build(deps-dev): bump typescript-eslint from 8.64.0 to 8.65.0 - #3136
Merged
mcp-commander[bot] merged 1 commit intoJul 27, 2026
Merged
Conversation
Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.64.0 to 8.65.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: typescript-eslint dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
Automatically approved under the dev-patch-minor Dependabot policy: all commits are dependabot-authored with verified signatures, changed files are within package.json, package-lock.json, every update is direct:development semver-patch/minor, and CI is green.
mcp-commander
Bot
deleted the
dependabot/npm_and_yarn/typescript-eslint-8.65.0
branch
July 27, 2026 09:53
subhashpolisetti
added a commit
to subhashpolisetti/modelcontextprotocol
that referenced
this pull request
Aug 7, 2026
updateSummaryFromStaleness was called without await, so process()
returned summaryData before it was written. Proposal and accepted SEPs
lost their entries outright; draft and in-review raced. Runs pinged
authors and closed proposals while the digest reported no activity.
await alone is not enough. The method re-ran analyzer.analyze() to
rebuild state the caller already had, and by then executePing had
posted a bot comment, so the second pass took the ping cooldown branch
and returned shouldClose false with a null pingTarget.
Thread the analysis down from checkStaleness and read the recipient
from result.action.targetUser, as the maintainer accountability block
already does. The method drops async, getTargetUser is now unused, and
each stale SEP costs three fewer API calls.
processor.ts had no tests; adds coverage for all four summary branches.
Merge pull request #3133 from koic/blog-ruby-sdk-1-0
Add blog post announcing Ruby SDK 1.0
Merge pull request #3204 from maxiboch/patch-1
docs: add Maxi Boch to Tool Annotations IG membership
docs: add Maxi Boch to Tool Annotations IG membership
Adds myself as a Participant, per the onboarding step in the IG meeting notes.
I'm contributing the io.modelcontextprotocol/display-templates extension proposal in the experimental-ext-tool-annotations repo.
Merge pull request #3200 from LucaButBoring/feat/agents-wg-charter
docs: add Agents WG charter
Merge pull request #3199 from modelcontextprotocol/davidsp/aldridge-emeritus
Move Nick Aldridge to Core Maintainer Emeritus
Move Nick Aldridge to Core Maintainer Emeritus
No-Verification-Needed: docs-only maintainer roster update
docs: add Agents WG charter
Add blog post announcing Ruby SDK 1.0
Announce the first stable release of the MCP Ruby SDK: a stable public API
under the Semantic Versioning policy, a 100% server and client conformance
pass rate, and the Tier 2 assessment (#3127).
If accepted, this post is intended to be published after #3128, which moves
the Ruby SDK to Tier 2 in the official SDK listing, is merged.
Merge pull request #3195 from modelcontextprotocol/dependabot/npm_and_yarn/npm_and_yarn-f5a5c7d1ef
Bump undici from 7.28.0 to 7.29.0 in the npm_and_yarn group across 1 directory
Bump undici in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici).
Updates `undici` from 7.28.0 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v7.28.0...v7.29.0)
---
updated-dependencies:
- dependency-name: undici
dependency-version: 7.29.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
docs: rewrite the MCP Inspector documentation for v2 (#3143)
* docs: rewrite the Inspector documentation for v2
Replaces the single legacy-era Inspector page with a folder of pages
covering the three clients (web, CLI, TUI) behind one mcp-inspector
binary, and the legacy vs. modern (2026-07-28) protocol-era fork that
now drives most of the tool's behavior.
New pages under docs/tools/inspector/:
- protocol-eras the era setting and negotiation, then the fork feature
by feature: logging, resource subscriptions, tasks,
MRTR, x-mcp-header mirrored params and excluded tools,
and the Mcp-* header / error taxonomy. Each section
names the test-servers config that reproduces it.
- web tab-by-tab walkthrough, session token, monitoring
sidebar, server settings, deep links.
- cli method reference, argument coercion, output formats,
app probing, exit codes and error envelopes, CI recipes.
- tui tabs, keyboard reference, loopback OAuth.
- configuration the launcher/client flag split, catalog vs. config,
the -- separator, and every environment variable
attributed to the layer that reads it.
- authorization the OAuth flow end to end, callback URLs, mid-session
re-authorization and step-up, non-interactive runs,
and the web-to-CLI token handoff.
- recipes transports, importing client configs, reviewing an
MCP App, Docker, and hosting on a network.
/docs/tools/inspector keeps its URL as the overview page; the subpages
are nested under it in the Developer tools navigation group.
Screenshot slots are marked with TODO captions and are still to be
captured.
Refs modelcontextprotocol/inspector#1803
* docs: add Inspector screenshots
Captures 21 screenshots against the repo's composable test servers, so
every era-fork claim in the prose has a picture that reproduces from a
named config:
- protocol eras: the era selector, the Logs fork (session-scoped Set
Active Level vs. per-request Log Level), the modern subscription
LISTENING badge, the Tasks fork (tasks/list + blocking result vs.
polled handles with an inlined result), an MRTR round paused at the
pending-request modal, the SEP-2243 mirrored-header panel beside the
struck-through excluded tool, and a -32022 rendered in both the
Network and Protocol views
- web: tab bar, monitoring sidebar, server settings, tools, resources,
prompts, apps, protocol
- tui: Tools and Auth tabs
- authorization: Connection Info after a completed OAuth flow
Web and OAuth shots are driven headlessly through Playwright; the TUI
shots are captured from a real pty and replayed through a terminal
emulator, so they keep their colors. All were taken against an isolated
HOME so no real catalog or token appears.
The hero image now shows the v2 client instead of the v1 screenshot.
The one shot not captured is the mid-session re-authorization banner:
the test authorization server grants every configured scope on the
initial DCR exchange, so no step-up fires. That frame is omitted rather
than faked.
Refs modelcontextprotocol/inspector#1803
* docs: correct what a freshly seeded catalog contains
The seed is not empty everywhere — it differs by client, and the pages
flattened both cases into "seeded empty".
The web backend seeds a writable catalog with two sample servers
(DEFAULT_SEED_CONFIG in core/mcp/serverList.ts): a filesystem server
scoped to /tmp and the everything reference server, so a first launch
has something to connect to. The CLI and TUI seed an empty mcpServers
object instead (seedEmptyCatalog in core/mcp/node/config.ts).
