chore(deps): bump @modelcontextprotocol/core from 2.1.0 to 2.4.0

DE
5d ago
+12-12

Bumps @modelcontextprotocol/core from 2.1.0 to 2.4.0.

Release notes

Sourced from @​modelcontextprotocol/core's releases.

@​modelcontextprotocol/core@​2.4.0

Minor Changes

  • #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

    • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
    • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
    • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
    • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

    SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

    Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

@​modelcontextprotocol/core@​2.3.1

No release notes provided.

@​modelcontextprotocol/core@​2.3.0

Patch Changes

  • #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

@​modelcontextprotocol/core@​2.2.0

Minor Changes

  • #2887 edd12e2 Thanks @​maxisbey! - Constructing ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider or CrossAppAccessProvider without expectedIssuer is deprecated: the constructor logs one console.warn and that call signature is marked @deprecated. Behaviour is otherwise unchanged. Pass the issuer of the authorization server the credentials were registered with.

    fetchToken() throws AuthorizationServerMismatchError, before sending anything, when the provider's client information is bound to a different authorization server than the one it is called with. The AuthorizationServerMismatchError message no longer assumes the authorization-code callback; its fields are unchanged.

    OAuthTokensSchema and OAuthClientInformationSchema accept the optional issuer stamp, so a provider that reads storage back through them keeps it. auth() overwrites it on every save.

Commits
  • 951fe56 Version Packages (#2959)
  • 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
  • 28124db fix(docs): use relative POSIX package entry globs (#3016)
  • f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
  • a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
  • 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
  • ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
  • 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
  • a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
  • c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by cubic

Bumps @modelcontextprotocol/core from 2.1.0 to 2.4.0 across apps/my-pi-mcp and packages/mcp-adapter.

Key changes in this range:

  • Adds the Skills extension (new ext/skills subpaths) without changing package root exports.
  • Marks OAuth provider constructors without expectedIssuer as deprecated and enforces authorization server binding checks.
  • Updates the package license field to Apache-2.0 (no code change).

No action required unless you plan to use the Skills APIs or rely on unvalidated OAuth token refreshes.