fix(deps): update dependency @modelcontextprotocol/sdk to v1.31.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/sdk (source)	1.29.0 → 1.31.0

---

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

CVE-2026-104850 / GHSA-6qxp-vccf-f47h

More information

Details

Summary

In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to.

A malicious or compromised MCP server could name its own authorization server. With no user interaction, the client would send it:

• the refresh_token and client_secret stored from an earlier sign-in
• the client_secret or signed assertion configured on a bundled provider

Am I affected?

Yes, if both of these hold:

• your application uses the SDK's OAuth client over HTTP, through any of:
  • an authProvider on a transport
  • the withOAuth() middleware
  • direct calls to auth() or fetchToken()
• it may connect to an MCP server you do not fully trust while holding credentials for a legitimate authorization server

Affected versions:

• @modelcontextprotocol/sdk 1.12.0 through 1.30.1
• @modelcontextprotocol/client 2.0.0 through 2.1.0, only for:
  • bundled providers without expectedIssuer
  • credentials stored or supplied without issuer
  • direct calls to fetchToken()
  • providers that read storage back through OAuthTokensSchema or OAuthClientInformationSchema

Not affected:

• MCP servers built with the SDK
• stdio clients

Fix

Upgrade to:

• 1.x: @modelcontextprotocol/sdk 1.31.0 or later
• 2.x: @modelcontextprotocol/client 2.2.0 or later, and @modelcontextprotocol/core 2.2.0 or later if you import it directly

The client now records the authorization server as issuer on saved credentials and does not send them to a different one. The user signs in again, or the call throws.

In the following cases, upgrading to the patched version is not enough. You also need to make a change:

• Bundled providers (ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider, CrossAppAccessProvider): pass expectedIssuer, for example expectedIssuer: 'https://auth.example.com'. Without it they still use whichever authorization server the MCP server names.
• Credentials saved without issuer: tokens and client information your OAuthClientProvider persisted (file, keychain, database) before upgrading, including everything 1.x saved before 1.31.0. They still go to whichever authorization server is named at first use. Add issuer to them, or clear them so users sign in again.
• Your own OAuthClientProvider: save exactly what saveTokens() and saveClientInformation() are given, including issuer. For pre-registered credentials, include issuer in what clientInformation() returns.

Not covered by this fix:

• a new interactive sign-in, which still goes to the authorization server the MCP server names. Only complete sign-ins for servers you trust.
• refreshAuthorization() and exchangeAuthorization() called directly
• 2.x with skipIssuerMetadataValidation: true

If an affected client may have connected to an untrusted MCP server, rotate its client secret or signing key and revoke its tokens.

If you cannot upgrade yet, connect OAuth clients only to MCP servers you trust. 2.0.0 and 2.1.0 already accept expectedIssuer.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h
• https://github.com/modelcontextprotocol/typescript-sdk/pull/2887
• https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd
• https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0
• https://github.com/advisories/GHSA-6qxp-vccf-f47h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.31.0

Compare Source

Upgrade notes

• Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
• Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

• [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @​maxisbey in #​2888
• chore: bump version to 1.31.0 by @​claude[bot] in #​2890

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

v1.30.1

Compare Source

What's Changed

• [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @​maxisbey in #​2717
• fix(auth): preserve resource URI without trailing slash (#​1968) by @​MukundaKatta in #​1972
• chore: bump version to 1.30.1 by @​claude[bot] in #​2848

New Contributors

• @​MukundaKatta made their first contribution in #​1972

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

v1.30.0

Compare Source

What's Changed

• fix(server): prioritize zod issues and format them by @​mozmo15 in #​1503
• chore(ci): switch publish to OIDC trusted publishing by @​felixweinberger in #​1839
• Add end-to-end test suite by @​felixweinberger in #​2167
• v1 stdio buffer limit by @​KKonstantinov in #​2239
• fix: support Zod 3.25 method literals by @​mattzcarey in #​2368
• Validate Content-Type by parsed media type instead of substring match (v1.x) by @​felixweinberger in #​2444
• fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @​mattzcarey in #​2538
• fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 by @​arimu1 in #​2549
• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @​felixweinberger in #​2547
• chore: bump version to 1.30.0 by @​felixweinberger in #​2563

New Contributors

• @​mozmo15 made their first contribution in #​1503
• @​arimu1 made their first contribution in #​2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review-active

---

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: Zoo-Code-Org/Zoo-Code/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f6a5a8da-8607-484e-99db-336be68c2aab

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Review status

This PR was opened by an automated account. A human maintainer must verify the change intent, provenance, and validation before merging.

Current step: Awaiting fresh human maintainer or CODEOWNER approval.

Review-state labels are managed by this workflow; do not edit them manually. community-approved is managed the same way — do not add or remove it manually. It signals a fresh community code approval for the current head as an advisory priority only; maintainer review is still required.