Verified both by running each surface against a throwaway HOME rather
than reading the code alone.
A read-only --config is still never seeded on any surface.
Refs modelcontextprotocol/inspector#1803
* docs: drop "fork" wording from the Inspector docs
Addresses review feedback from @BobDickinson and @olaservo: "fork" was
used to mean "the legacy/modern split", which collides with its git
meaning. Every use is now phrased in terms of protocol eras, matching
the `protocolEra` config field and the Protocol Era selector in the UI.
Also reframes the "Reproducing each era locally" section so it reads as
setup for the per-feature "Reproduce with ..." pointers rather than a
non-sequitur, and replaces one remaining "the 2026-07-28 leg" jargon.
* docs: address review feedback on the Inspector docs
- Tighten the Node/npx and server-README sentences in the Inspector index
- Move Protocol eras after the client and configuration pages, in both the
navigation and the "Where to go next" cards — it only makes sense once the
basics are understood
- Drop the client-side-negotiation implementation detail in favour of the
takeaway: era selection behaves the same in all three clients
- Explain the -32602 error panels in relation to legacy rendering, and stop
implying the difference is isError vs. JSON-RPC error
* Update docs/docs/draft/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/configuration.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/configuration.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/configuration.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/configuration.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/cli.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/web.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/web.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/configuration.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/web.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/web.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/web.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/web.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/web.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/web.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/web.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/configuration.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/configuration.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/recipes.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector/recipes.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector/configuration.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/draft/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Update docs/docs/2026-07-28/tools/inspector.mdx
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
* Apply review suggestions to Inspector v2 docs
Editorial pass across the eight Inspector pages, applied to both the
draft and 2026-07-28 copies: clearer first-use bridging from the npx
command to the mcp-inspector binary, definitions and cross-links for
protocol era, MRTR, roots, MCP Apps, CIMD, and the session token, plus
corrections where the prose drifted from the current draft (serverInfo
now rides in the result _meta, the -32021 client-capability wording, the
401 WWW-Authenticate resource_metadata description, and the optional legacy
session id). Also fixes the CI recipe whose exit-code branch could never
fire, and swaps the marked em dashes, unicode arrows, ellipsis glyphs,
curly quotes, and bold-lead list walls for plain ASCII prose. A number
of remaining dashes still need the page-wide sweep called out in review.
No-Verification-Needed: docs-only prose changes
:house: Remote-Dev: homespace
* Sweep remaining em dashes and unicode glyphs from Inspector docs
Finish the page-wide pass the review called for: replace the remaining
em dashes, unicode arrows, and ellipsis glyphs with plain ASCII
punctuation (commas, colons, semicolons, or parentheses as the sentence
reads), including inside Frame captions and code samples, and spell out
the placeholder table cells as None. Applied identically to the draft and
2026-07-28 copies.
No-Verification-Needed: docs-only prose changes
:house: Remote-Dev: homespace
* Quote tui.mdx description containing a colon
The unquoted YAML value with a colon after 'Inspector' failed frontmatter parsing and broke the Mintlify deploy. Quote it in both the draft and 2026-07-28 copies, matching cli.mdx.
No-Verification-Needed: docs-only frontmatter fix
:house: Remote-Dev: homespace
---------
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Den Delimarsky <den@anthropic.com>
Add Ruby SDK Tier 2 assessment to SDK listing (#3128)
This refers to assessment report https://github.com/modelcontextprotocol/modelcontextprotocol/issues/3127.
The Ruby SDK is currently at tier 2 in the assessment and development toward tier 1 is ongoing.
Merge pull request #3159 from DaleSeo/docs/sep-2575-identity-metadata
docs: record post-final SEP-2575 changes
Merge pull request #3147 from jhauga/docs
docs/authorization: add 3 csharp copy/paste code-blocks
Apply suggestions from code review
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
docs(registry-wg): remove @tadasant from Registry WG Leads (#3175)
* docs(registry-wg): remove @tadasant from Registry WG leadership
@tadasant is stepping down as Registry WG co-lead; @rdimitrov becomes the
sole Lead. @tadasant remains an MCP maintainer and a Registry WG member,
and stays champion of the Server Card / server.json alignment work item.
Leadership-only change: the Membership row moves from Lead to WG Member
and the Emeritus table is untouched.
* Update registry.mdx
---------
Co-authored-by: Tadas Antanavicius <jon@tadasant.com>
Merge pull request #3186 from neiljar/typo-mcp-docs
fix: correct typos in SEP documents
Merge pull request #3190 from modelcontextprotocol/copilot/remove-disclosure-txt-file
Remove accidental `disclosure.txt` from the repository
Apply remaining changes
Initial plan
docs: remove experimental term from Task docs and repo name. (#3177)
Task is now an official MCP extension with 7-28 release.
Signed-off-by: Sameera Jayasoma <sameera.madushan@gmail.com>
fix: correct typos in SEP documents
Fix misspellings in SEP sources and regenerate the corresponding docs pages.
Merge branch 'main' into docs
fix(scripts): parse wrapped Author(s) lines in render-seps (#3178)
The Author(s) regex used `.` to capture the field value, which does not
match newlines. When an author list wrapped onto an indented continuation
line, every author after the first line was silently dropped from the
generated docs/seps/*.mdx table, leaving a dangling comma in the cell.
Capture the first line plus any indented continuation lines that do not
begin a new list item, and collapse interior whitespace when the value is
used. Regenerated the three affected SEP documents: 2322 (was losing 1 of
3 authors), 1865 (6 of 9), and 2575 (2 of 5).
Co-authored-by: Gabriel Zimmerman <gabez@Gabriels-MacBook-Pro.local>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Merge pull request #3166 from modelcontextprotocol/claude/final-sep-historical-notice
Mark Final SEP pages as historical records
Merge pull request #3116 from jamadeo/jamadeo/correct-error-codes
fix: correct MISSING_REQUIRED_CLIENT_CAPABILITY error code in SEP-2663
Merge pull request #3173 from modelcontextprotocol/fix/issue-3169-versioning-current
docs: state 2026-07-28 as the current protocol version on the versioning page
ci: stamp the current protocol version into learn/versioning.mdx at cut
The promote step rewrites draft-tier links but not the hardcoded dated
version in the Revisions section, which is how the 2026-07-28 copy
shipped naming 2025-11-25 as current. Stamp the new version into the
promoted copy and the draft source, mirroring the existing changelog
rewrite.
docs: state 2026-07-28 as the current protocol version on the versioning page
The learn/versioning page under the 2026-07-28 docs path, and its draft
source, still named 2025-11-25 as the current protocol version. Update
the Revisions section on both to 2026-07-28 to match the rest of the
page.
