github · typescript-sdkHEAD

File invokes the MCP `sampling/createMessage` capability without passing a `maxTokens` / `max_tokens` cap. The MCP spec has the *client* perform the LLM call on the server's behalf, so an uncapped request bills the end user (or hits provider limits silently). Always pass an explicit cap. TS: await server.createMessage({ messages, maxTokens: 1024, ... }) Python: await session.create_message(messages=[...], max_tokens=1024) Distinct from MCP-084 (denial-of-wallet), which targets the server's

---

name: migrate-v1-to-v2

description: Migrate MCP TypeScript SDK code from v1 (@modelcontextprotocol/sdk) to v2 (@modelcontextprotocol/core, /client, /server). Use when a user asks to migrate, upgrade, or port their MCP TypeScript code from v1 to v2.

---

# MCP TypeScript SDK: v1 → v2 Migration

Apply these changes in order: dependencies → imports → API calls → type aliases.

## 1. Environment

- Node.js 20+ required (v18 dropped)

- ESM only (CJS dropped). If the project uses `require()`, conv

File invokes the MCP `sampling/createMessage` capability without passing a `maxTokens` / `max_tokens` cap. The MCP spec has the *client* perform the LLM call on the server's behalf, so an uncapped request bills the end user (or hits provider limits silently). Always pass an explicit cap. TS: await server.createMessage({ messages, maxTokens: 1024, ... }) Python: await session.create_message(messages=[...], max_tokens=1024) Distinct from MCP-084 (denial-of-wallet), which targets the server's

import type {

    BaseContext,

    ClientCapabilities,

    CreateMessageRequest,

    CreateMessageRequestParamsBase,

    CreateMessageRequestParamsWithTools,

    CreateMessageResult,

    CreateMessageResultWithTools,

    ElicitRequestFormParams,

    ElicitRequestURLParams,

    ElicitResult,

    Implementation,

    InitializeRequest,

    InitializeResult,

    JSONRPCRequest,

    JsonSchemaType,

    jsonSchemaValidator,

    ListRootsRequest,

    LoggingLevel,

    LoggingMessageNotification,

    Me

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

import { createMcpExpressApp } from '@modelcontextprotocol/express';

import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';

import type { CallToolResult, GetPromptResult, ReadResourceResult } from '@modelcontextprotocol/server';

import { McpServer } from '@modelcontextprotocol/server';

import type { Request, Response } from 'express';

import * as z from 'zod/v4';

const getServer = () => {

    // Create an MCP server with implementation details

    const server = new Mcp

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

# `@modelcontextprotocol/fastify`

Fastify adapters for the MCP TypeScript server SDK.

This package is a thin Fastify integration layer for [`@modelcontextprotocol/server`](https://github.com/modelcontextprotocol/typescript-sdk/tree/main/packages/server).

It does **not** implement MCP itself. Instead, it helps you:

- create a Fastify app with sensible defaults for MCP servers

- add DNS rebinding protection via Host header validation (recommended for localhost servers)

