All issues

Search results

Auth metadata discovery: fallback URL built on resource host instead of authorization-server host

Status: Open.

#2784 In modelcontextprotocol/typescript-sdk;

· sahil7886 opened on Sep 10, 2026

Auth metadata discovery: fallback only triggers on 404, misses 401/403

Status: Open.

#2783 In modelcontextprotocol/typescript-sdk;

· sahil7886 opened on Sep 10, 2026

OAuth client_secret comparison in clientAuth.ts is not constant-time

Status: Open.

#2780 In modelcontextprotocol/typescript-sdk;

· Rahul-s-007 opened on Sep 10, 2026

Where does validation of a peer's declarations belong? Four things the client accepts today

Status: Open.

#2777 In modelcontextprotocol/typescript-sdk;

· BerkantACUN opened on Sep 9, 2026

stderr: 'pipe' deadlocks the session if the consumer never reads transport.stderr

Status: Open.

#2776 In modelcontextprotocol/typescript-sdk;

· BerkantACUN opened on Sep 9, 2026

Transport errors are reported only on onerror; awaiting callers always get "MCP error -32000: Connection closed"

Status: Open.

#2775 In modelcontextprotocol/typescript-sdk;

· BerkantACUN opened on Sep 9, 2026

authorizationHandler drops the OAuth state parameter on error redirects

Status: Open.

#2773 In modelcontextprotocol/typescript-sdk;

· Ssavan99 opened on Sep 9, 2026

[v2] Streamable HTTP client does not clear stale resumption token after an empty SSE id

Status: Open.

#2769 In modelcontextprotocol/typescript-sdk;

· znnnnnnn-wil opened on Sep 8, 2026

Doc comments misattribute the token-endpoint TLS check to SEP-2207 (which is OIDC refresh / offline_access)

Status: Open.

#2766 In modelcontextprotocol/typescript-sdk;

· cliffhall opened on Sep 7, 2026

[v2] Typescript: optional content when structuredContent is present

v2Ideas, requests and plans for v2 of the SDK which will incorporate major changes and fixesIdeas, requests and plans for v2 of the SDK which will incorporate major changes and fixes

Status: Open.

#2755 In modelcontextprotocol/typescript-sdk;

· tobiasBora opened on Sep 3, 2026

[v2] Should raise error at build time if zod outputSchema is not consistent with the structuredContent type

v2Ideas, requests and plans for v2 of the SDK which will incorporate major changes and fixesIdeas, requests and plans for v2 of the SDK which will incorporate major changes and fixes

Status: Open.

#2754 In modelcontextprotocol/typescript-sdk;

· tobiasBora opened on Sep 3, 2026

Server auth defaults silently produce RFC 9728-noncompliant discovery when the MCP endpoint has a path

Status: Open.

#2751 In modelcontextprotocol/typescript-sdk;

· bumhwan opened on Sep 3, 2026