Fixes #3169
docs: record subscription completion change
docs: record SEP-2575 identity metadata changes
Refactor ResourceMetadata in authorization.mdx
Removed redundant `ResourceMetadata` assignment and updated Resource and `ResourceDocumentation` URIs.
Apply suggestions from code review
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: John Haugabook <johnhaugabook@gmail.com>
Merge branch 'main' into docs
Mark Final SEP pages as historical records
Final SEPs are point-in-time records of the design as accepted. The
protocol can change after a SEP is finalized, so a Final SEP page can
drift from the current specification. SEP-2322 still documents
tasks/result and tasks/input_response even though SEP-2663 removed
them (#3142).
The SEP generator now injects a notice at the top of every Final SEP
page pointing readers to the current specification. The SEP guidelines
now state that Final SEPs are not updated after finalization and that
the current specification is authoritative.
Closes #3142
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XY2THv6f61qBZdC8j7uPZP
Merge pull request #3165 from modelcontextprotocol/fix/quotes-carousel-arrow-drift
Fix blog quotes carousel next arrow stalling before the end on phones
Fix quotes carousel next arrow stalling before the end of the strip
The next arrow derived the page index from scrollLeft divided by the
viewport width while scroll targets were quantized to card starts. On
phone widths each card is 44px narrower than the viewport, so the
deficit grew by 44px per page and after a few pages the derived index
rounded down below the real one. The next click then recomputed the
position the track was already at and the arrow went dead until a prev
click reset the drift.
Position math now works in whole cards, which round-trips exactly
between targets and the derived index and also absorbs the fractional
scrollLeft values Android Chrome reports at non-integer device pixel
ratios. A pending scroll target lets clicks that land during the smooth
scroll animation keep advancing from the intended position instead of a
stale mid-flight scrollLeft.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gUz1xdMLzxdAvXZ6tmV5Y
Merge branch 'main' into docs
Merge pull request #3164 from modelcontextprotocol/claude/posthog-logo-refresh
Update PostHog logo in GA post with light and dark variants
Update PostHog logo in GA post with light and dark variants
PostHog provided refreshed brand SVGs with fixed colors, so the single
currentColor file no longer fits. The quote shortcode gains an optional
logo-dark param that inlines a second SVG, and quotes.css shows one
variant per theme via PaperMod's body.dark toggle. The GA post now uses
posthog.svg in light mode and posthog-white.svg in dark mode.
Co-Authored-By: Claude <noreply@anthropic.com>
Merge pull request #3163 from modelcontextprotocol/claude/fix-3160-date-draft-links
Date remaining draft links in the 2026-07-28 spec tree
Date remaining draft links in the 2026-07-28 spec tree
The cut-release promote step rewrote /specification/draft/ links but
left /docs/draft/ and schema/draft/ links untouched in the promoted
spec tree, so 13 links in docs/specification/2026-07-28/ still pointed
at the living draft tiers. Date all 13 to 2026-07-28, matching the
hand-cut 2025-11-25 snapshot, and extend the workflow so future cuts
rewrite both patterns plus the changelog compare link.
Fixes #3160
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DrwuUqBvFfzvqAFmefi7pU
Merge pull request #3155 from modelcontextprotocol/localden/cut-release-redirect-dedup
Skip existing redirect sources when cutting a release
Merge pull request #3162 from modelcontextprotocol/blog/release-quotes-runlayer-stacklok
Add Runlayer and Stacklok quotes to the 2026-07-28 release post
Add Runlayer and Stacklok quotes to 2026-07-28 release post
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NfLeWYXCrMXtNpV8nMU5vT
docs/authorization: add 3 csharp copy/paste code-blocks
Merge pull request #3161 from modelcontextprotocol/localden/publish-ga-post
Publish the 2026-07-28 specification post
Publish the 2026-07-28 specification post
:house: Remote-Dev: homespace
Merge pull request #3145 from modelcontextprotocol/blog/2026-07-28-ga
Blog: The 2026-07-28 Specification Is Generally Available
Link the getting-started guides in the GA post
Swap the TBD placeholder in the Getting started list for the versioned 2026-07-28 documentation entry point now that the docs are published.
:house: Remote-Dev: homespace
Merge pull request #3158 from modelcontextprotocol/claude/subscriptions-listen-envelope
Align subscriptions/listen result naming and add response envelope
fix(schema): apply subscriptions/listen envelope and MetaObject rename to 2026-07-28
Port the SubscriptionsListenResultMetaObject rename and the
SubscriptionsListenResultResponse envelope from draft into the released
2026-07-28 schema, add the validated example, and regenerate schema.json
and schema.mdx for both versions. Also add 2026-07-28 to the generator's
version list so its schema.json is generated and checked.
Merge pull request #3157 from modelcontextprotocol/localden/docs-typo-redeploy
Fix typo in 2025-11-25 authorization spec
Fix typo in 2025-11-25 authorization spec
Remove the stray "the" in the localhost redirect URI attack steps, matching the wording already used in the draft and 2026-07-28 copies of this page.
:house: Remote-Dev: homespace
schema(draft): align subscriptions/listen with envelope and _meta naming conventions
Fixes #2989
Rename SubscriptionsListenResultMeta to SubscriptionsListenResultMetaObject
to match the MetaObject-suffix convention used by MetaObject,
RequestMetaObject, and NotificationMetaObject, and add the
SubscriptionsListenResultResponse envelope so subscriptions/listen matches
the per-method *ResultResponse pattern used by the other nine request
methods. Adds a listen-closed-response.json example validated against the
new envelope. schema.json and schema.mdx are regenerated.
Merge pull request #3156 from modelcontextprotocol/localden/docs-default-version
Mark 2026-07-28 as the default docs version
Mark 2026-07-28 as the default docs version
Mintlify falls back to guessing the latest version when no entry sets default, and it currently resolves 2025-11-25 even though 2026-07-28 is first. Set default: true on the 2026-07-28 entry in both the Documentation and Specification tabs so the version chooser and the outdated-version banner point at the new release.
