[dependabot]

Bumps @modelcontextprotocol/server to 2.3.1 and updates ancestor dependency agents. These dependencies need to be updated together.

Updates @modelcontextprotocol/server from 2.0.0 to 2.3.1

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

• #2952 5a18673 Thanks @​claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

• Updated dependencies []:

  • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server@​2.3.1

Patch Changes

• Updated dependencies []:
  • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

• #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [633dd3e]:

  • @​modelcontextprotocol/core@​2.3.0

@​modelcontextprotocol/server@​2.3.0

Minor Changes

• #2929 40f8f4e Thanks @​claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

• #2926 6d8dbc6 Thanks @​claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

• #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

  What keeps working without a change:

  • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
  • A handler that builds a new server and a new stateless transport for each request.
  • One server and one transport per session (a transport with a sessionIdGenerator).
  • Connecting a server again after close().
  • Client.

  What fails now, how it shows, and what to change:

  • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
  • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
  • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
  • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

  What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

  The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

• #2907 e55f9ac Thanks @​claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

... (truncated)

Commits

• fcef852 Version Packages (#2953)
• e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
• 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
• 3ab61c6 docs: update the README banners (#2940)
• 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
• 33fecfb test(e2e): cover tools/call without arguments (#2933)
• 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
• a202a36 Version Packages (#2896)
• 2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
• b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
• Additional commits viewable in compare view

Updates agents from 0.21.0 to 0.29.0

Release notes

Sourced from agents's releases.

agents@0.29.0

Minor Changes

• #2560 8c720d3 Thanks @​mattzcarey! - Agent Skills read and write a @cloudflare/computer Workspace, for both projection and skills.runner(). See Upgrading to a Computer workspace.

Patch Changes

• #2584 3b3a88e Thanks @​ben-reitz! - Browser creates and closes its Browser Run sessions with the binding's typed acquire() and closeSession(), falling back to the HTTP API in fully local dev. See Browser.

• #2615 05843e4 Thanks @​mattzcarey! - Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.

• #2604 5d6f5d6 Thanks @​mattzcarey! - createAI takes { accountId, apiToken } in place of binding, to use a gateway in another account or to run outside a Worker. See the models docs.

• #2622 2c68a71 Thanks @​mattzcarey! - createAI transcribes with @cf/deepgram/nova-3. See the models docs.

• #2576 b048873 Thanks @​mattzcarey! - createAI no longer uses AI Gateway's deprecated Universal Endpoint. Model ids, now including catalog ids like anthropic/claude-opus-4.8, run on env.AI.run; model objects go to the provider-native path. Adds byokAlias, fixes pi-ai catalog models and dynamic routes, and lets agents/models/opencode take catalog ids. See the models docs.

• #2589 841cc18 Thanks @​mattzcarey! - createAI resumes a catalog or dynamic route stream that drops mid-answer, with nothing lost or repeated. See the models docs.

• #2594 cc34652 Thanks @​ben-reitz! - agents/models/pi-ai resolves Claude ids from pi-ai 1.2's gateway catalog under AI Gateway's spelling, anthropic/claude-opus-4.8. See Models for pi-ai.

• #2594 cc34652 Thanks @​ben-reitz! - Support Pi 1.3: the Pi web search, web fetch, browser, and skills tools return output, and the Pi peer range is now ~1.3.0. See Pi harness.

• #2621 e80a201 Thanks @​ben-reitz! - PiHarness submit() and steer() now accept pi-durable's entry option, which labels an input with a transcript kind of your own (for example app.approval) instead of pi.user. Before, the harness had no way to pass it. See Label input the user did not type.

• #2616 65ddec8 Thanks @​ben-reitz! - openPiSessionStore now uses pi-durable's own Durable Object SQLite adapter, so several Pi storages in one object share its operation queue. See Pi harness.

agents@0.28.1

Patch Changes

• #2571 1bd2bc5 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) adds the zdr gateway option, and vendorKey: "request" for AI SDK models routed with your own vendor key. See docs/agents/models.md.

• #2572 b7c6ab9 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) takes AI Gateway dynamic routes as ai("dynamic/<route>"). See docs/agents/models.md.

• #2573 80719a5 Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.2.0 and @modelcontextprotocol/sdk to 1.31.0. See Model Context Protocol.

• #2574 131af4b Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/sdk to 1.32.1. The MCP client transports now follow redirects only within the same origin. See Model Context Protocol.

• #2574 131af4b Thanks @​mattzcarey! - McpAgent now answers requests for a session ended with DELETE with 404 straight away, instead of serving it until deferred teardown runs, and createMcpHandler rejects a Legacy request whose factory returns an instance still serving another request without closing that instance. See Transport.

• #2568 46570f5 Thanks @​mattzcarey! - OpenCodeHarness: session.events() now returns a stream with a snapshot of the session and then its events, translated into the same kinds PiHarness reports: run_start/run_end, operation_start/operation_end (with the result wait() returns), message_start/message_end, text_delta, reasoning_delta, tool_start/tool_end, permissions and compaction. It replaces the async iterable of OpenCode's raw events; those are still available, durable and resumable, from session.log(). The OpenCode example now gives the model Workspace tools from @cloudflare/computer in place of OpenCode's local file and shell tools.

agents@0.28.0

This release adds two new tools, browser via agents/browser/{pi,ai-sdk,tanstack-ai} allowing an agent to create and manipulate a persistent browser session and web_fetch via agents/webfetch/{pi,ai-sdk,tanstack-ai} that can retrieve most document formats converted into markdown.

