CHANGELOG.md

@modelcontextprotocol/hono

2.0.0-beta.2

Patch Changes

• #2405 f172626 Thanks @mattzcarey! - Ship CommonJS builds alongside ESM. Each package now emits both .mjs/.d.mts and .cjs/.d.cts (via tsdown format: ['esm', 'cjs']), and its exports map adds a require condition so require('@modelcontextprotocol/…') works from CommonJS consumers. Output extensions are normalized across all packages (@modelcontextprotocol/core moves from .js/.d.ts to .mjs/.d.mts); the public import paths are unchanged.
• Updated dependencies [f172626, 3c7ddaf]:
  • @modelcontextprotocol/server@2.0.0-beta.2

2.0.0-beta.1

Patch Changes

• #2402 a400259 Thanks @felixweinberger! - First beta release of SDK v2 with support for the MCP 2026-07-28 specification revision. See the migration guides for upgrading from v1 (docs/migration/upgrade-to-v2.md) and adopting the 2026-07-28 revision (docs/migration/support-2026-07-28.md).
• Updated dependencies [a400259]:
  • @modelcontextprotocol/server@2.0.0-beta.1

2.0.0-alpha.4

Minor Changes

• #2286 1823aae Thanks @felixweinberger! - Add Origin header validation alongside the existing Host header validation. The server package gains framework-agnostic helpers (validateOriginHeader, localhostAllowedOrigins, originValidationResponse); the Express, Hono and Fastify adapters gain originValidation / localhostOriginValidation middleware and a new allowedOrigins option on their app factories, which now arm Origin validation by default for localhost-class binds (mirroring the Host validation ladder; the 0.0.0.0-without-allowlist warning is unchanged). Requests without an Origin header pass — non-browser MCP clients are unaffected — while a present Origin that is not allowed or cannot be parsed (including the opaque null origin) is rejected with 403. The Node adapter ships hostHeaderValidation / originValidation request guards for plain node:http servers, which previously had no validation helpers.

Patch Changes

• Updated dependencies [1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 801111e, 1823aae, 1823aae, 6cc7b1c, f0bf785, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae, 1823aae]:
  • @modelcontextprotocol/server@2.0.0-alpha.4

2.0.0-alpha.3

Patch Changes

• #1898 2a7611d Thanks @felixweinberger! - Add top-level types field (and typesVersions on client/server for their subpath exports) so consumers on legacy moduleResolution: "node" can resolve type declarations. The exports map remains the source of truth for nodenext/bundler resolution. The typesVersions map includes entries for subpaths added by sibling PRs in this series (zod-schemas, stdio); those entries are no-ops until the corresponding dist/*.d.mts files exist.

• Updated dependencies [e8c7180, 434b2f1, db83829, e84c3e9, 42cb6b2, c59dc3a, df4b6cc, 2c0c481, 0fb8406, 2a7611d, e15a8ef, db28156, 49c0a71, c8d7401, 96db044, 1b53a41, 9fc9070, 16d13ab, 55b1f06, b256546]:

  • @modelcontextprotocol/server@2.0.0-alpha.3

2.0.0-alpha.2

Patch Changes

• #1840 424cbae Thanks @KKonstantinov! - tsdown exports resolution fix

• Updated dependencies [424cbae]:

  • @modelcontextprotocol/server@2.0.0-alpha.2

2.0.0-alpha.1

Patch Changes

• #1534 69a0626 Thanks @josefaidt! - remove npm references, use pnpm

• #1534 69a0626 Thanks @josefaidt! - clean up package manager usage, all pnpm

• Updated dependencies [e86b183, 0a75810, 3466a9e, fcde488, 462c3fc, 01954e6, 78bae74, 689148d, f1ade75, 108f2f3, dcf708d, f66a55b, 69a0626, 69a0626, dcf708d, 0784be1, 71ae3ac]:

  • @modelcontextprotocol/server@2.0.0-alpha.1