v2.2.0

Minor Changes

• 79aa420: Promote the experimental WebMCP bridge to a minor release.

v2.1.2

Patch Changes

• f37e63e: Add an experimental experimental_webMcp option to createMcpHandler, which serves a browser bridge from the existing MCP route and registers an explicit allowlist of the endpoint's tools with the page's WebMCP provider (navigator.modelContext / document.modelContext).

v2.1.1

Patch Changes

• e38a932: Forward maxSubscriptions to the MCP SDK handler so applications can bound or disable subscription streams.

v2.1.0

Minor Changes

• 8398dbd: createMcpHandler(initialize, serverOptions, config) is now createMcpHandler(initialize, options) — a single options object combining the SDK's ServerOptions with serverInfo, verboseLogs, and onEvent (exported as McpHandlerOptions). The deprecated 1.x compatibility shims (basePath, streamableHttpEndpoint, sseEndpoint, sseMessageEndpoint, disableSse, redisUrl, maxDuration, sessionIdGenerator) are removed.

v2.0.1

Patch Changes

• e6e6378: Mount the MCP handler directly at a framework route and remove legacy transport endpoint routing. The CLI now generates app/api/mcp/route.ts; deprecated route, SSE, Redis, and session config keys remain accepted as ignored 2.x compatibility shims.

v2.0.0

Major Changes

• 33c06b6: Upgrade to MCP SDK v2 and the 2026-07-28 MCP specification (CIMD era).

  • The handler now serves the stateless 2026-07-28 protocol (per-request _meta envelope, server/discover) natively, with the SDK's stateless legacy fallback answering 2025-era Streamable HTTP clients from the same handler.
  • Breaking: requires @modelcontextprotocol/server ^2.0.0 (replaces the @modelcontextprotocol/sdk peer dependency), zod ^4.2.0 for schemas, and Node.js 20+.
  • Breaking: the legacy HTTP+SSE transport (protocol 2024-11-05) has been removed. /sse and /message endpoints answer 410 Gone; the redis dependency and redisUrl, maxDuration, and sessionIdGenerator config options are deprecated no-ops.
  • Breaking: tool/prompt/resource registration follows SDK v2 (registerTool with z.object(...) Standard Schemas; variadic server.tool(...) is gone; extra.authInfo is now ctx.http?.authInfo).
  • withMcpAuth now builds its 401/403 challenges with the SDK's consolidated OAuthError/bearerAuthChallengeResponse, keeping RFC 9728 resource_metadata discovery in place for CIMD-era authorization flows. Dynamic Client Registration is deprecated by the spec in favor of Client ID Metadata Documents — see README.

v1.1.0

Minor Changes

• 7ac97dc: Require minimum of @modelcontextprotocol/sdk@1.26.0 which uses web streams

v1.0.7

Patch Changes

• 5a92040: Update pinned version of MCP TS SDK to 1.25.2 for vulnerability patch
• 8c51d39: Allow passing in sessionIdGenerator for stateful sessions

v1.0.6

Patch Changes

• a9c7af5: Ensure auth profiles stay tied to the request

v1.0.5

Patch Changes

• 81bdf1c: Update README, examples, and support for > MCP TS SDK 1.25.0
• 6e75141: Add raw headers to incoming message
• 51b8a24: bump @modelcontextprotocol/sdk version