@modelcontextprotocol/sdk breaking changes

1.32.0

9 breaking changes, first published October 2, 2026.

• Behavior changed
  Tasks in the in-memory task store are now kept within the session that created them, so code that reads tasks across sessions will no longer see them. github.com
• Behavior changed SSEClientTransport
  A redirect to another host or port is no longer followed. Configure the final URL or set redirectPolicy to 'follow' on the transport; in browsers the request fails unless that option is set. github.com
• Behavior changed StreamableHTTPClientTransport
  A redirect to another host or port is no longer followed. Configure the final URL or set redirectPolicy to 'follow' on the transport; in browsers the request fails unless that option is set. github.com
• Signature changed experimental:InMemoryTaskStore.createTask
  Was createTask(taskParams: CreateTaskOptions, requestId: RequestId, request: Request, _sessionId?: string): Promise<Task>; now createTask(taskParams: CreateTaskOptions, requestId: RequestId, request: Request, sessionId?: string)... npmjs.com
• Signature changed experimental:InMemoryTaskStore.getTask
  Was getTask(taskId: string, _sessionId?: string): Promise<Task | null>; now getTask(taskId: string, sessionId?: string): Promise<Task | null>. npmjs.com
• Signature changed experimental:InMemoryTaskStore.getTaskResult
  Was getTaskResult(taskId: string, _sessionId?: string): Promise<Result>; now getTaskResult(taskId: string, sessionId?: string): Promise<Result>. npmjs.com
• Signature changed experimental:InMemoryTaskStore.listTasks
  Was listTasks(cursor?: string, _sessionId?: string): Promise<{tasks: Task[]; nextCursor?: string;}>; now listTasks(cursor?: string, sessionId?: string): Promise<{tasks: Task[]; nextCursor?: string;}>. npmjs.com
• Signature changed experimental:InMemoryTaskStore.storeTaskResult
  Was storeTaskResult(taskId: string, status: 'completed' | 'failed', result: Result, _sessionId?: string): Promise<void>; now storeTaskResult(taskId: string, status: 'completed' | 'failed', result: Result, sessionId?: string): Promise<void>. npmjs.com
• Signature changed experimental:InMemoryTaskStore.updateTaskStatus
  Was updateTaskStatus(taskId: string, status: Task['status'], statusMessage?: string, _sessionId?: string): Promise<void>; now updateTaskStatus(taskId: string, status: Task['status'], statusMessage?: string, sessionId?: string)... npmjs.com

1.31.0

1 breaking change, first published September 28, 2026.

• Behavior changed
  Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields must be changed to allow it. github.com

1.30.0

1 breaking change, first published July 27, 2026.

• Behavior changed
  The v1 stdio transport now applies a buffer size limit, so very large messages may be rejected. Check that your messages stay within the limit. github.com

1.29.0

7 breaking changes, first published March 30, 2026.

• Behavior changed
  Requests that pass a null (infinite) TTL are now disallowed, so callers must send a finite TTL value instead. github.com
• Signature changed client:Client.callTool
  Was callTool(params: CallToolRequest['params'], resultSchema?: typeof CallToolResultSchema | typeof CompatibilityCallToolResultSchema, options?: RequestOptions): Promise<{[x: string]: unknown; content: ({type: "text"; text: string... npmjs.com
• Signature changed client:Client.getPrompt
  Was getPrompt(params: GetPromptRequest['params'], options?: RequestOptions): Promise<{[x: string]: unknown; messages: {role: "user" | "assistant"; content: {type: "text"; text: string; annotations?: {audience?: ("user" | "assistant")[] |... npmjs.com
• Signature changed client:Client.listResources
  Was listResources(params?: ListResourcesRequest['params'], options?: RequestOptions): Promise<{[x: string]: unknown; resources: {uri: string; name: string; description?: string | undefined; mimeType?: string | undefined; annotations?... npmjs.com
• Signature changed experimental:CreateTaskRequestHandlerExtra.taskRequestedTtl
  Was taskRequestedTtl?: number | null; now taskRequestedTtl?: number. npmjs.com
• Signature changed experimental:TaskCreationParamsSchema
  Was const TaskCreationParamsSchema: z.ZodObject<{ttl: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodNull]>>; pollInterval: z.ZodOptional<z.ZodNumber>;}, z.core.$loose>; now const TaskCreationParamsSchema: z.ZodObject<{ttl... npmjs.com
• Signature changed experimental:TaskRequestHandlerExtra.taskRequestedTtl
  Was taskRequestedTtl?: number | null; now taskRequestedTtl?: number. npmjs.com