:house: Remote-Dev: homespace
Merge pull request #3154 from modelcontextprotocol/release/2026-07-28
Add 2026-07-28 MCP specification
Reformat promoted 2026-07-28 pages after path rewrite
The release promotion rewrites /specification/draft/ and /docs/draft/
paths to their dated equivalents inside the copied pages. The longer
paths push some lines past the 80-column prose wrap, so prettier flags
the promoted copies even though the draft originals are clean. Re-run
prettier over the affected pages so the format check passes; only
line wrapping changes.
:house: Remote-Dev: homespace
Skip redirect sources that already exist when cutting a release
The nav patch step in cut-release adds a dated sibling redirect for
every /specification/draft/... entry, but it never checked whether that
dated source was already present. When main already carries the
<version>/ redirects, the loop appends a second copy of each source and
Mintlify rejects the resulting docs.json for reusing a source path,
which is exactly what broke the 2026-07-28 release PR. Track the
existing sources in a set and skip any collision so the step is
idempotent regardless of what main already contains.
:house: Remote-Dev: homespace
Remove duplicate 2026-07-28 redirects from docs.json
The cut-release nav patch appended a dated sibling for every
/specification/draft/... redirect, but main already carried these five
2026-07-28 entries, so the sources ended up listed twice. Mintlify
rejects a docs.json where a source path is used more than once, which
blocks the deploy for this release PR. Drop the duplicated tail entries;
the original definitions are unchanged.
:house: Remote-Dev: homespace
Add 2026-07-28 MCP specification
Merge pull request #3153 from modelcontextprotocol/claude/redeploy-docs-20260728
Fix PyPI capitalization in registry FAQ
Fix PyPI capitalization in registry FAQ
Drop GA from the post title and slug
Merge pull request #2805 from modelcontextprotocol/docs/2026-07-28-release
Track 2026-07-28 release
Merge pull request #3152 from modelcontextprotocol/claude/pr2805-review-fixes
Rewrite spec links when cutting a release
Update David Soria Parra's quote
Mention the Rust SDK's beta support
Merge pull request #3151 from modelcontextprotocol/claude/sync-main-into-release-0728
Sync main into the 2026-07-28 release branch
Rewrite spec links when promoting draft to a dated version
The promote step now self-dates /specification/draft/ links in the
copied spec, docs, and schema trees.
Merge main into docs/2026-07-28-release
No textual conflicts. Rename detection applied main's server-concepts.mdx wording update (PR #2981) only to the 2025-06-18 copy, so the same edit was propagated by hand to the 2024-11-05, 2025-03-26, 2025-11-25, and draft copies. Main's NumberSchema erratum (PR #3139) applied cleanly to schema/2025-06-18 and schema/2025-11-25. npm run prep is clean.
Merge pull request #3139 from modelcontextprotocol/paulc/2025-11-25-numberschema-erratum
schema: fix NumberSchema numeric fields typed integer in released generated JSON (2025-06-18, 2025-11-25)
Merge pull request #2981 from Uomocapra/codex/clarify-weather-tool-flow
docs: clarify weather tool selection flow
Merge branch 'main' into codex/clarify-weather-tool-flow
Merge pull request #3150 from modelcontextprotocol/claude/pr2805-review-fixes
Address adversarial review feedback on the release tracking PR
Update David Soria Parra's quote
Add Cloudflare quote from Brendan Irvine-Broque
Reformat client concepts feature tables
Prettier realigns the table columns after the elicitation row
removal.
Self-date spec links in the 2025-06-18 and 2025-11-25 guide snapshots
Frozen guide pages linked to /specification/draft/ and
/specification/latest/, so their spec citations would drift as the
draft changes. Rewrite them to each snapshot's own dated spec tree,
drop the tool name validation bullet from the 2025-06-18 tree since
the tool name format section first appears in 2025-11-25, and fix the
2025-11-25 initialize example to negotiate 2025-11-25.
Remove anachronistic content from the two oldest guide snapshots
The 2024-11-05 and 2025-03-26 guides described elicitation and
outputSchema, which first shipped in 2025-06-18. The 2024-11-05 tree
also documented the Streamable HTTP transport, which arrived in
2025-03-26, and both trees showed 2025-06-18 initialize examples.
Strip those sections, set initialize examples to each snapshot's own
protocol version, use HTTP with SSE wording in the 2024-11-05 tree,
and point spec links at each snapshot's own dated spec. Authorization
spec links in the 2024-11-05 tree point at 2025-03-26, the first
revision with an authorization spec.
Extend David Soria Parra's quote
Use the Honeycomb vector logo with theme-aware text
Add David Soria Parra's quote
Point draft spec cross-references at the draft docs tier
Unversioned /docs/tutorials/ and /docs/learn/ links in the draft
spec resolved through catch-all redirects to the frozen 2025-11-25
guides, which lack some of the cited security content. Rewrite all
nine links to /docs/draft/. Also uppercase a normative MUST in the
authorization scope hierarchy requirement.
Fix extensions overview examples to match the draft schema
The server/discover response now includes resultType, ttlMs, and
cacheScope, carries serverInfo in _meta, and advertises 2026-07-28.
The client capabilities example stamps the 2026-07-28 protocol
version instead of 2025-06-18.
