What's Changed

• Add type compatibility test between SDK and spec types by @ochafik in #729
• Add OIDC ID token support by @dankelleher in #680
• Add prompt=consent for OIDC offline_access scope by @dankelleher in #681
• Non-critical: Readme syntax and typographical error fixes by @freakynit in #765
• make client side client_id generation configurable in the oauth router by @cdaguerre in #734
• Adding invalidateCredentials() to OAuthClientProvider by @geelen in #570
• fix: use authorization_server_url as issuer when fetching metadata by @JoJoJoJoJoJoJo in #763
• feat(protocol): Debounce notifications to improve network efficiancy by @jneums in #746
• fix(731): StreamableHTTPClientTransport Fails to Reconnect on Non-Resumable Streams by @jneums in #732
• fix: consistently use consumer-provided fetch function by @LucaButBoring in #767
• fix client id issuance date should only be sent when generated by @cdaguerre in #775
• 1.16.0 by @ihrpr in #779

New Contributors 🙏

• @dankelleher made their first contribution in #680
• @freakynit made their first contribution in #765
• @cdaguerre made their first contribution in #734
• @JoJoJoJoJoJoJo made their first contribution in #763
• @jneums made their first contribution in #746
• @LucaButBoring made their first contribution in #767

Full Changelog: 1.15.1...1.16.0

What's Changed

• fix(client): Some mcp server need default env(#393, #196) by @sunrabbit123 in #394
• feat: Add CORS configuration for browser-based MCP clients by @jerome3o-anthropic in #713
• Add onsessionclosed hook to StreamableHTTPServerTransport by @jerome3o-anthropic in #743
• add custom headers on initial _startOrAuth call by @anthonjn in #318
• Improve stdio test Windows compatibility and refactor command logic by @HoberMin in #284
• Add missing app.listen error handling to server examples by @ochafik in #749
• fix(server): validate expiresAt token value for non existence by @christian-bromann in #446
• [auth]: support oauth client_secret_basic / none / custom methods by @jaredhanson, @SightStudio, @ochafik in #720
• feat: support async callbacks for onsessioninitialized and onsessionclosed by @jerome3o-anthropic in #751
• Fix oauth well-known paths to retain path and query by @ihrpr in #756
• auth: fetch AS metadata in well-known subpath from serverUrl even when PRM returns external AS by @ochafik in #752

New Contributors

• @sunrabbit123 made their first contribution in #394
• @anthonjn made their first contribution in #318
• @HoberMin made their first contribution in #284

Full Changelog: 1.15.0...1.15.1

What's Changed

• Allow custom fetch in SSEClientTransport and StreamableHTTPClientTransport by @cliffhall in #721
• Revert "fix: add type safety for tool output schemas in ToolCallback" by @sushichan044 in #725
• bump version to 1.15.0 by @bhosmer-ant in #730

Full Changelog: 1.14.0...1.15.0

What's Changed

• Rename reject to decline by @ihrpr in #727
• 1.14.0 by @ihrpr in #728

Full Changelog: 1.13.3...1.14.0

What's Changed

• Implement DNS Rebinding Protections per spec by @ddworken in #565
• fix lint by @ihrpr in #704
• fix: add missing eventsource-parser dependency by @domnit in #424
• fix: add windows env PROGRAMFILES, avoid some exe can not be found by @muzea in #386
• add overloads for registerResource method in McpServer class by @kentcdodds in #661
• fix: extra headers when they are a Headers object by @garciasdos in #571
• fix: missing "properties" property in empty schema by @sinedied in #598
• fix: Expose the MCP child process PID as an accessible property in StdioClientTransport by @XiaofuHuang in #455
• fix: add type safety for tool output schemas in ToolCallback by @sushichan044 in #670
• doc minimum node version requirment by @marcopeg in #463
• docs: add error handling when it fails to start HTTP server by @formulahendry in #371
• Added Sampling Example to README by @RishiNandha in #698
• Returning undefined from discoverOAuthMetadata for CORS errors by @geelen in #717
• Bump version to 1.13.3 by @ihrpr in #719

