chore(deps): bump @modelcontextprotocol/sdk from 1.30.0 to 1.31.0

[dependabot]

Bumps @modelcontextprotocol/sdk from 1.30.0 to 1.31.0.

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.31.0

Upgrade notes

• Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
• Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

• [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @​maxisbey in modelcontextprotocol/typescript-sdk#2888
• chore: bump version to 1.31.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2890

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

• [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @​maxisbey in modelcontextprotocol/typescript-sdk#2717
• fix(auth): preserve resource URI without trailing slash (#1968) by @​MukundaKatta in modelcontextprotocol/typescript-sdk#1972
• chore: bump version to 1.30.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2848

New Contributors

• @​MukundaKatta made their first contribution in modelcontextprotocol/typescript-sdk#1972

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits

• 4b0051f chore: bump version to 1.31.0 (#2890)
• 51ad4f0 [v1.x] Bind stored OAuth credentials to the authorization server that issued ...
• 289ac2c chore: bump version to 1.30.1 (#2848)
• 12b4256 fix(auth): preserve resource URI without trailing slash (#1968) (#1972)
• a9f6eb7 [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON...
• See full diff in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: 030c234

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Peer contract change lacks changeset

Consumers using MCP SDK 1.30.0 no longer satisfy the published agents peer contract. The repository requires a changeset for package API changes, but this PR has none.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[agent-think]

🟡 agents import sizes: 2 entry points grew

	Entry point	Exports	Largest gzip change	Size now
🟡	agents/mcp	15 resized	up to +2.5 KiB (+0.67%)	383.2 KiB
🟡	agents/experimental/webmcp	1 resized	+2.5 KiB (+2.93%)	87.7 KiB

Changed exports (16)

	Import	Gzip change	Size now
🟡	agents/mcp#createLegacyMcpHandler	+2.5 KiB (+0.67%)	383.2 KiB
🟡	agents/mcp#experimental_createMcpHandler	+2.5 KiB (+0.66%)	383.3 KiB
🟡	agents/experimental/webmcp#registerWebMcp	+2.5 KiB (+2.93%)	87.7 KiB
🟡	agents/mcp#createMcpHandler	+2.5 KiB (+0.63%)	395.4 KiB
🟡	agents/mcp#WorkerTransport	+2.5 KiB (+0.7%)	353.1 KiB
🟡	agents/mcp#normalizeServerId	+2.1 KiB (+0.61%)	349.4 KiB
🟡	agents/mcp#RPCClientTransport	+2.1 KiB (+0.61%)	349.4 KiB
🟡	agents/mcp#RPCServerTransport	+2.1 KiB (+0.61%)	349.4 KiB
🟡	agents/mcp#getMcpAuthContext	+2.1 KiB (+0.61%)	349.4 KiB
🟡	agents/mcp#SSEEdgeClientTransport	+2.1 KiB (+0.61%)	349.5 KiB
🟡	agents/mcp#ElicitRequestSchema	+2.1 KiB (+0.6%)	349.4 KiB
🟡	agents/mcp#MCP_SERVER_ID_MAX_LENGTH	+2.1 KiB (+0.6%)	349.4 KiB
🟡	agents/mcp#StreamableHTTPEdgeClientTransport	+2.1 KiB (+0.6%)	349.5 KiB
🟡	agents/mcp#RPC_DO_PREFIX	+2.1 KiB (+0.6%)	349.4 KiB
🟡	agents/mcp#McpAgent	+2.1 KiB (+0.6%)	349.4 KiB
🟡	agents/mcp#DurableObjectEventStore	+2.1 KiB (+0.6%)	349.4 KiB

How this works

Each runtime export is bundled on its own, minified, and gzipped. Changes smaller than 100 B, or smaller than 1% and 1 KiB, are ignored. Growth over 10% or 5 KiB is marked 🔴. This report is informational and does not fail CI. The workflow artifact contains every measurement.

_{Compared f2f745b5 → 030c2347 · workflow run · reported by agent-think[bot]}

[pkg-pr-new]

Open in StackBlitz

agents

npm i https://pkg.pr.new/agents@2516

@cloudflare/ai-chat

npm i https://pkg.pr.new/@cloudflare/ai-chat@2516

@cloudflare/codemode

npm i https://pkg.pr.new/@cloudflare/codemode@2516

hono-agents

npm i https://pkg.pr.new/hono-agents@2516

@cloudflare/shell

npm i https://pkg.pr.new/@cloudflare/shell@2516

@cloudflare/think

npm i https://pkg.pr.new/@cloudflare/think@2516

@cloudflare/voice

npm i https://pkg.pr.new/@cloudflare/voice@2516

@cloudflare/worker-bundler

npm i https://pkg.pr.new/@cloudflare/worker-bundler@2516

commit: 030c234

[mattzcarey]

Superseded by #2573, which updates @modelcontextprotocol/client and @modelcontextprotocol/server to 2.2.0 together (so both resolve the same core) and @modelcontextprotocol/sdk to 1.31.0 with one lockfile.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.