the connection down. Only the wire notification is suppressed. Every other method keeps the existing cancellation path.

• #2590 75dc7ea Thanks @davidpavlovschi! - Reject a modern (2026-07-28) POST that omits the required MCP-Protocol-Version header.

  createMcpHandler accepted a request whose body carried a valid per-request _meta
  envelope but whose MCP-Protocol-Version header was absent: the request was classified
  modern, dispatched, and answered 200 — tool handlers ran. Only the mismatch case
  (header present, disagreeing with the body) was rejected, so of the standard headers
  SEP-2243 requires on a modern POST, presence was enforced for Mcp-Method (and for
  Mcp-Name on the methods that mirror params.name / params.uri) but not for
  MCP-Protocol-Version.

  Such a request is now refused with 400 Bad Request and JSON-RPC -32020
  (HeaderMismatch), matching the shape the sibling missing-header cells already emit and
  echoing the request id — per the Streamable HTTP spec, which requires the header on every
  POST and lists a missing required standard header as a HeaderMismatch failure. The
  spec's allowance to treat a header-less request as 2025-03-26 is available only to a
  server that also serves pre-2025-06-18 clients, and permits routing it to legacy
  handling — never serving it as 2026-07-28; under legacy: 'reject' the requirement is
  unconditional.

  Era classification is deliberately unchanged and stays body-primary: a proxy that strips
  the header still must not change the era, so such a request is still classified modern
  and is refused one rung later, at standard-header-validation — the same rung that
  already answers a missing Mcp-Method. Legacy-era traffic is untouched, notifications
  are unaffected, body-less GET / DELETE session operations are method-routed before
  any header validation, and stdio serving (which has no HTTP headers) is not involved.

  Clients built with this SDK always send the header, so no first-party client is affected;
  hand-rolled clients that omitted it must add it.

• Updated dependencies []:

  • @modelcontextprotocol/core@2.0.1