Commits

Commit history

1. Commits on Oct 25, 2026

   • Merge pull request #2809 from modelcontextprotocol/v2/feat/2805-scope-on-refresh

     Show description for 4bb5ee7
     cliffhall

     authored
     4bb5ee7View commit details

     Copy full SHA for 4bb5ee7

     View code at this pointBrowse repository at this point

   • feat(auth): opt-in scope on OAuth token refresh via scopeForRefresh (#2805)

     Show description for e4f2c06
     

     cliffhall

     and

     claude

     committed
     e4f2c06View commit details

     Copy full SHA for e4f2c06

     View code at this pointBrowse repository at this point

   • chore(skills): take SEP-2640 constants and schemas from the SDK, move the rest to core/extension/skills (#2804)

     Show description for c212b92
     

     cliffhall

     and

     claude

     committed
     c212b92View commit details

     Copy full SHA for c212b92

     View code at this pointBrowse repository at this point

   • chore(build): migrate the web runner, mcpdo and TUI bundles from tsup to tsdown (#2797)

     Show description for 1a335e7
     

     cliffhall

     and

     claude

     committed
     1a335e7View commit details

     Copy full SHA for 1a335e7

     View code at this pointBrowse repository at this point

   • chore(cli): pin rolldown to the root's copy for dep-lockstep (#1492)

     Show description for 5498e15
     

     cliffhall

     and

     claude

     committed
     5498e15View commit details

     Copy full SHA for 5498e15

     View code at this pointBrowse repository at this point

   • chore(cli): migrate the CLI bundle from tsup to tsdown (#1492)

     Show description for aabddc3
     

     cliffhall

     and

     claude

     committed
     aabddc3View commit details

     Copy full SHA for aabddc3

     View code at this pointBrowse repository at this point

   • feat(web): warn on non-loopback binds and document the token's access-control boundary (#2750)

     Show description for f65e095
     

     cliffhall

     and

     claude

     committed
     f65e095View commit details

     Copy full SHA for f65e095

     View code at this pointBrowse repository at this point
2. Commits on Oct 21, 2026

   • docs(web): state the IP forms the Host allow-list accepts

     Show description for 28eda4c
     

     cliffhall

     and

     claude

     committed
     28eda4cView commit details

     Copy full SHA for 28eda4c

     View code at this pointBrowse repository at this point

   • fix(web): restrict Host names to hostname characters, punycode allowed-host entries

     Show description for 4c31c6b
     

     cliffhall

     and

     claude

     committed
     4c31c6bView commit details

     Copy full SHA for 4c31c6b

     View code at this pointBrowse repository at this point

   • fix(web): validate the Host header on the production web server

     Show description for 1239983
     

     cliffhall

     and

     claude

     committed
     1239983View commit details

     Copy full SHA for 1239983

     View code at this pointBrowse repository at this point
3. Commits on Oct 20, 2026

   • fix(skills): require ttlMs and cacheScope on modern resources/directory/read results (#2740)

     Show description for 721d314
     

     olaservo

     and

     claude

     committed
     721d314View commit details

     Copy full SHA for 721d314

     View code at this pointBrowse repository at this point

   • Merge pull request #2739 from modelcontextprotocol/v2/fix/2734-handoff-owner-provenance

     Show description for 1b4d4ec
     cliffhall

     authored
     1b4d4ecView commit details

     Copy full SHA for 1b4d4ec

     View code at this pointBrowse repository at this point

   • fix(auth): bind an owner stamp with an HMAC keyed by the credential

     Show description for 15de439
     

     cliffhall

     and

     claude

     committed
     15de439View commit details

     Copy full SHA for 15de439

     View code at this pointBrowse repository at this point

   • Merge pull request #2618 from modelcontextprotocol/v2/docs/2617-dco-retroactive-signoffs

     Show description for 36e251c
     cliffhall

     authored
     36e251cView commit details

     Copy full SHA for 36e251c

     View code at this pointBrowse repository at this point

   • ci: scan v2/main with a committed CodeQL advanced-setup workflow

     Show description for a781eb3
     

     cliffhall

     and

     claude

     committed
     a781eb3View commit details

     Copy full SHA for a781eb3

     View code at this pointBrowse repository at this point

   • fix(auth): carry a client credential only for the client its store stamp names

     Show description for 24952c5
     

     cliffhall

     and

     claude

     committed
     24952c5View commit details

     Copy full SHA for 24952c5

     View code at this pointBrowse repository at this point

   • Merge pull request #2731 from modelcontextprotocol/v2/fix/2672-carry-secrets-across-backend-switch

