@modelcontextprotocol/client v2.4.0：弃用 number 参数
@modelcontextprotocol/[email protected]
推荐理由
v2.4.0 引入了针对 number 类型参数的强制弃用和 schema 校验收紧，不兼容旧版 MCP 规范的开发者必须立即调整代码，否则会导致工具列表为空或编译报错。
Minor Changes
次要更改
- #3085 a633756 Thanks @claude! - Add an opt-in for sending scope on refresh-token requests, for authorization servers that reject a refresh without it (Microsoft Entra ID answers AADSTS90009 when the client and the resource are the same app registration, #2718). OAuthClientProvider gains an optional scopeForRefresh(tokens): auth(), and so the transports and withOAuth, sends the string it returns. refreshAuthorization() gains an optional scope. When a scope is sent and the response has none, the sent scope is kept on the returned tokens. Without either option the refresh request and the saved tokens are unchanged.
- #3047 46d9c99 Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.
- @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
- @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
- @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
- @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.
- SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.
- Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().
- #3085 a633756 感谢 @claude！- 为刷新令牌请求添加可选的 scope 发送选项，以支持拒绝无此参数刷新令牌的授权服务器（当客户端与资源为同一应用注册时，Microsoft Entra ID 会返回 AADSTS90009，#2718）。OAuthClientProvider 新增可选方法 scopeForRefresh(tokens): auth()，因此传输层和 withOAuth 会发送其返回的字符串。refreshAuthorization() 新增可选 scope 参数。当发送了 scope 且响应中未包含 scope 时，将保留发送的 scope 到返回的令牌中。若未使用任一选项，刷新请求和保存的令牌保持不变。
- #3047 46d9c99 感谢 @KKonstantinov、@tobi-oye、@mattzcarey！- 添加 Skills 扩展（SEP-2640），可通过新的 ext/skills 子路径访问；包根级导出保持不变。
- @modelcontextprotocol/server/ext/skills: SkillsExtension（attach(server) 提供 skills/list、skills/get、resources/directory/read 以及 skill://{+path} 资源模板）、SkillsExtension.load(files) 返回带有 entries 和 reload() 方法的 SkillCatalog、memorySkillFiles 实现的 SkillFiles 存储适配器、用于生成目录的 SkillSource、skillEntry 以及 SkillCatalogError。无效技能会被跳过并附带警告（onWarning），或在严格模式下失败。字节为有效 UTF-8 的文件无论其 MIME 类型如何均以文本形式提供；其他任何文件则以 base64 blob 形式提供。
- @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) 和 nodeSkillFiles(folder)。
- @modelcontextprotocol/client/ext/skills: SkillsClient 包含 list()（遇到无效条目时会抛出异常；skipInvalid: true 会保留有效条目，并将其余条目作为 invalid 返回）、get()、read(skill, path?)（验证 size、digest 和 SKILL.md frontmatter，不匹配时抛出 SkillVerificationError；若从响应缓存中获取的副本检查失败，则先以 cacheMode: 'refresh' 重新获取一次）以及 readDirectory()。
- @modelcontextprotocol/core/ext/skills: schemas、types 和 constants，包括 SKILL_LIMITS。结果 schema 遵循稳定规范，因此 ttlMs 和 cacheScope 为必填项。
- SkillsExtension.attach 属于 @experimental：扩展与服务器的连接方式可能在次要版本中发生变化。Skills API 的其他部分保持稳定。
- 适用于 2025-11-25 和 2026-07-28。仅在 2026-07-28 上，服务器会发送缓存字段（ttlMs、cacheScope），且 SkillsClient 要求这些字段并从 list()、get() 和 readDirectory() 返回它们。
Patch Changes
补丁更改
- #3083 ef38c67 Thanks @claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.
- #2762 b022522 Thanks @pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.
- Updated dependencies [46d9c99]:
- @modelcontextprotocol/[email protected]
- #3083 ef38c67 感谢 @claude！- 内置的 Ajv 验证器现已使用 fast-uri 3.1.8 构建（此前为 3.1.0）。fast-uri 3.1.6 及更高版本会拒绝 $id 或 $ref，如果其第一个冒号前的文本不是有效的 URI 方案（如 my_tool:output），或者其 URN 命名空间无效（如 urn:my_tool:output）：使用此类引用的模式将不再编译通过，携带该引用的工具将因 invalid-schema 错误而失败。不带冒号的下划线（如 my_tool_output）以及指向 #/$defs/... 或 #/definitions/... 的 $ref 不受影响。
- #2762 b022522 感谢 @pcarleton！- 现在将拒绝类型为 number 的工具参数上的 x-mcp-header，这与 2026-07-28 规范一致（“不允许类型为 number 的参数”；客户端必须从 tools/list 中排除此类工具）。此前接受 number 类型仅是为了满足一个旧的合规性测试用例，该用例随后已被修正。integer、string 和 boolean 类型不受影响。
- 更新依赖项 [46d9c99]：
- @modelcontextprotocol/[email protected]
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力