Replace OpenAI PNG with theme-switching SVG logo
Replace GIF placeholder with the stateless core demo video
Add Prefect quote from Jeremiah Lowin
Make quote divider overhang symmetric
Use a slash separator in breadcrumbs
Fix horizontal scrollbar from the footer hairline's 100vw breakout
Order quote cards alphabetically by company
Fix carousel backward navigation from the last page
Add placeholder quote card for David Soria Parra
Add Microsoft quote from Tina Schuchman
Add PostHog and Supabase logos to quote cards
Add Google Cloud, Arcade, Netlify, Xero, and Manufact logos to quote cards
Align quote card logos to a shared top line
Add partner logos to quote cards
Add Honeycomb quote from Austin Parker
Remove the quote shortcode's built-in quotation marks around quote text
Simplify quote attributions to plain name, title, company
Merge pull request #3146 from modelcontextprotocol/claude/release-final-sweep-2026-07-28
Sync docs/2026-07-28-release with main for the release (merge commit required)
Add missing periods in build-client and authorization tutorial
Add 2026-07-28 GA announcement post
Merge main into docs/2026-07-28-release
Merge pull request #3141 from modelcontextprotocol/feat/quote-component
Blog: add quotes shortcode for testimonial cards
Merge pull request #3144 from modelcontextprotocol/claude/python-examples-v2-resolved
docs: modernise the Python examples for the 2026-07-28 release
Remove quote component test post
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWbYcGYDQESh3KWwpfoc4V
Bold the attribution name and move the title to its own line
The figcaption now renders the name and title as separate block spans
instead of one "Name, Title" line. The name is 700 in the body text
color, the title stays 400 in the muted secondary color. A quote with
no title renders the name alone. The test post gains a no-title
variant to exercise that path.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWbYcGYDQESh3KWwpfoc4V
Set quote attribution and text-logo fallback to regular weight
PaperMod bolds figure > figcaption, which made the Name, Title line
read too heavy. Override it to font-weight 400 so the attribution is a
quiet secondary line, and drop the 600 weight on the no-logo company
name fallback to match.
Break the quote strip out of the prose column
The quotes row now bleeds horizontally past the post column, capped at
1200px and centered in the viewport, with a slice of the next card
peeking at the right edge whenever more cards exist than fit one view.
The bleed bound leaves a 32px gutter that absorbs the page scrollbar,
so the page never scrolls horizontally. Carousel init now waits for
DOMContentLoaded so every quotes block on a page gets its controls,
and the arrow disabled state follows the actual scroll position.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWbYcGYDQESh3KWwpfoc4V
Merge branch 'docs/2026-07-28-release' into python-examples-v2
Resolves a prose conflict in docs/docs/draft/learn/architecture.mdx by
taking the base branch's discovery-era paragraph, which already subsumes
this branch's removal of the initialization wording.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ffRGFfKafAtUJ4fTYsf7U
Align quote attributions to a shared start line
Cards in a quotes row now adopt the track's explicit logo, quote, and
attribution rows via CSS subgrid, so every attribution starts at the same
line across a row and across carousel pages. Long quotes spill downward
without clamping and short cards keep the open space. Attributions that
wrap do so below the shared line. Browsers without subgrid fall back to
the previous bottom-aligned flex layout. Subgrid is skipped below 600px
where cards render one per view. Test post quotes now vary in length to
show the behavior.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWbYcGYDQESh3KWwpfoc4V
Merge pull request #3138 from modelcontextprotocol/dependabot/npm_and_yarn/tools/sep-automation/npm_and_yarn-6b7f7a8c69
build(deps-dev): bump postcss from 8.5.15 to 8.5.23 in /tools/sep-automation in the npm_and_yarn group across 1 directory
Merge pull request #3134 from modelcontextprotocol/dependabot/github_actions/actions/labeler-7
build(deps): bump actions/labeler from 6 to 7
Merge pull request #3125 from kerlenton/fix/rc-blog-input-required
docs(blog): fix resultType value in 2026-07-28 RC post
Merge pull request #3069 from modelcontextprotocol/claude/rc-stateless-lifecycle
docs: reflect the stateless protocol, server/discover, and session removal
schema: fix 2025-06-18 NumberSchema min/max to number in generated JSON
Same generator artifact as 2025-11-25: schema.ts declares number, the
generated JSON says integer. 2025-06-18 has no default field on
NumberSchema, so only minimum/maximum change.
No-Verification-Needed: JSDoc-only source edit plus script-regenerated schema.json
docs: restore the reviewed serverInfo and clientInfo placement
Reverts d438d8e. Review feedback on this PR asked for the #3002 shape, with serverInfo carried in the result _meta as io.modelcontextprotocol/serverInfo and clientInfo as a SHOULD. The schema on the release branch predates #3002 and main still carries it.
Merge remote claude/rc-stateless-lifecycle, keeping the acknowledgment example
docs: move serverInfo to the discover result body and state required _meta fields
The Discover Response example carried serverInfo under a nonexistent
io.modelcontextprotocol/serverInfo key in the result _meta. The draft
schema defines serverInfo as a required top-level field of
DiscoverResult. The surrounding prose also described clientInfo as
optional, while the schema and the base protocol page mark it required
on every request.
Add quotes shortcode for testimonial cards on the blog
Adds a quotes/quote shortcode pair that renders testimonial cards in a
row with hairline dividers, matching the docs site's design language.
When more quotes than fit one view are given, a scroll-snap carousel
with arrow buttons and pagination dots takes over. A lone quote renders
full width as a pull quote.
Includes a draft test post with fictional companies and original SVG
wordmarks so the component can be reviewed in the PR preview. Drop the
test post before or at merge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWbYcGYDQESh3KWwpfoc4V
Merge docs/2026-07-28-release into claude/rc-stateless-lifecycle
Merge branch 'docs/2026-07-28-release' into claude/rc-stateless-lifecycle
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhtN33k4CMKjzsQL2jd6Z9
Merge pull request #3068 from modelcontextprotocol/claude/rc-server-concepts
docs: document subscriptions/listen and CacheableResult in draft learn and client pages
docs: align Python examples with the v2 SDK client API
schema: fix 2025-11-25 NumberSchema min/max/default to number in generated JSON
The TypeScript source declares these fields as `number`, but
typescript-json-schema emits `integer` without an explicit hint, so the
released 2025-11-25 schema.json rejects fractional values like
`default: 95.5` that the schema.ts source of truth allows. Add the same
@TJS-type annotations #2710 applied to the draft schema and regenerate.
Same shape as 357adac4, which corrected Task.ttl nullability in the
released 2025-11-25 generated schema when it contradicted schema.ts.
No-Verification-Needed: JSDoc-only source edit plus script-regenerated schema.json
docs: note that discovery is a cacheable per-server flow
build(deps-dev): bump prettier from 3.9.5 to 3.9.6 (#3137)
Bumps [prettier](https://github.com/prettier/prettier) from 3.9.5 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.5...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.6
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps-dev): bump eslint from 10.7.0 to 10.8.0 (#3135)
Bumps [eslint](https://github.com/eslint/eslint) from 10.7.0 to 10.8.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.7.0...v10.8.0)
---
updated-dependencies:
- dependency-name: eslint
dependency-version: 10.8.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps-dev): bump postcss
Bumps the npm_and_yarn group with 1 update in the /tools/sep-automation directory: [postcss](https://github.com/postcss/postcss).
