[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@modelcontextprotocol/client@2.4.0

Minor Changes

• #3047 46d9c99 Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

  • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
  • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
  • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
  • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

  Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

• #2762 b022522 Thanks @pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

• Updated dependencies [46d9c99]:

  • @modelcontextprotocol/core@2.4.0

@modelcontextprotocol/core@2.4.0

Minor Changes

• #3047 46d9c99 Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

  • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
  • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
  • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
  • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

  Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

@modelcontextprotocol/server@2.4.0

Minor Changes

• #3057 c05225a Thanks @steipete! - ServerEvent takes optional params, which the subscriptions/listen router delivers with its own subscription ID, so a gateway can forward change notifications with their _meta and extension params.

• #3047 46d9c99 Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

  • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
  • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
  • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
  • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

  Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

• #2960 43c45f4 Thanks @claude! - A server whose tool puts x-mcp-header on a number-typed parameter keeps checking that tool's Mcp-Param-* headers on tools/call, as 2.3.0 does: a header that is missing for a value in the body, or that disagrees with the body, is answered 400 with JSON-RPC error -32020. Clients on a 2026-07-28 connection other than stdio no longer list such a tool and send no Mcp-Param-* headers for it, so a call that carries a value for a declared parameter is rejected the same way; the server logs a warning each time tools are listed. Use an integer (z.int()) or remove the annotation.

• #3057 c05225a Thanks @steipete! - Connecting a Server or McpServer to a PerRequestHTTPServerTransport classified at a modern revision that supportedProtocolVersions lists and the SDK implements now binds that revision, instead of answering -32022.

• #3005 b381559 Thanks @chaeyn! - Reflect resource and resource template update({ title }) changes in list responses. Preserve other metadata and individual resource titles when a template supplies list entries.

• #2762 b022522 Thanks @pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

• Updated dependencies [46d9c99]:

  • @modelcontextprotocol/core@2.4.0

@modelcontextprotocol/server-legacy@2.4.0

Patch Changes

• Updated dependencies [46d9c99]:
  • @modelcontextprotocol/core@2.4.0

@modelcontextprotocol/codemod@2.4.0

@modelcontextprotocol/core-internal@2.0.5

Patch Changes

• #2762 b022522 Thanks @pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

• Updated dependencies [46d9c99]:

  • @modelcontextprotocol/core@2.4.0