[dependabot]

Bumps mcp-handler from 1.1.0 to 2.3.0.

Release notes

Sourced from mcp-handler's releases.

v2.3.0

Minor Changes

• 0073647: Add experimental_registerMcpEvents for the draft MCP Events webhook control methods, with authenticated catalogs, event argument validation, deterministic subscription identity, and application-owned storage and delivery adapters. Require a bounded subscription reservation before callback verification and pass its fencing token into activation so adapters can prevent late verification from undoing cancellation or newer refreshes. Redact webhook signing secrets from request telemetry.

  Add experimental_validateMcpEventDelivery for workers to check subscription expiry, validate event data without transformations, and recheck authorization using stored identity without retaining access tokens.

  Allow event definitions to provide authorizeDiscovery to filter authenticated catalogs and subscription lookup, while keeping authorization of actual subscription arguments separate.

Patch Changes

• fb83ab8: Fix release workflow authentication by using GitHub's built-in token instead of a fine-grained personal access token.

v2.2.0

Minor Changes

• 79aa420: Promote the experimental WebMCP bridge to a minor release.

v2.1.2

Patch Changes

• f37e63e: Add an experimental experimental_webMcp option to createMcpHandler, which serves a browser bridge from the existing MCP route and registers an explicit allowlist of the endpoint's tools with the page's WebMCP provider (navigator.modelContext / document.modelContext).

v2.1.1

Patch Changes

• e38a932: Forward maxSubscriptions to the MCP SDK handler so applications can bound or disable subscription streams.

v2.1.0

Minor Changes

• 8398dbd: createMcpHandler(initialize, serverOptions, config) is now createMcpHandler(initialize, options) — a single options object combining the SDK's ServerOptions with serverInfo, verboseLogs, and onEvent (exported as McpHandlerOptions). The deprecated 1.x compatibility shims (basePath, streamableHttpEndpoint, sseEndpoint, sseMessageEndpoint, disableSse, redisUrl, maxDuration, sessionIdGenerator) are removed.

v2.0.1

Patch Changes

• e6e6378: Mount the MCP handler directly at a framework route and remove legacy transport endpoint routing. The CLI now generates app/api/mcp/route.ts; deprecated route, SSE, Redis, and session config keys remain accepted as ignored 2.x compatibility shims.

v2.0.0

Major Changes

• 33c06b6: Upgrade to MCP SDK v2 and the 2026-07-28 MCP specification (CIMD era).

  • The handler now serves the stateless 2026-07-28 protocol (per-request _meta envelope, server/discover) natively, with the SDK's stateless legacy fallback answering 2025-era Streamable HTTP clients from the same handler.
  • Breaking: requires @modelcontextprotocol/server ^2.0.0 (replaces the @modelcontextprotocol/sdk peer dependency), zod ^4.2.0 for schemas, and Node.js 20+.
  • Breaking: the legacy HTTP+SSE transport (protocol 2024-11-05) has been removed. /sse and /message endpoints answer 410 Gone; the redis dependency and redisUrl, maxDuration, and sessionIdGenerator config options are deprecated no-ops.
  • Breaking: tool/prompt/resource registration follows SDK v2 (registerTool with z.object(...) Standard Schemas; variadic server.tool(...) is gone; extra.authInfo is now ctx.http?.authInfo).
  • withMcpAuth now builds its 401/403 challenges with the SDK's consolidated OAuthError/bearerAuthChallengeResponse, keeping RFC 9728 resource_metadata discovery in place for CIMD-era authorization flows. Dynamic Client Registration is deprecated by the spec in favor of Client ID Metadata Documents — see README.

Changelog

Sourced from mcp-handler's changelog.

2.3.0

Minor Changes

• 0073647: Add experimental_registerMcpEvents for the draft MCP Events webhook control methods, with authenticated catalogs, event argument validation, deterministic subscription identity, and application-owned storage and delivery adapters. Require a bounded subscription reservation before callback verification and pass its fencing token into activation so adapters can prevent late verification from undoing cancellation or newer refreshes. Redact webhook signing secrets from request telemetry.

  Add experimental_validateMcpEventDelivery for workers to check subscription expiry, validate event data without transformations, and recheck authorization using stored identity without retaining access tokens.

  Allow event definitions to provide authorizeDiscovery to filter authenticated catalogs and subscription lookup, while keeping authorization of actual subscription arguments separate.

Patch Changes

• fb83ab8: Fix release workflow authentication by using GitHub's built-in token instead of a fine-grained personal access token.

2.2.0

Minor Changes

• 79aa420: Promote the experimental WebMCP bridge to a minor release.

2.1.2

Patch Changes

• f37e63e: Add an experimental experimental_webMcp option to createMcpHandler, which serves a browser bridge from the existing MCP route and registers an explicit allowlist of the endpoint's tools with the page's WebMCP provider (navigator.modelContext / document.modelContext).

2.1.1

Patch Changes

• e38a932: Forward maxSubscriptions to the MCP SDK handler so applications can bound or disable subscription streams.

2.1.0

Minor Changes

• 8398dbd: createMcpHandler(initialize, serverOptions, config) is now createMcpHandler(initialize, options) — a single options object combining the SDK's ServerOptions with serverInfo, verboseLogs, and onEvent (exported as McpHandlerOptions). The deprecated 1.x compatibility shims (basePath, streamableHttpEndpoint, sseEndpoint, sseMessageEndpoint, disableSse, redisUrl, maxDuration, sessionIdGenerator) are removed.

2.0.1

Patch Changes

• e6e6378: Mount the MCP handler directly at a framework route and remove legacy transport endpoint routing. The CLI now generates app/api/mcp/route.ts; deprecated route, SSE, Redis, and session config keys remain accepted as ignored 2.x compatibility shims.

2.0.0

Major Changes

• 33c06b6: Upgrade to MCP SDK v2 and the 2026-07-28 MCP specification (CIMD era).

... (truncated)

Commits

• 67bf165 fix: align package repository with npm provenance (#195)
• c4c4b43 chore: update package versions (#194)
• fb83ab8 fix: use built-in GitHub token for release workflows (#193)
• 0073647 feat: add experimental MCP Events registration and delivery validation (#192)
• d4009f6 Add Labs status badges to README (#190)
• 9e42568 chore: update package versions (#189)
• 79aa420 chore: add minor changeset for WebMCP (#188)
• c3c64a5 chore: update package versions (#186)
• ecf52c2 chore: release WebMCP bridge as patch (#187)
• f37e63e feat: add experimental WebMCP bridge to createMcpHandler (#183)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mcp-handler since your current version.