modelcontextprotocol/typescript-sdk

View on GitHub

The official TypeScript SDK for Model Context Protocol servers and clients

Stars: 13.4k
Forks: 2.2k
Open beginner issues: 25
Indexed issues: 300
Avg merge: 3d 15h
Merged PRs (30d): 4

Dominant language: TypeScript
License: No license data
Last GitHub push: Sep 16, 2026
Latest indexed: Sep 20, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue help wanted

Beginner friendly Everything

Open All

49 beginner-friendly issues open

Auth metadata discovery: fallback URL built on resource host instead of authorization-server host Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#2784 · Opened Sep 10, 2026
Auth metadata discovery: fallback only triggers on 404, misses 401/403 Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

modelcontextprotocol/typescript-sdk#2783 · 1 comment · Opened Sep 10, 2026
authorizationHandler drops the OAuth state parameter on error redirects Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

modelcontextprotocol/typescript-sdk#2773 · Opened Sep 9, 2026
Doc comments misattribute the token-endpoint TLS check to SEP-2207 (which is OIDC refresh / `offline_access`) Open

Difficulty 1/5 Under an hour Newbie friendliness 92/100

modelcontextprotocol/typescript-sdk#2766 · 1 comment · Opened Sep 7, 2026
Server auth defaults silently produce RFC 9728-noncompliant discovery when the MCP endpoint has a path Open

Difficulty 2/5 1-2 days Newbie friendliness 72/100

modelcontextprotocol/typescript-sdk#2751 · Opened Sep 3, 2026
experimental.tasks.getTaskResult() throws TypeError: Cannot read properties of undefined (reading '_zod') when the optional result schema is omitted Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

modelcontextprotocol/typescript-sdk#2742 · 2 comments · Opened Aug 31, 2026
UriTemplate.match() does not percent-decode extracted values Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

modelcontextprotocol/typescript-sdk#2728 · 4 comments · Opened Aug 27, 2026
outputSchema always emitted as JSON Schema draft-07, breaking clients that only accept 2020-12 Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

modelcontextprotocol/typescript-sdk#2721 · 4 comments · 2 reactions · Opened Aug 26, 2026
Docs: registerClient's @deprecated notice cites SEP-2577; DCR deprecation is PR #2858 (SEP-2577 is Roots/Sampling/Logging) Open

Difficulty 1/5 Under an hour Newbie friendliness 85/100

modelcontextprotocol/typescript-sdk#2719 · Opened Aug 26, 2026
Deno: TS2307 on all .js subpath imports — './*' exports map types to '*.js.d.ts' Open

v1

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

modelcontextprotocol/typescript-sdk#2701 · 2 comments · Opened Aug 22, 2026
Streamable HTTP SSE tests assume multiple events share one fetch chunk Open

bug good first issue P3 v1 v2

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

modelcontextprotocol/typescript-sdk#2661 · 2 comments · Opened Aug 14, 2026
[v2] subscriptions/listen holds a stream open even when it has honoured nothing Open

bug P1 ready for work spec-2026-07-28 v2

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

modelcontextprotocol/typescript-sdk#2650 · 2 comments · Opened Aug 12, 2026
[v2] Legacy-era cancel of a resumed request: notifications/cancelled inherits the request's resumptionToken, so the transport swallows the cancellation and opens a rogue resumed GET Open

v1 v2

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

modelcontextprotocol/typescript-sdk#2646 · 1 comment · Opened Aug 11, 2026
Docs: passing z.object() as inputSchema on v1 fails silently (empty schema) or cryptically (tools/list crash) — not covered in troubleshooting or migration guide Open

documentation enhancement good first issue P3 v1 v2

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

modelcontextprotocol/typescript-sdk#2627 · 4 comments · Opened Aug 9, 2026
Client.listTools() corrupts its cached tool metadata when an output schema fails to compile Open