## Install

```bash

npm

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

import { randomUUID } from 'node:crypto';

import { createMcpExpressApp } from '@modelcontextprotocol/express';

import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';

import type { CallToolResult } from '@modelcontextprotocol/server';

import { isInitializeRequest, McpServer } from '@modelcontextprotocol/server';

import type { Request, Response } from 'express';

import * as z from 'zod/v4';

// Create an MCP server with implementation details

const getServer = () => {

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

# `@modelcontextprotocol/node`

Node.js adapters for the MCP TypeScript server SDK.

This package is a thin Node.js integration layer for [`@modelcontextprotocol/server`](https://github.com/modelcontextprotocol/typescript-sdk/tree/main/packages/server). It provides a Streamable HTTP transport that works with Node’s `IncomingMessage` / `ServerResponse`.

For web‑standard runtimes (Cloudflare Workers, Deno, Bun, etc.), use `WebStandardStreamableHTTPServerTransport` from `@modelcontextprotocol/serv

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

import { randomUUID } from 'node:crypto';

import { createMcpExpressApp } from '@modelcontextprotocol/express';

import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';

import type { ReadResourceResult } from '@modelcontextprotocol/server';

import { isInitializeRequest, McpServer } from '@modelcontextprotocol/server';

import type { Request, Response } from 'express';

// Helper to register a dynamic resource on a given server instance

const addResource = (server: McpServer

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

/**

 * SSE Polling Example Server (SEP-1699)

 *

 * This example demonstrates server-initiated SSE stream disconnection

 * and client reconnection with Last-Event-ID for resumability.

 *

 * Key features:

 * - Configures `retryInterval` to tell clients how long to wait before reconnecting

 * - Uses `eventStore` to persist events for replay after reconnection

 * - Uses `ctx.http?.closeSSE()` callback to gracefully disconnect clients mid-operation

 *

 * Run with: pnpm tsx src/ssePollingExample.ts

 *

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

// Run with: pnpm tsx src/elicitationFormExample.ts

//

// This example demonstrates how to use form elicitation to collect structured user input

// with JSON Schema validation via a local HTTP server with SSE streaming.

// Form elicitation allows servers to request *non-sensitive* user input through the client

// with schema-based validation.

// Note: See also elicitationUrlExample.ts for an example of using URL elicitation

// to collect *sensitive* user input via a browser.

import { randomUUID

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

/**

 * Simple interactive task server demonstrating elicitation and sampling.

 *

 * This server demonstrates the task message queue pattern from the MCP Tasks spec:

 * - confirm_delete: Uses elicitation to ask the user for confirmation

 * - write_haiku: Uses sampling to request an LLM to generate content

 *

 * Both tools use the "call-now, fetch-later" pattern where the initial call

 * creates a task, and the result is fetched via tasks/result endpoint.

 */

import { randomUUID } from 'node:cryp

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

/**

 * This file is automatically generated from the Model Context Protocol specification.

 *

 * Source: https://github.com/modelcontextprotocol/modelcontextprotocol

 * Pulled from: https://raw.githubusercontent.com/modelcontextprotocol/modelcontextprotocol/main/schema/draft/schema.ts

 * Last updated from commit: 5c25208be86db5033f644a4e0d005e08f699ef3d

 *

 * DO NOT EDIT THIS FILE MANUALLY. Changes will be overwritten by automated updates.

 * To update this file, run: pnpm run fetch:spec-types

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

console.log('Failed to open SSE stream');

                break;

            case SdkErrorCode.ClientHttpNotImplemented:

                console.log('HTTP request failed');

                break;

        }

        // Access HTTP status code from error.data if needed

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

console.log('Please try again...');

                        continue;

                    } else {

                        console.log('Maximum attempts reached. Declining request.');

                        return returnResult({ action: 'decline' });

                    }

                }

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

await transport.handleRequest(req, res, req.body);

    } catch (error) {

        console.error('Error handling MCP request:', error);

        if (!res.headersSent) {

            res.status(500).json({

                jsonrpc: '2.0',

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

console.log('Please correct the errors and try again...');

                        continue;

                    } else {

                        console.log('Maximum attempts reached. Declining request.');

                        return returnResult({ action: 'decline' });

                    }

                }

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

//#region Client_setRequestHandler_sampling

    client.setRequestHandler('sampling/createMessage', async request => {

        const lastMessage = request.params.messages.at(-1);

        console.log('Sampling request:', lastMessage);

        // In production, send messages to your LLM here

        return {

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

// Handle the request with existing transport

        await transport.handleRequest(req, res, req.body);

    } catch (error) {

        console.error('Error handling MCP request:', error);

        if (!res.headersSent) {

            res.status(500).json({

                jsonrpc: '2.0',

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

});

app.delete('/mcp', async (req: Request, res: Response) => {

    console.log('Received DELETE MCP request');

    res.writeHead(405).end(

        JSON.stringify({

            jsonrpc: '2.0',

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

const client = new Client({ name: 'acme-search-client', version: '0.0.0' });

client.setNotificationHandler('acme/searchProgress', { params: SearchProgressParams }, params => {

    console.log(`[progress] ${params.stage} ${Math.round(params.pct * 100)}%`);

});

await client.connect(new StdioClientTransport({ command: 'node', args: ['../server/dist/customMethodExample.js'] }));

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

return;

    }

    console.log(`Received session termination request for session ${sessionId}`);

    try {

        const transport = transports[sessionId];

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

}

            console.log('\n🔔 Elicitation (form) Request Received:');

            console.log(`Message: ${request.params.message}`);

            console.log(`Related Task: ${request.params._meta?.[RELATED_TASK_META_KEY]?.taskId}`);

            console.log(`Task Creation Requested: ${request.params.task ? 'yes' : 'no'}`);

            console.log('Requested Schema:');

            console.log(JSON.stringify(request.params.requestedSchema, null, 2));

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

```ts source="../examples/client/src/clientGuide.examples.ts#elicitation_handler"

client.setRequestHandler('elicitation/create', async request => {

    console.log('Server asks:', request.params.message);

    if (request.params.mode === 'form') {

        // Present the schema-driven form to the user

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

console.log('\n🔔 Elicitation (form) Request Received:');

            console.log(`Message: ${request.params.message}`);

            console.log(`Related Task: ${request.params._meta?.[RELATED_TASK_META_KEY]?.taskId}`);

            console.log(`Task Creation Requested: ${request.params.task ? 'yes' : 'no'}`);

            console.log('Requested Schema:');

            console.log(JSON.stringify(request.params.requestedSchema, null, 2));

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

}

            }

            console.log('Maximum attempts reached. Declining request.');

            return returnResult({ action: 'decline' });

        });

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

// Handle the request with existing transport

            await transport.handleRequest(req, res, req.body);

        } catch (error) {

            console.error('Error handling MCP request:', error);

            if (!res.headersSent) {

                res.status(500).json({

                    jsonrpc: '2.0',

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

console.log('Failed to open SSE stream');

                break;

            case SdkErrorCode.ClientHttpNotImplemented:

                console.log('HTTP request failed');

                break;

        }

        // Access HTTP status code from error.data if needed