MCP SDK v2 adoption via mcp-ts-core 0.12.3
- Tool inputs are now strict — an undeclared argument key is rejected with
isError: truenaming the key, instead of being silently stripped - Advertised schemas move to JSON Schema 2020-12 with
additionalProperties: false;outputSchemanow declares the error envelope; protocol revision 2026-07-28 is served alongside the 2025 era on HTTP ctx.logoutput also reaches the client asnotifications/message; input-validation failures now read as flatpath: messagesentencesbun auditclears from 35 advisories (17 high, 16 moderate, 2 low) to 0 across 345 packages — the SDK v2 swap drops the transitiveexpress/ajv/express-rate-limitchainMCP_SESSION_MODEdocumented (defaults toauto, resolves tostateful); vulnerability reports now route tosecurity@caseyjhand.com;CONTRIBUTING.mdandCODE_OF_CONDUCT.mdadded- deps:
@cyanheads/mcp-ts-core^0.11.0 → ^0.12.3 (Bun 1.3.14 → 1.4.0)