1.28.0

3 breaking changes, first published March 25, 2026.

• Behavior changed
  The SDK now uses scopes_supported from resource metadata by default, so authorization requests may request different scopes than before. github.com
• Behavior changed inputSchema
  Passing a plain JSON Schema object as inputSchema is now rejected, so code using that form must switch to a supported schema type. github.com
• Default changed
  When a server omits token_endpoint_auth_methods_supported, the client now defaults to client_secret_basic authentication. github.com

1.25.0

33 breaking changes, first published December 15, 2025.

• Removed
  Loose and passthrough types not allowed by the MCP spec were removed, so code that depended on them may no longer type-check. Update code to use the spec-defined types. github.com
• Behavior changed
  Protocol dates are now validated, so date values that were previously accepted may be rejected. github.com
• Signature changed client:Client.callTool
  Was callTool(params: CallToolRequest['params'], resultSchema?: typeof CallToolResultSchema | typeof CompatibilityCallToolResultSchema, options?: RequestOptions): Promise<{[x: string]: unknown; content: ({type: "text"; text: string... npmjs.com
• Signature changed client:Client.complete
  Was complete(params: CompleteRequest['params'], options?: RequestOptions): Promise<{[x: string]: unknown; completion: {[x: string]: unknown; values: string[]; total?: number | undefined; hasMore?: boolean | undefined;}; _meta?: {[x... npmjs.com
• Signature changed client:Client.getPrompt
  Was getPrompt(params: GetPromptRequest['params'], options?: RequestOptions): Promise<{[x: string]: unknown; messages: {role: "user" | "assistant"; content: {type: "text"; text: string; annotations?: {audience?: ("user" | "assistant")[] |... npmjs.com
• Signature changed client:Client.listPrompts
  Was listPrompts(params?: ListPromptsRequest['params'], options?: RequestOptions): Promise<{[x: string]: unknown; prompts: {name: string; description?: string | undefined; arguments?: {name: string; description?: string | undefined... npmjs.com
• Signature changed client:Client.listResources
  Was listResources(params?: ListResourcesRequest['params'], options?: RequestOptions): Promise<{[x: string]: unknown; resources: {uri: string; name: string; description?: string | undefined; mimeType?: string | undefined; annotations?... npmjs.com
• Signature changed client:Client.listResourceTemplates
  Was listResourceTemplates(params?: ListResourceTemplatesRequest['params'], options?: RequestOptions): Promise<{[x: string]: unknown; resourceTemplates: {uriTemplate: string; name: string; description?: string | undefined; mimeType?: string... npmjs.com
• Signature changed client:Client.listTools
  Was listTools(params?: ListToolsRequest['params'], options?: RequestOptions): Promise<{[x: string]: unknown; tools: {inputSchema: {[x: string]: unknown; type: "object"; properties?: Record<string, object> | undefined; required?: string[] |... npmjs.com
• Signature changed client:Client.ping
  Was ping(options?: RequestOptions): Promise<{_meta?: {[x: string]: unknown; "io.modelcontextprotocol/related-task"?: {[x: string]: unknown; taskId: string;} | undefined;} | undefined;}>; now ping(options?: RequestOptions): Promise<{_meta?... npmjs.com

And 23 more in this version.

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.