bug P3 ready for work v1

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

modelcontextprotocol/typescript-sdk#2614 · 1 comment · Opened Aug 4, 2026
Client.callTool() throws -32602 after tools/list_changed replaces an in-flight call's output schema Open

bug P2 ready for work v1

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

modelcontextprotocol/typescript-sdk#2612 · 1 comment · Opened Aug 4, 2026
OAuth: isLoopbackHost rejects *.localhost subdomains, breaking host-based local dev (InsecureTokenEndpointError) Open

spec-2026-07-28 v2

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

modelcontextprotocol/typescript-sdk#2591 · 4 comments · 4 reactions · Opened Jul 31, 2026
`_onprogress` raises a protocol error for a race servers cannot avoid (progress notification arriving with the response) Open

bug P2 ready for work v1 v2

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

modelcontextprotocol/typescript-sdk#2580 · 4 comments · Opened Jul 30, 2026
normalizeHeaders references the bare global `HeadersInit`, breaking Node-only consumers with skipLibCheck: false Open

bug P2 ready for work v1

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

modelcontextprotocol/typescript-sdk#2568 · 1 comment · Opened Jul 28, 2026
InMemoryEventStore: standalone-stream resume broken by getStreamIdFromEventId split Open

bug P2 ready for work v1 v2

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#2560 · 1 comment · Opened Jul 27, 2026
Widen @hono/node-server range to ^1.19.9 || ^2 so GHSA-frvp-7c67-39w9 is reachable (npm suggests a breaking downgrade) Open

bug P2 ready for work v2

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#2548 · 3 comments · Opened Jul 24, 2026
[v2] MRTR wipe-cache example reads unvalidated elicitation content and defaults malformed scope to all Open

spec-2026-07-28 v2

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

modelcontextprotocol/typescript-sdk#2542 · 3 comments · Opened Jul 24, 2026
stdio.ts/ReadBuffer retains consumed input and copies the next stdio chunk Open

bug P3 ready for work v1 v2

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

modelcontextprotocol/typescript-sdk#2536 · 1 comment · Opened Jul 23, 2026
Bug: Resumption token dropped when a resumed SSE stream disconnects before any id-bearing event Open

bug P2 ready for work v1 v2

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

modelcontextprotocol/typescript-sdk#2499 · 1 comment · Opened Jul 14, 2026
[v2] Origin and Host validators accept userinfo before allowlisted hostnames Open

v1 v2

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

modelcontextprotocol/typescript-sdk#2489 · 1 comment · Opened Jul 14, 2026
Tool inputSchema generation emits $ref for reused Zod instances · breaks strict MCP clients (kimi) Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

modelcontextprotocol/typescript-sdk#2100 · 3 comments · Opened May 15, 2026
[SEP-1613 regression] tools/list still emits draft-07 in 1.29.0 — `target` option missing from mcp.js `toJsonSchemaCompat` calls Open

bug fix proposed P1 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

modelcontextprotocol/typescript-sdk#2084 · 6 comments · 1 reaction · Opened May 14, 2026
Type inconsistency: StreamableHTTPServerTransport.onclose widens Transport interface contract under exactOptionalPropertyTypes Open

potentially close

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

modelcontextprotocol/typescript-sdk#2083 · 2 comments · Opened May 13, 2026
`registerPrompt()` silently drops `icons` from PromptDefinition config Open

potentially close

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

modelcontextprotocol/typescript-sdk#2054 · 1 comment · Opened May 12, 2026
Security: Transitive dependencies with known vulnerabilities in @modelcontextprotocol/sdk@1.29.0 Open

potentially close

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

modelcontextprotocol/typescript-sdk#2042 · 1 comment · 1 reaction · Opened May 10, 2026
DEFAULT_INHERITED_ENV_VARS Open

bug fix proposed P2 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

modelcontextprotocol/typescript-sdk#2037 · 3 comments · 1 reaction · Opened May 9, 2026
handleAutomaticTaskPolling ignores AbortSignal; cancelled requests poll indefinitely Open

