What changed in mcp-handler from 1 to 2

4 releases numbered after v1.1.0 up to and including v2.1.1, stable releases only. v1.1.0 and v2.1.1 are the newest stable releases of 1 and 2 we track; this page follows them as new ones ship.

17 changes across 4 releases

Changed 11

v2.1.1

  • Forward maxSubscriptions to the MCP SDK handler so applications can bound or disable subscription streams

v2.1.0

  • Replace createMcpHandler(initialize, serverOptions, config) with createMcpHandler(initialize, options) using a single options object combining ServerOptions with serverInfo, verboseLogs, and onEvent, exported as McpHandlerOptions

v2.0.1

  • Mount the MCP handler directly at a framework route instead of using legacy transport endpoint routing
  • CLI now generates app/api/mcp/route.ts for the MCP handler

v2.0.0

  • Upgrade to MCP SDK v2 and the 2026-07-28 MCP specification
  • Handler now serves the stateless 2026-07-28 protocol with per-request _meta envelope and server/discover natively
  • SDK's stateless legacy fallback answers 2025-era Streamable HTTP clients from the same handler
  • The /sse and /message endpoints answer 410 Gone
  • Tool/prompt/resource registration follows SDK v2 with registerTool using z.object(...) Standard Schemas
  • extra.authInfo is now ctx.http?.authInfo
  • withMcpAuth now builds 401/403 challenges with the SDK's consolidated OAuthError/bearerAuthChallengeResponse
Removed 3

v2.1.0

  • Remove deprecated 1.x compatibility shims: basePath, streamableHttpEndpoint, sseEndpoint, sseMessageEndpoint, disableSse, redisUrl, maxDuration, and sessionIdGenerator

v2.0.0

  • Legacy HTTP+SSE transport (protocol 2024-11-05) has been removed
  • Variadic server.tool(...) is gone
Deprecated 3

v2.0.1

  • Legacy route, SSE, Redis, and session config keys remain accepted as ignored 2.x compatibility shims

v2.0.0

  • redis dependency and redisUrl, maxDuration, and sessionIdGenerator config options are deprecated no-ops
  • Dynamic Client Registration is deprecated by the spec in favor of Client ID Metadata Documents

Original release notes, newest first

The list above is our reading of these notes; the originals from Vercel are here, one fold per release.

v2.1.1
Patch Changes
  • e38a932: Forward maxSubscriptions to the MCP SDK handler so applications can bound or disable subscription streams.

View originalPermalink

v2.1.0
Minor Changes
  • 8398dbd: createMcpHandler(initialize, serverOptions, config) is now createMcpHandler(initialize, options) — a single options object combining the SDK's ServerOptions with serverInfo, verboseLogs, and onEvent (exported as McpHandlerOptions). The deprecated 1.x compatibility shims (basePath, streamableHttpEndpoint, sseEndpoint, sseMessageEndpoint, disableSse, redisUrl, maxDuration, sessionIdGenerator) are removed.

View originalPermalink

v2.0.1
Patch Changes
  • e6e6378: Mount the MCP handler directly at a framework route and remove legacy transport endpoint routing. The CLI now generates app/api/mcp/route.ts; deprecated route, SSE, Redis, and session config keys remain accepted as ignored 2.x compatibility shims.

View originalPermalink

v2.0.0
Major Changes

  • 33c06b6: Upgrade to MCP SDK v2 and the 2026-07-28 MCP specification (CIMD era).

    • The handler now serves the stateless 2026-07-28 protocol (per-request _meta envelope, server/discover) natively, with the SDK's stateless legacy fallback answering 2025-era Streamable HTTP clients from the same handler.
    • Breaking: requires @modelcontextprotocol/server ^2.0.0 (replaces the @modelcontextprotocol/sdk peer dependency), zod ^4.2.0 for schemas, and Node.js 20+.
    • Breaking: the legacy HTTP+SSE transport (protocol 2024-11-05) has been removed. /sse and /message endpoints answer 410 Gone; the redis dependency and redisUrl, maxDuration, and sessionIdGenerator config options are deprecated no-ops.
    • Breaking: tool/prompt/resource registration follows SDK v2 (registerTool with z.object(...) Standard Schemas; variadic server.tool(...) is gone; extra.authInfo is now ctx.http?.authInfo).
    • withMcpAuth now builds its 401/403 challenges with the SDK's consolidated OAuthError/bearerAuthChallengeResponse, keeping RFC 9728 resource_metadata discovery in place for CIMD-era authorization flows. Dynamic Client Registration is deprecated by the spec in favor of Client ID Metadata Documents — see README.

View originalPermalink