Updates `postcss` from 8.5.15 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.15...8.5.23)
---
updated-dependencies:
- dependency-name: postcss
dependency-version: 8.5.23
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
build(deps-dev): bump typescript-eslint from 8.64.0 to 8.65.0 (#3136)
Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.64.0 to 8.65.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint)
---
updated-dependencies:
- dependency-name: typescript-eslint
dependency-version: 8.65.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps): bump actions/labeler from 6 to 7
Bumps [actions/labeler](https://github.com/actions/labeler) from 6 to 7.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](https://github.com/actions/labeler/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/labeler
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Merge docs/2026-07-28-release into claude/rc-stateless-lifecycle
docs: update client concept guides for the 2026-07-28 protocol changes (#3067)
* docs: update client concept guides for the 2026-07-28 draft
- describe the form and URL elicitation modes and reframe the privacy
guidance around URL mode
- rewrite the elicitation and sampling flows for Multi Round-Trip
Requests (InputRequiredResult / inputRequests)
- mention tool calling in sampling and retarget the
/docs/concepts/sampling redirect to the latest spec
- drop roots/list_changed and logging/setLevel references and document
the per-request io.modelcontextprotocol/logLevel _meta field
- add deprecation callouts for Roots, Sampling, and Logging with
suggested migrations
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016WBaED7Rta4YsYVz66Qoru
* docs: tighten deprecation wording in client guides
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5bczitGsFmjopooZXfbSQ
* docs: explain MRTR once and link elsewhere
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5bczitGsFmjopooZXfbSQ
* docs: make sampling params example match the draft schema
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5bczitGsFmjopooZXfbSQ
* docs: drop duplicated logging advice in debugging warning
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5bczitGsFmjopooZXfbSQ
* Update docs/docs/draft/learn/client-concepts.mdx
* docs: group deprecated client features below the list
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5bczitGsFmjopooZXfbSQ
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
Co-authored-by: Den Delimarsky <hi@den.dev>
Merge pull request #3126 from jhauga/docs
docs/authorization: resolve demo Python server 401 error
docs: point the client tutorial at Claude Opus 5
The model id in the build-client examples was past its end-of-life date, so
the Anthropic client warns on every run and a reader copying the page may get an
error instead of a working chatbot. Move all eight language tabs to
claude-opus-5.
No-Verification-Needed: docs-only string swap
docs/authorization: resolve demo Python server 401 error
docs/authorization: resolve demo Python server 401 error
docs(blog): fix resultType value in 2026-07-28 RC post
docs: bring the Python examples up to SDK v2
The Python tabs across the release-branch guides were written against the v1
SDK. Two of them no longer run at all: the authorization tutorial imports
`mcp.server.fastmcp`, which v2 deleted, and the debugging page calls
`ctx.session.send_log_message`, where v2's `Context` has no `session`. The
rest execute but teach shapes v2 replaced.
- build-server: `from mcp.server import MCPServer`, and httpx2 in place of
httpx. The SDK depends on httpx2, so `uv add "mcp[cli]"` already brings it
in and the install line no longer needs to name an HTTP library. The stdio
logging guidance moves to a module logger.
- build-client: rebuilt on the high-level `Client` instead of `ClientSession`
plus `AsyncExitStack`, which removes the connect and cleanup pair entirely.
Tool schemas are read as `tool.input_schema`, and tool results are narrowed
to text blocks with `is_error` handed to the model rather than raised.
- architecture: the four pseudo-code blocks use `Client`, and the notification
one follows changes with `client.listen(...)`.
- debugging: standard library logging. The protocol logging capability is
deprecated at 2026-07-28 and the SDK marks its `Context.log` deprecated
alongside it.
- authorization: `MCPServer`, with host, port and path moved from the
constructor to `run()`, and httpx2 in the token verifier.
- oauth-client-credentials: both snippets wrapped in `main()` so they run as
pasted rather than raising a SyntaxError.
Each block was assembled into the file a reader would actually create and
executed against the shipping v2 SDK over stdio. The build-client tutorial was
run against the build-server tutorial's server: it lists the tools, calls one,
and negotiates 2026-07-28.
Only the Python tabs changed. The other language tabs are untouched.
No-Verification-Needed: docs-only change, examples driven end-to-end instead
Merge pull request #3117 from jhauga/docs
docs/authorization: resolve demo server 'Internal Server Error'
Merge pull request #3123 from modelcontextprotocol/dependabot/npm_and_yarn/npm_and_yarn-04db377a11
build(deps): bump fast-uri from 3.1.2 to 3.1.4 in the npm_and_yarn group across 1 directory
Merge pull request #3107 from modelcontextprotocol/dependabot/github_actions/actions/setup-node-7
build(deps): bump actions/setup-node from 6 to 7
build(deps): bump fast-uri in the npm_and_yarn group across 1 directory
Bumps the npm_and_yarn group with 1 update in the / directory: [fast-uri](https://github.com/fastify/fast-uri).
