- Ship CommonJS builds alongside ESM by emitting both .mjs/.d.mts and .cjs/.d.cts for each package and updating the exports map to add a require condition so require('@modelcontextprotocol/…') works from CommonJS consumers
- Return HTTP 400 for a MissingRequiredClientCapabilityError (-32021) produced after dispatch instead of surfacing it in-band on HTTP 200
Patch Changes
-
#2405
f172626Thanks @mattzcarey! - Ship CommonJS builds alongside ESM. Each package now emits both.mjs/.d.mtsand.cjs/.d.cts(via tsdownformat: ['esm', 'cjs']), and itsexportsmap adds arequirecondition sorequire('@modelcontextprotocol/…')works from CommonJS consumers. Output extensions are normalized across all packages (@modelcontextprotocol/coremoves from.js/.d.tsto.mjs/.d.mts); the public import paths are unchanged. -
#2399
3c7ddafThanks @felixweinberger! - Return HTTP 400 for aMissingRequiredClientCapabilityError(-32021) produced after dispatch. The spec mandates400 Bad Requestfor this error with no condition on where it arose, but only the pre-dispatch capability gate honored that; the post-handler emission — theinput_requiredgate rejecting an embedded request whose required capability the caller did not declare — surfaced in-band on HTTP 200. The JSON-RPC error body is unchanged, every other error code (including a handler relaying a downstream peer's-32020/-32022) keeps the origin-keyed in-band behavior, and the mapping only applies while the response is uncommitted: an exchange that already streamed — or one hosted withresponseMode: 'sse', which opens its stream at dispatch end — keeps its committed 200 and carries the error in-stream.