MCP TypeScript SDK 1.29.0
The 1.x line is where most frameworks and agents actually sit. Two of its cells explain a whole class of support tickets: resource is conditional on protected resource metadata, and there's no issuer validation at all.
- Client type
- Reference SDK, 1.x line
- Protocol revision
2025-11-25
Support
MCP TypeScript SDK 1.29.0
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
2025-11-25- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Partial
- Client ID
- Yes
- resource
- Partial
- iss
- No
- Headers
- Yes
- Protocol revision
2025-11-25. This row exists because it's the line most libraries pin, so it sets the real ceiling for a large part of the ecosystem regardless of what the 2.x row says.
Caveats and sources
Each one names the column it qualifies and cites the page it comes from, which is often not the page in the row's primary source.
- Metadata document
- Implemented, and doubly gated: the authorization server must advertise support, and the host application must also expose a metadata document URL on its provider. That second gate is why so many clients built on 1.x still land on dynamic registration. Source
- Sends resource (RFC 8707)
- Gated on discovering RFC 9728 protected resource metadata. A server that publishes none gets no
resourceparameter from any client built on this line. Source - Validates iss (RFC 9207)
- Source-verified absence: the 1.29.0 client auth module sends
resourceand performs no issuer validation on the authorization response. Source
Primary source
This row was last verified July 31, 2026 against the 2026-07-28 revision.