MCP TypeScript SDK v2.3.0: stateless per-request servers, same-origin redirects, Tasks extension
sdkModel Context Protocol TypeScript SDK 2.3.0 ships stateless Streamable HTTP (one server per request), same-origin redirect policy on HTTP client transports, new `maxToolInputElements` and `expectedResource` audience checks for bearer auth, support for `tasks/get`/`tasks/cancel` on 2026-07-28 connections, browser-extension origin allow-listing, and major perf wins for large SSE messages (100MB tool result went from ~60s/1.7GB to <1s/0.5GB).
An agent host can now spin up a cheap per-request McpServer over stateless Streamable HTTP, restrict bearer tokens by audience, cap tool-input size, and stream 100MB+ tool results in under a second.
Significant release: stateless per-request pattern changes how MCP servers are deployed on serverless/edge, and the audience-bound bearer tokens close a real auth-confused-deputy gap.
npm i @modelcontextprotocol/server@2.3.0 @modelcontextprotocol/client@2.3.0import { McpServer } from '@modelcontextprotocol/server';
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/server';
import express from 'express';
const app = express();
app.post('/mcp', async (req, res) => {
// One server per request (new in 2.3.0)
const server = new McpServer(
{ name: 'demo', version: '1.0.0' },
{ maxToolInputElements: 1000 }
);
server.registerTool(
'echo',
{ description: 'Echo input', inputSchema: { type: 'object' } },
async (args) => ({ content: [{ type: 'text', text: JSON.stringify(args) }] })
);
const transport = new StreamableHTTPServerTransport({ stateless: true });
await server.connect(transport);
await transport.handleRequest(req, res);
});
app.listen(3000);