potentially close

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#2018 · 1 comment · Opened May 5, 2026
zod listed in both dependencies and peerDependencies causes duplicate installs and TS type-incompatibility Open

bug fix proposed P2 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

modelcontextprotocol/typescript-sdk#2011 · 1 comment · 2 reactions · Opened May 2, 2026
Bug: StdioServerTransport doesn't handle stdin close/end — causes zombie process accumulation Open

bug fix proposed P1 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

modelcontextprotocol/typescript-sdk#2002 · 8 comments · 2 reactions · Opened May 1, 2026
RegisteredTool.update() crashes with ZodObject inputSchema (passthrough schemas) Open

bug fix proposed good first issue P2

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

modelcontextprotocol/typescript-sdk#1960 · 2 comments · Opened Apr 25, 2026
Bug: `_handleSseStream` retains reader lock on stream close, leaking ~50MB per reconnection Open

potentially close

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#1959 · 2 comments · Opened Apr 25, 2026
adaptOAuthProvider returns expired tokens without checking expiry, breaking long-running StreamableHTTP connections Open

auth bug P2 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#1954 · 2 comments · Opened Apr 24, 2026
OAuth discovery does not fall back to well-known URI when 401 carries a non-Bearer WWW-Authenticate (e.g. Negotiate) Open

auth bug needs repro

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

modelcontextprotocol/typescript-sdk#1946 · 3 comments · Opened Apr 22, 2026
authExtensions docs say custom claims override reserved JWT claims, but implementation keeps reserved claims authoritative Open

bug documentation fix proposed P3 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#1914 · 4 comments · Opened Apr 16, 2026
`createMcpHonoApp` should support generics for Env (Bindings and Variables) Open

enhancement needs decision P3 v2

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

modelcontextprotocol/typescript-sdk#1877 · 1 comment · 1 reaction · Opened Apr 11, 2026
StreamableHTTPClientTransport cannot be restarted after close() — breaks OAuth re-authentication Open

auth bug fix proposed P2 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

modelcontextprotocol/typescript-sdk#1641 · 2 comments · Opened Mar 7, 2026
Hono Package is not under @modelcontextprotocol Open

bug potentially close

Difficulty 1/5 1-3 hours Newbie friendliness 70/100

modelcontextprotocol/typescript-sdk#1639 · 4 comments · Opened Mar 6, 2026
StreamableHTTPClientTransport should handle 404 and 406 gracefully for GET SSE stream Open

bug fix proposed P2 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

modelcontextprotocol/typescript-sdk#1635 · 3 comments · Opened Mar 5, 2026
registerToolTask handlers receive wrong arguments when inputSchema is omitted Open

bug fix proposed P2 ready for work v2

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#1471 · 3 comments · Opened Feb 3, 2026
Simplify public access to McpServer registered tools Open

enhancement needs decision P3

Difficulty 2/5 1-3 hours Newbie friendliness 67/100

modelcontextprotocol/typescript-sdk#1036 · 1 comment · Opened Oct 21, 2025
The bug in InMemoryEventStore break SSE stream resumability Open

bug fix proposed P2 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

modelcontextprotocol/typescript-sdk#943 · 4 comments · Opened Sep 15, 2025
OAuth token exchange fails with URL-encoded responses - assumes JSON format only Open

auth bug fix proposed P2 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#759 · 4 comments · 2 reactions · Opened Jul 11, 2025
MCP SDK Can not handle the MCP Servers with subpath Open

bug fix proposed P2 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

modelcontextprotocol/typescript-sdk#471 · 9 comments · 1 reaction · Opened May 9, 2025
MCP SDK Path Handling Bug for Subpath Servers Open

bug fix proposed P2 ready for work

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

modelcontextprotocol/typescript-sdk#470 · 5 comments · Opened May 9, 2025

modelcontextprotocol/typescript-sdk

Get new issues in your inbox