Minor Changes

• #2484 dedbee4 Thanks @​ben-reitz! - Add browserTool() to agents/browser/pi. See Persistent browser.

• #2473 6614955 Thanks @​mattzcarey! - Make agents/lifecycle stable along with the Scheduler (agents/schedules), State (agents/state), WebSockets (agents/websockets) and MCPClientManager (agents/mcp/client) capabilities. See Lifecycle.

... (truncated)

Changelog

Sourced from agents's changelog.

0.29.0

Minor Changes

• #2560 8c720d3 Thanks @​mattzcarey! - Agent Skills read and write a @cloudflare/computer Workspace, for both projection and skills.runner(). See Upgrading to a Computer workspace.

Patch Changes

• #2584 3b3a88e Thanks @​ben-reitz! - Browser creates and closes its Browser Run sessions with the binding's typed acquire() and closeSession(), falling back to the HTTP API in fully local dev. See Browser.

• #2615 05843e4 Thanks @​mattzcarey! - Chat recovery now seals a turn after chatRecovery.maxInterruptedAttempts interrupted attempts (default 5), so a turn that exceeds the Durable Object memory limit on every run no longer retries forever; maxOomRetries is deprecated. See Stream Recovery.

• #2604 5d6f5d6 Thanks @​mattzcarey! - createAI takes { accountId, apiToken } in place of binding, to use a gateway in another account or to run outside a Worker. See the models docs.

• #2622 2c68a71 Thanks @​mattzcarey! - createAI transcribes with @cf/deepgram/nova-3. See the models docs.

• #2576 b048873 Thanks @​mattzcarey! - createAI no longer uses AI Gateway's deprecated Universal Endpoint. Model ids, now including catalog ids like anthropic/claude-opus-4.8, run on env.AI.run; model objects go to the provider-native path. Adds byokAlias, fixes pi-ai catalog models and dynamic routes, and lets agents/models/opencode take catalog ids. See the models docs.

• #2589 841cc18 Thanks @​mattzcarey! - createAI resumes a catalog or dynamic route stream that drops mid-answer, with nothing lost or repeated. See the models docs.

• #2594 cc34652 Thanks @​ben-reitz! - agents/models/pi-ai resolves Claude ids from pi-ai 1.2's gateway catalog under AI Gateway's spelling, anthropic/claude-opus-4.8. See Models for pi-ai.

• #2594 cc34652 Thanks @​ben-reitz! - Support Pi 1.3: the Pi web search, web fetch, browser, and skills tools return output, and the Pi peer range is now ~1.3.0. See Pi harness.

• #2621 e80a201 Thanks @​ben-reitz! - PiHarness submit() and steer() now accept pi-durable's entry option, which labels an input with a transcript kind of your own (for example app.approval) instead of pi.user. Before, the harness had no way to pass it. See Label input the user did not type.

• #2616 65ddec8 Thanks @​ben-reitz! - openPiSessionStore now uses pi-durable's own Durable Object SQLite adapter, so several Pi storages in one object share its operation queue. See Pi harness.

0.28.1

Patch Changes

• #2571 1bd2bc5 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) adds the zdr gateway option, and vendorKey: "request" for AI SDK models routed with your own vendor key. See docs/agents/models.md.

• #2572 b7c6ab9 Thanks @​mattzcarey! - createAI (agents/models/ai-sdk, agents/models/pi-ai) takes AI Gateway dynamic routes as ai("dynamic/<route>"). See docs/agents/models.md.

• #2573 80719a5 Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.2.0 and @modelcontextprotocol/sdk to 1.31.0. See Model Context Protocol.

• #2574 131af4b Thanks @​mattzcarey! - Update @modelcontextprotocol/client and @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/sdk to 1.32.1. The MCP client transports now follow redirects only within the same origin. See Model Context Protocol.

• #2574 131af4b Thanks @​mattzcarey! - McpAgent now answers requests for a session ended with DELETE with 404 straight away, instead of serving it until deferred teardown runs, and createMcpHandler rejects a Legacy request whose factory returns an instance still serving another request without closing that instance. See Transport.

• #2568 46570f5 Thanks @​mattzcarey! - OpenCodeHarness: session.events() now returns a stream with a snapshot of the session and then its events, translated into the same kinds PiHarness reports: run_start/run_end, operation_start/operation_end (with the result wait() returns), message_start/message_end, text_delta, reasoning_delta, tool_start/tool_end, permissions and compaction. It replaces the async iterable of OpenCode's raw events; those are still available, durable and resumable, from session.log(). The OpenCode example now gives the model Workspace tools from @cloudflare/computer in place of OpenCode's local file and shell tools.

0.28.0

Minor Changes

• #2484 dedbee4 Thanks @​ben-reitz! - Add browserTool() to agents/browser/pi. See Persistent browser.

... (truncated)

Commits

• fc7f59f Version Packages (#2588)
• 05843e4 fix(chat-recovery): seal a turn after repeated interrupted attempts (#2615)
• 2c68a71 feat(agents): createAI transcribes with Deepgram Nova-3 (#2622)
• 5d6f5d6 feat(agents): createAI takes an account id and API token in place of the bind...
• e80a201 fix(agents): forward pi-durable's input entry through PiHarness.submit (#2621)
• 65ddec8 refactor(agents): open the pi session store with pi-durable's adapter (#2616)
• cc34652 fix(agents): support pi-durable 1.3 (#2594)
• 841cc18 feat(agents): resume dropped /run streams in createAI (#2589)
• b048873 feat(agents): createAI on env.AI.run and the provider-native path, for the AI...
• 8c720d3 think, agents: work in a @​cloudflare/computer Workspace (#2560)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.