Updates `fast-uri` from 3.1.2 to 3.1.4
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4)
---
updated-dependencies:
- dependency-name: fast-uri
dependency-version: 3.1.4
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #3110 from modelcontextprotocol/dependabot/npm_and_yarn/npm_and_yarn-7429694490
build(deps-dev): bump brace-expansion from 5.0.6 to 5.0.7 in the npm_and_yarn group across 1 directory
Disable SEP reminder
Fix formatting in authorization tutorial
docs/authorization: resolve demo server 'Internal Server Error'
fix: correct MISSING_REQUIRED_CLIENT_CAPABILITY error codes in SEP-2663
Merge pull request #3099 from modelcontextprotocol/claude/security-best-practices-relocation
Move security guidance narratives to the security best practices page
docs: broaden caching guidance to server/discover and resources/read; note best-effort notification delivery
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018Ep4aMzUcNqroQQuXdiHKn
docs: drop the session close step from the client example
docs: link remaining subscriptions/listen mentions to the subscriptions spec page
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018Ep4aMzUcNqroQQuXdiHKn
docs: use client naming in the architecture examples
Merge pull request #3111 from nbarbettini/patch-1
docs: Fix broken anchor to _meta
build(deps-dev): bump brace-expansion
Bumps the npm_and_yarn group with 1 update in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Updates `brace-expansion` from 5.0.6 to 5.0.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.6...v5.0.7)
---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 5.0.7
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #3106 from olaservo/feature/add-note-on-structured-content
docs: clarify structuredContent is not LLM "structured outputs"
docs: state the per-request version declaration directly
Merge pull request #3098 from modelcontextprotocol/claude/rc-java-examples
docs: switch Java quickstart examples from SSE to Streamable HTTP
docs: keep versioned tutorial pages scoped to the current protocol
Merge pull request #3092 from DaleSeo/fix/sep-2575-error-codes
docs: align SEP-2575 error codes
docs: consolidate caching guidance and link subscription docs
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfPKVFyxGAbS7i2f2vhT2G
Merge pull request #3064 from modelcontextprotocol/claude/rc-deprecations
docs: reflect feature lifecycle deprecations and the Tasks recategorization
Merge pull request #3066 from modelcontextprotocol/claude/rc-sdk-v2-examples
docs: update code examples to the v2 SDKs
docs: extract text blocks from tool results in the client quickstart
docs: align SEP-2575 error codes
Merge branch 'docs/2026-07-28-release' into claude/rc-deprecations
Merge pull request #2992 from DaleSeo/docs/clarify-sep-2243-header-mismatch-code
docs: clarify SEP-2243 HeaderMismatch error code
build(deps-dev): bump typescript-json-schema from 0.67.4 to 0.68.0 (#3108)
Bumps [typescript-json-schema](https://github.com/YousefED/typescript-json-schema) from 0.67.4 to 0.68.0.
- [Commits](https://github.com/YousefED/typescript-json-schema/compare/v0.67.4...v0.68.0)
---
updated-dependencies:
- dependency-name: typescript-json-schema
dependency-version: 0.68.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps): bump actions/setup-node from 6 to 7
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
docs: clarify structuredContent is not LLM "structured outputs"
Add a note to the Structured Content section of the server tools spec clarifying that `structuredContent` is server-produced result data, unrelated to LLM provider "structured outputs" (schema-constrained model generation). The terms are routinely conflated. Applied to the draft, 2025-11-25, and 2025-06-18 revisions.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Apply review feedback
docs: scope the subscription acknowledgment ordering guarantee
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhtN33k4CMKjzsQL2jd6Z9
docs: use American spelling in elicitation example and drop logging from client features bullet
docs: tighten tools list-change prose
Apply review feedback
docs: tidy phrasing in changed prose
docs: align identity exchange with the per-request _meta fields
docs: use httpx2 in client credentials examples
docs: cite SEP-2663 for the Tasks extension in roadmap
docs: update Spring AI client customizer bullet to generic McpClientCustomizer
docs: apply review wording for clientInfo and subscription acks
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfPKVFyxGAbS7i2f2vhT2G
Align relocated text with the spec countermeasure list
docs: add 'Changes since SEP became Final' section to SEP-2243
Preserve SEP-2243 as a historical record instead of editing its body,
and document the HeaderMismatch error code reassignment from -32001 to
-32020 (#2907) in a dedicated section per maintainer feedback.
Also regenerate SEP-2549 docs, whose rendered mdx had drifted from its
source on main, so 'npm run check:seps' passes on PR CI.
Move security guidance narratives to the security best practices page
Relocate attack walkthroughs and scope-strategy guidance from the
authorization spec to the security best practices docs page. All
normative requirements remain in the spec.
docs: assume SDK 2.0.0 stable and drop unrelated SEP-1686 edit
Unpin the Python SDK install commands in the client and server
quickstarts and the OAuth client credentials guide, since these docs
ship with the 2026-07-28 release when the stable 2.0.0 package is
expected on PyPI. Update the system requirements lines to match.
Restore the draft specification wording in the SEP-1686 historical
note and regenerate the SEP docs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGEZeUktW3zbqbqm5yuCEc
docs: switch Java quickstart examples from SSE to Streamable HTTP
docs: move Java example updates to a separate PR
Merge pull request #2747 from spacewander/patch-1
Fix typos and clarify error handling for missing ttlMs
Update seps/2549-TTL-for-list-results.md
feat(schema): add optional serverInfo response metadata and make clientInfo optional (#3002)
* feat(schema): add optional serverInfo response metadata and make clientInfo optional
Merge pull request #3085 from modelcontextprotocol/docs/reserved-keys-table
docs: add a consolidated table of reserved `_meta` keys
Update docs/specification/draft/basic/index.mdx
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
Update docs/specification/draft/basic/index.mdx
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
Update docs/specification/draft/basic/index.mdx
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
Update docs/specification/draft/basic/index.mdx
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
Update docs/specification/draft/basic/index.mdx
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
docs: carry _meta on the tools/list example and fix listChanged prose
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfPKVFyxGAbS7i2f2vhT2G
docs: keep apps build guide on v1 SDK and add node types to tsconfig examples
The published @modelcontextprotocol/ext-apps (1.7.3) peer-depends on the
v1 SDK and types registerAppTool against the v1 McpServer, so the MCP
Apps build guide reverts to the v1 install commands and imports until a
compatible ext-apps release ships. The quickstart tsconfig examples set
"types": ["node"] because newer TypeScript versions dropped automatic
@types inclusion.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGEZeUktW3zbqbqm5yuCEc
docs: pin mcp 2.0.0b1 in examples and fix SEP-1686 wording
Pin the Python SDK install commands in the client quickstart and the
OAuth client credentials guide to mcp==2.0.0b1, since uv and pip skip
prereleases and would otherwise install v1.x against v2-only code.
