The official source reports this update: @modelcontextprotocol/node@2.1.0. Minor Changes #1624 6032170 Thanks @SamMorrowDrums ! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks. createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup.
Canonical AI event
Model Context Protocol Node Adds OAuth Scope Challenges
The new version of @modelcontextprotocol/node adds OAuth scope challenges for various tools and resources. It also enforces a 4 MiB default size limit on HTTP request bodies.
23 Sept 20261 verified claims1 sources1 observations
This official update documents a development concerning @modelcontextprotocol/node@2.1.0. Its practical significance depends on the scope and evidence stated by the source.
Read the official source update and verify its stated scope, evidence and timing before acting on it.
Connected knowledge
Entities affected by this event
Continue this topic
Related verified updates
Evidence trail
Sources behind the event
Editorial presentation
Open story