New Contributors 🙏

• @ddworken made their first contribution in #565
• @domnit made their first contribution in #424
• @muzea made their first contribution in #386
• @kentcdodds made their first contribution in #661
• @garciasdos made their first contribution in #571
• @sinedied made their first contribution in #598
• @XiaofuHuang made their first contribution in #455
• @sushichan044 made their first contribution in #670
• @marcopeg made their first contribution in #463
• @formulahendry made their first contribution in #371
• @RishiNandha made their first contribution in #698

Full Changelog: 1.13.2...1.13.3

What's Changed

• Fix /.well-known/oauth-authorization-server dropping path by @calclavia in #687
• Fallback for /.well-known/oauth-authorization-server dropping path by @ihrpr in #692
• [auth] refactor resource selection to not include resource if PRM is not present by @pcarleton in #693
• fix: skip validation if tool reports error by @Areo-Joe in #655
• feat(shared/auth): support software_statement in OAuthClientMetadata by @chrisdickinson in #696
• Show session id per request in simpleStreamableHttp example server by @cliffhall in #640
• Raw request propagation in tools - passed to callbacks via RequestHandlerExtra<ServerRequest, ServerNotification> by @KKonstantinov in #627
• Update readme file to include a tip to allow mcp-session-id in CORS when using StreamableHTTP by @Achintha444 in #633
• Pr/protocol overwriting transport hooks by @nichtsam in #477
• docs: Add clarifying comments for stateless streamable HTTP endpoints by @dhodun in #542
• Bump formidable from 3.5.2 to 3.5.4 in the npm_and_yarn group across 1 directory by @dependabot in #428
• test(server): add more tests for SSEServerTransport class by @christian-bromann in #391
• Update version of the package to 1.13.2 by @ihrpr in #701

New Contributors 🙏

• @calclavia made their first contribution in #687
• @Areo-Joe made their first contribution in #655
• @KKonstantinov made their first contribution in #627
• @Achintha444 made their first contribution in #633
• @nichtsam made their first contribution in #477
• @dhodun made their first contribution in #542
• @christian-bromann made their first contribution in #391

Full Changelog: 1.13.1...1.13.2

What's Changed

• simpleStreamableHttp: fix example code by @ochafik in #660
• build: add watching script targets for build & simple streamable http server by @ochafik in #663
• feat: remove console statements from SDK code by @ashwin-ant in #668
• [auth] adjust default validation for resource parameter in client flow, and server example by @pcarleton in #664
• fix(client/sse): extract protected resource from eventsource 401 by @chrisdickinson in #675
• 1.13.1 by @ihrpr in #683

Full Changelog: 1.13.0...1.13.1

🚀 Implementation for Spec revision 2025-06-18

https://github.com/modelcontextprotocol/modelcontextprotocol/releases/tag/2025-06-18

• feat: implement MCP-Protocol-Version header requirement for HTTP transport by @ochafik in #614
• Rename ResourceReference to ResourceTemplateReference by @ihrpr in #619
• Adds _meta to additional interface types by @ihrpr in #630
• Add title to tools, resources, prompts by @ihrpr in #631
• Add support for resource link by @ihrpr in #632
• Include context into completions by @ihrpr in #634
• Add missing _meta fields to match spec requirements by @felixweinberger in #636
• Introduce Elicitation capability by @ihrpr in #520
• update _meta usage guidance in types.ts by @bhosmer-ant in #639
• Jerome/fix/dev oauth server required scopes change by @jerome3o-anthropic in #629
• remove hasCustomTitle by @ihrpr in #645
• update latest protocol version by @ihrpr in #643
• change version by @ihrpr in #647
• RFC 8707 Resource Indicators Implementation by @ochafik in #638
• rename decline to reject by @ihrpr in #657

New Contributors 🙏

• @ochafik made their first contribution in #614
• @felixweinberger made their first contribution in #636

Full Changelog: 1.12.3...1.13.0

What's Changed

• 1.12.3 by @ihrpr in #623

Full Changelog: 1.12.2...1.12.3

What's Changed

• fix: Ensure completions capability is registered on setCompletionRequestHandler call by @fredericbarthelet in #546
• fixes metadata for listed resources from resource templates so that they favor their own metadata by @carlpeaslee in #574
• Adding tests to prevent regressions for: fixes metadata for listed resources from resource templates so that they favor their own metadata by @ihrpr in #621

New Contributors

• @carlpeaslee made their first contribution in #574

Full Changelog: 1.12.1...1.12.2