     Show description for d0714d5
     cliffhall

     authored
     d0714d5View commit details

     Copy full SHA for d0714d5

     View code at this pointBrowse repository at this point

   • Merge pull request #2729 from modelcontextprotocol/v2/chore/2715-ci-npm-11

     Show description for 44a41d2
     cliffhall

     authored
     44a41d2View commit details

     Copy full SHA for 44a41d2

     View code at this pointBrowse repository at this point

   • Merge pull request #2732 from modelcontextprotocol/v2/feat/2446-web-tls

     Show description for e5479fe
     cliffhall

     authored
     e5479feView commit details

     Copy full SHA for e5479fe

     View code at this pointBrowse repository at this point

   • docs: retroactive DCO signoff for olaservo's unsigned commits (#2617)

     Show description for 57ee659
     olaservo

     committed
     57ee659View commit details

     Copy full SHA for 57ee659

     View code at this pointBrowse repository at this point

   • fix(auth): record owners only for held values, and skip ambiguous hand-off owners

     Show description for cde08e2
     

     cliffhall

     and

     claude

     committed
     cde08e2View commit details

     Copy full SHA for cde08e2

     View code at this pointBrowse repository at this point

   • fix(auth): record a credential's owner when written, and harden the carry-over

     Show description for b4c352f
     

     cliffhall

     and

     claude

     committed
     b4c352fView commit details

     Copy full SHA for b4c352f

     View code at this pointBrowse repository at this point

   • fix(auth): carry a superseded namespace's client secret across a backend switch

     Show description for 26a1b67
     

     cliffhall

     and

     claude

     committed
     26a1b67View commit details

     Copy full SHA for 26a1b67

     View code at this pointBrowse repository at this point

   • fix(subscriptions): stop retrying a subscriptions/listen refused over HTTP

     Show description for 9365059
     

     cliffhall

     and

     claude

     committed
     9365059View commit details

     Copy full SHA for 9365059

     View code at this pointBrowse repository at this point

   • feat(web): optional TLS for the web UI listener

     Show description for b54eb82
     

     cliffhall

     and

     claude

     committed
     b54eb82View commit details

     Copy full SHA for b54eb82

     View code at this pointBrowse repository at this point

   • ci: install pinned npm 11 before every dependency install

     Show description for 6fcbefe
     

     cliffhall

     and

     claude

     committed
     6fcbefeView commit details

     Copy full SHA for 6fcbefe

     View code at this pointBrowse repository at this point
4. Commits on Oct 13, 2026

   • docs: describe the non-registry and bundled cases verify:install-scripts reports (#2712)

     Show description for 105d6f6
     

     cliffhall

     and

     claude

     committed
     105d6f6View commit details

     Copy full SHA for 105d6f6

     View code at this pointBrowse repository at this point

   • fix(scripts): match allowScripts keys and identity the way npm does (#2712)

     Show description for bfa1fbf
     

     cliffhall

     and

     claude

     committed
     bfa1fbfView commit details

     Copy full SHA for bfa1fbf

     View code at this pointBrowse repository at this point

   • chore(deps): deny esbuild/fsevents install scripts; guard unreviewed ones (#2712)

     Show description for 03c7dc3
     

     cliffhall

     and

     claude

     committed
     03c7dc3View commit details

     Copy full SHA for 03c7dc3

     View code at this pointBrowse repository at this point

   • chore(scripts): guard the file set each coverage run measures (#2709)

     Show description for 2b1db6b
     

     cliffhall

     and

     claude

     committed
     2b1db6bView commit details

     Copy full SHA for 2b1db6b

     View code at this pointBrowse repository at this point
5. Commits on Oct 12, 2026

   • Merge pull request #2704 from modelcontextprotocol/v2/fix/2631-cli-boolean-flag-target

     Show description for ca0ab33
     cliffhall

     authored
     ca0ab33View commit details

     Copy full SHA for ca0ab33

     View code at this pointBrowse repository at this point

   • fix(cli): keep the stdio target when an option precedes it (#2631)

     Show description for 786148b
     

     cliffhall

     and

     claude

     committed
     786148bView commit details

     Copy full SHA for 786148b

     View code at this pointBrowse repository at this point

   • fix(auth): apply endpoint overrides when the AS publishes no metadata (#2562)

     Show description for 4914f25
     

     cliffhall

     and

     claude

     committed
     4914f25View commit details

     Copy full SHA for 4914f25

     View code at this pointBrowse repository at this point

   • Merge branch 'v2/main' into v2/fix/2642-mcpdo-proxy-fetch

     cliffhall

     authored
     8be706cView commit details

     Copy full SHA for 8be706c

     View code at this pointBrowse repository at this point

   • chore(pack:verify): assert skills/mcpdo ships and drive an mcpdo tool call (#2650)

     Show description for 80d8730
     

     cliffhall

     and

     claude

     committed
     80d8730View commit details

     Copy full SHA for 80d8730

     View code at this pointBrowse repository at this point