Add the matching SDK version note to the client quickstart system
requirements. Inline the InMemoryTokenStorage class into the
PrivateKeyJWT Python example so the block runs as pasted. Name the
2026-07-28 specification in the SEP-1686 historical note instead of
calling it the draft specification, and regenerate the SEP docs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGEZeUktW3zbqbqm5yuCEc
docs: tighten deprecation wording per review
docs: link deprecation notes and mark Roots and Sampling in client features table
Merge pull request #3065 from modelcontextprotocol/claude/rc-nav-redirects
docs: add redirects for restructured spec pages
build(deps-dev): bump typescript-eslint from 8.63.0 to 8.64.0 (#3087)
Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.63.0 to 8.64.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/typescript-eslint)
---
updated-dependencies:
- dependency-name: typescript-eslint
dependency-version: 8.64.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Merge pull request #3084 from modelcontextprotocol/docs/improvements
Small Spec Improvements
Merge pull request #3086 from modelcontextprotocol/fix/pin-typescript-6
build(deps-dev): pin typescript back to 6.x
docs: add a consolidated table of reserved `_meta` keys
The keys reserved by the spec were scattered across prose in several
pages (per-request fields, logging, subscriptions, OpenTelemetry),
making it easy to miss one. List them in a single table in the General
fields section, pointing to where each key is normatively defined.
Extension-defined keys stay in each extension's own documentation.
No-Verification-Needed: doc-only change
Update docs/specification/draft/basic/patterns/subscriptions.mdx
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
Update docs/specification/draft/basic/index.mdx
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
docs: remove confusing sentence
docs: define the subscription acknowledgment ordering per subscription, not per stream
The rule said the acknowledgment MUST be the first message "on the stream",
which is meaningless on stdio, where every subscription shares one channel. An
implementation could read it as vacuous there and emit notifications for a
subscription before acknowledging it, leaving the client with data it cannot yet
interpret. State the rule in terms of the subscription ID instead, and say
explicitly that messages for other subscriptions may be interleaved ahead of it.
No-Verification-Needed: doc-only change (JSDoc, prose, and regenerated output)
docs: make MUST NOT in General Field's section bold
docs: `_meta` is just part of the schema. It's not more or less reserved than any other field.
docs: explain the optional `data` field in the error response
build(deps-dev): pin typescript back to 6.x
typedoc 0.28.20 declares a peer range of 5.0.x - 6.0.x and has no
release supporting TypeScript 7, so bumping typescript to 7.0.2 made
`npm ci` fail to resolve. This broke every job that installs
dependencies, on main and on all open pull requests.
Restore package.json and package-lock.json to their pre-bump state and
tell Dependabot to hold back typescript majors until typedoc supports
them.
No-Verification-Needed: dependency revert, lockfile, and CI config only
Merge pull request #3083 from jhauga/docs
docs: inline style to proportionally render icons
docs: inline style to proportionally render icons
Merge pull request #3079 from modelcontextprotocol/dependabot/npm_and_yarn/typescript-7.0.2
build(deps-dev): bump typescript from 6.0.3 to 7.0.2
fix(spec): replace Mcp-Param-* implementation note with rejection-retry guidance (#3071)
Remove the implementation note about constructing Mcp-Param-* headers
when the inputSchema has not been obtained, which contradicted the
validation table labeling header omission as non-conforming. Keep the
recovery path as inline prose: on a HeaderMismatch rejection, clients
SHOULD re-fetch tools/list and retry.
Fixes #2974
Merge branch 'main' into dependabot/npm_and_yarn/typescript-7.0.2
build(deps-dev): bump prettier from 3.9.4 to 3.9.5 (#3078)
Bumps [prettier](https://github.com/prettier/prettier) from 3.9.4 to 3.9.5.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.4...3.9.5)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.5
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps-dev): bump eslint from 10.6.0 to 10.7.0 (#3077)
Bumps [eslint](https://github.com/eslint/eslint) from 10.6.0 to 10.7.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.6.0...v10.7.0)
---
updated-dependencies:
- dependency-name: eslint
dependency-version: 10.7.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps-dev): bump typescript from 6.0.3 to 7.0.2
Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)
---
updated-dependencies:
- dependency-name: typescript
dependency-version: 7.0.2
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
build(deps-dev): bump typescript-eslint from 8.62.1 to 8.63.0 (#3080)
Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.62.1 to 8.63.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint)
---
updated-dependencies:
- dependency-name: typescript-eslint
dependency-version: 8.63.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
build(deps-dev): bump tsx from 4.23.0 to 4.23.1 (#3076)
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.0 to 4.23.1.
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.0...v4.23.1)
---
updated-dependencies:
- dependency-name: tsx
dependency-version: 4.23.1
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Merge pull request #3073 from jhauga/docs-develop
docs/develop: img and text edits to latest Claude UI version
resolve: md formatting error
docs/develop: img and text edits to latest Claude UI version
docs: clean up remaining tasks, sse, and client logging references
docs: leave debugging logging sections to the client concepts PR
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhtN33k4CMKjzsQL2jd6Z9
docs: clarify cacheScope semantics in architecture guide
cacheScope controls who may cache a response, while ttlMs controls
how long the result stays fresh. The previous wording attributed
reuse duration to both fields.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016WBaED7Rta4YsYVz66Qoru
docs: address review feedback on stateless lifecycle bundle
- Note that tools/list also accepts an optional cursor for pagination
- Add the Logging deprecation warning to the debugging guide
- Show the mandatory subscriptions/listen acknowledgment in the
architecture walkthrough
- Retitle the new session hijacking subsections to Title Case to match
the file's heading convention
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016WBaED7Rta4YsYVz66Qoru
docs: make draft protocol examples in architecture overview spec-valid
Add the required per-request _meta fields to the subscriptions/listen
and follow-up tools/list examples, and add resultType: "complete" to
the tools/list response that shows the ttlMs and cacheScope hints.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016WBaED7Rta4YsYVz66Qoru
docs: update extension negotiation phrasing to per-request capabilities
Extensions are declared in the extensions field of the per-request
clientCapabilities carried in _meta and in the server capabilities
returned by server/discover, so replace the initialize-time phrasing
in the client matrix and the auth and tasks overviews.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016WBaED7Rta4YsYVz66Qoru
docs: scope session hijacking guidance and cover state handles
Protocol revision 2026-07-28 removes protocol-level sessions and the
Mcp-Session-Id header, so scope the session hijacking attacks to
protocol versions 2025-11-25 and earlier and add guidance for securing
the explicit …
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps typescript-eslint from 8.64.0 to 8.65.0.
Release notes
Sourced from typescript-eslint's releases.
Changelog
Sourced from typescript-eslint's changelog.
Commits
63ba81bchore(release): publish 8.65.0eaf4576feat: add warning when TS 7 is detected (#12529)0d06406chore: add attw validation to repo (#12437)c2386e4chore(deps): update dependency prettier to v3.9.5 (#12486)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)