Qeravio
Canonical AI event

Model Context Protocol Node Adds OAuth Scope Challenges

The new version of @modelcontextprotocol/node adds OAuth scope challenges for various tools and resources. It also enforces a 4 MiB default size limit on HTTP request bodies.

23 Sept 20261 verified claims1 sources1 observations
What happened

The official source reports this update: @modelcontextprotocol/node@2.1.0. Minor Changes #1624 6032170 Thanks @SamMorrowDrums ! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks. createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup.

Why it matters

This official update documents a development concerning @modelcontextprotocol/node@2.1.0. Its practical significance depends on the scope and evidence stated by the source.

What to watch next

Read the official source update and verify its stated scope, evidence and timing before acting on it.

Connected knowledge

Entities affected by this event

Continue this topic
Evidence trail

Sources behind the event