v2.0.0

What's Changed

ext-apps 2.0 moves to the MCP TypeScript SDK 2.0 split packages. The MCP Apps wire protocol is unchanged: 2.x Views run in 1.x hosts and 2.x hosts render 1.x Views (covered by a test that runs the published 1.7.5 against this release in both directions). What breaks is dependencies and the TypeScript API; see the migration guide.

Breaking changes

• Peer dependencies. @modelcontextprotocol/sdk@^1 is replaced by @modelcontextprotocol/client@^2.0.0 (required: App and AppBridge extend its Protocol), @modelcontextprotocol/server@^2.0.0 (optional, only for the ./server helpers), and zod@^4.2.0. Node.js 20+.
• zod 3 is no longer supported. SDK 2.0 requires zod 4.2+ (the release that added Standard JSON Schema output); the 1.x fallback for zod 3.25 is gone. Raw zod shapes in registerAppTool still work as a deprecated overload; wrap them in z.object({...}) to move off it.
• Handler context. Custom handlers receive the SDK 2.x BaseContext: extra.signal is now extra.mcpReq.signal, extra.requestId is extra.mcpReq.id.
• setRequestHandler / setNotificationHandler are keyed by method name. The 2.x form is setRequestHandler("method", { params }, (params, ctx) => …). The 1.x (Schema, handler) form still works as a deprecated overload with a one-time warning (#769) and goes away in 3.0.
• The double-registration guard now covers the SDK's own handlers. Registering a handler for notifications/progress or notifications/cancelled throws already registered, as ping and the on*-owned methods did in 1.x.
• ProtocolWithEvents is removed. AppRequest, AppNotification and AppResult remain as deprecated type aliases.
• Errors. Remote JSON-RPC errors are ProtocolError (numeric code); local failures are SdkError (string code). Host-side wire deltas: a handler-thrown -32002 reaches the View as -32602, invalid params on ui/* methods go from -32603 to -32602, and the MCP error N: message prefix is gone.
• schema.json follows the 2.0 core schemas: structuredContent is any JSON value, result _meta documents io.modelcontextprotocol/serverInfo, toolInfo.tool.outputSchema is a loose object, and a recursive JSON-value definition is added.

SDK

• Migrate to SDK v2 with the official Protocol and isolated role peers by @tonxxd, building on @khandrew1's #710 and @felixweinberger's #712, in #720
• SDK 2.0 fixups: regenerated lockfile, ^2.0.0 peers, restored double-registration guard, deprecated raw-shape registerAppTool overload, migration guide, wire-compat tests, MCPB build in #768
• Fix: explicit .js extensions on relative imports so published declarations resolve under NodeNext / Node16 (#704) by @ken-jo in #705
• Keep the 1.x handler registration forms as deprecated overloads in #769
• Cross-version interop test against the published ext-apps 1.7.5 in #770

Examples

• All examples migrated to the split SDK packages (NodeStreamableHTTPServerTransport, z.object schemas, extra.mcpReq.*) in #720
• server-pdf now advertises JSON Schema 2020-12 on every tool's inputSchema / outputSchema, which fixes #765 for clients with a strict 2020-12 validator

Docs

• Add Alpic Playground to supported clients by @qchuchu in #729

Security

npm audit reports 10 findings (2 critical, 4 high, 4 moderate), all in example workspaces or build tooling, none reachable from the published package, whose only runtime dependency is @standard-schema/spec:

• seroval / solid-js (GHSA-mv8w-475r-vwqw): the Solid example's vite plugin, pinned by a root overrides
• undici 7.28.0: cheerio in wiki-explorer-server
• nanoid, postcss: vite
• brace-expansion: nodemon (dev)
• hono / @hono/node-server (GHSA-frvp-7c67-39w9): @modelcontextprotocol/node in the examples' servers; same advisory as the 1.7.5 residual, still unreachable (only getRequestListener / serve are imported)
• qs: express 5 in examples; fflate: @types/three (dev)

All have non-major fixes available and will be picked up in a follow-up, kept off this release to keep the version diff clean.

Full Changelog: v1.7.5...v2.0.0