modelcontextprotocol / typescript-sdk
Repository health
Security, maintenance, dependencies and license for modelcontextprotocol/typescript-sdk.
Security
75 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
Security checks (RepoPilot estimate) · 6.4/10
OpenSSF has not scored this repository, so RepoPilot ran some of its checks from public GitHub data. Checks sorted from strongest to weakest.
- Recent activityLast commit 1d ago10/10
- License filePermissive license: MIT10/10
- Tests run on pull requestsCI configured + tests present10/10
- Automated dependency updatesDependabot configured10/10
- Security policySECURITY.md present10/10
- Least-privilege CI tokensWorkflows declare explicit, scoped permissions10/10
- Pinned dependenciesOnly 11/34 actions pinned to SHAs2/10
- Code review before mergeOnly 0/20 recent PRs had requested reviewers2/10
- Static analysis on commitsNo SAST workflow detected0/10
- Branch protectionDefault branch 'main' has no protection rule0/10
Maintenance
Outside contributions: 5 of 89 external pull requests merged (29% of those decided), median 2 days to merge.From the 94 most recently updated pull requests, bots excluded.
Recent releases
- v2.3.15 Oct 2026 · same day as previous
- 1.32.15 Oct 2026 · same day as previous
- @modelcontextprotocol/server@2.3.15 Oct 2026 · same day as previous
- @modelcontextprotocol/server-legacy@2.3.15 Oct 2026 · same day as previous
- @modelcontextprotocol/core@2.3.15 Oct 2026 · same day as previous
Pull requests
- Open
- 27
- 0 stale (60+ days, no update in 30)
- Merged
- 2
- of the 30 latest
- Median time to merge
- 2 days
- From bots
- 3
- not listed below
Open
- #3064 fix(server): refuse includeContext thisServer/allServers without sampling.contextStevenLi-phoenix · opened today
- #3039 fix(client): percent-encode client_secret_basic credentials like the Python SDKgdut4140 · opened 6 days ago
- #3063 fix(core): reject a plain Mcp-Param or Mcp-Name value with invalid characterschrikrah · opened today
- #2996 fix(codemod): migrate constant template literal module specifiersrudycelekli · opened 12 days ago
- #2995 fix(core): match exploded slash-separated URI path variablesrudycelekli · opened 12 days ago
Recently merged
- #3057 fix(server): preserve forwarded params and support modern low-level connectionssteipete · merged 20 Oct 2026
- #3047 feat: Skills extension (SEP-2640) for server and clientKKonstantinov · merged 20 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- felixweinberger24 commits · 39%
- KKonstantinov4 commits · 7%
- mattzcarey4 commits · 7%
- maxisbey3 commits · 5%
- pcarleton2 commits · 3%
Of the 61 most recent commits.
Issues
- Open
- 602
- issues and pull requests, as GitHub counts them
- Median time to close
- 173 days
- from 3 closed of the 40 latest
- Awaiting first reply
- 12
- of 37 open among the 40 latest
- Oldest open
- 2.1 years
Most wanted
- #1264 OpenTelemetry integration out of the box3 reactions · 2 comments
- #1708 StreamableHTTPClientTransport doesn't handle 404 per spec (no session clear + re-init)3 reactions · 9 comments
- #861 StreamableHTTPClientTransport is not implementing Transport properly2 reactions · 3 comments
Rates come from the 40 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
License compatibility
Repo license: MIT · 25 deps checked · 0 potential conflicts.