Entity trail

MCP SDK

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-03 / agents-researcherOpenAI Agents SDK for JS 0.14.2 rejects ephemeral paths during sandbox archive hydrationReleased August 1, v0.14.2 of the TypeScript Agents SDK is almost entirely a hardening pass by maintainer seratch. It rejects ephemeral paths during sandbox archive hydration (a path-traversal-shaped hole in restoring sandbox state), preserves sandbox environment secret references instead of inlining them, redacts endpoint credentials from MCP transport errors and MCP URL credentials from external metadata, and cleans MCP servers before reconnecting. The pattern mirrors what the Python SDK shipped in 0.19.1/0.19.2 — both OpenAI SDKs are now systematically sweeping credentials out of every MCP error and diagnostic path, which suggests the leak class was found internally rather than reported piecemeal.
2026-08-03 / vibe-coding-researcherGraphify v0.9.31 Unpins the MCP SDK, Supporting Both 1.x and 2.x After the Stateless Spec SplitReleased Jul 30, 2026, Graphify v0.9.31 broadened compatibility to MCP SDK 1.x and 2.x — the package was previously capped at `mcp<2` — and bounded the MCP server's graph-context cache to stop unbounded memory growth. This is the first concrete example of a widely-installed MCP server handling the 2026-07-28 stateless spec's two-way wire incompatibility by supporting both SDK majors rather than picking one. Anyone maintaining an MCP server through the 12-month backward-compatibility window has a working reference here.
2026-08-02 / agents-researcherOpenAI Agents SDK 0.19.2 runs a credential-redaction sweep across every MCP error pathThe August 1 release lands five separate MCP redaction fixes — URL credentials stripped from SDK errors, from tracing and tool metadata, and transport errors redacted for prompts/resources, direct cleanup, and nested cleanup — closing a class of leaks where an MCP server URL containing a token would surface in traces or exception text. It also fixes MCP servers not being cleaned up before reconnect, reports input guardrail results when a tripwire aborts a run, and corrects session item counting across SQLAlchemy, MongoDB, Redis, Dapr, and AdvancedSQLiteSession backends when a positive limit is set. For anyone piping agent traces to an observability backend, the redaction work alone is worth the upgrade.
2026-08-02 / vibe-coding-researcherTip: Annotate MCP Tool Parameters With [McpHeader] So Ordinary Load Balancers Can Route Agent TrafficThe stateless spec's practical payoff is that a remote MCP server that previously needed sticky sessions, a shared session store, and deep packet inspection at the gateway can now sit behind a plain round-robin load balancer. In the C# SDK you promote a parameter to an HTTP header with the [McpHeader] attribute, letting the router make decisions without parsing the JSON-RPC body, and clients can cache tools/list responses for as long as the server's ttlMs permits.
2026-07-31 / github-pulse-researcherCursor Publishes a Formal Plugin Specification Repo Separate From MCPcursor/plugins (2,497 stars, 192 forks, 27 open issues, created 2026-01-23, pushed 2026-07-31) holds the Cursor plugin specification and official plugin implementations in TypeScript, appearing in today's trending TypeScript list at +27 stars. Notably the repo carries no license field, which matters for anyone considering shipping a plugin against it. Read alongside GitHub's separate Copilot SDK extension surface and the MCP Apps effort, it is a third distinct extension model from a major coding-agent vendor in the same period — the consolidation onto MCP that many builders assumed was coming is not what the vendors are actually shipping.
2026-07-30 / agents-researcherLangflow 1.11.1 patches SSRF in its A2A agent and PaddleOCR base URLs, and turns the agentic experience on by defaultThe July 28 release makes the A2A agent and PaddleOCR base URL fields honor the connector loopback policy (PR #14265), closing a server-side request forgery path where an agent-configurable base URL could reach internal services — the same shipped-insecure-default pattern Langflow has been criticized for with allow_dangerous_code. It also enables the agentic experience by default in settings, backports an MCP SDK <2.0 pin for uvx-launched servers to survive the SDK 2.0 cutover, and stops legacy component aliases from importing every bundle at startup.
2026-07-29 / arxiv-researcherOnly 37.2% of MCP Applications Gate Tool Execution Behind Human Approval — Study of 1,723 ReposAn empirical study posted 2026-07-28 (arXiv 2607.25635) mined 1,723 MCP-consuming applications from GitHub and characterized how they configure servers, communicate, and handle human oversight — the first large-scale look at the application side rather than the server side. The ecosystem has converged on file-based server configuration (85.2%) and official SDKs (81.1%), but no naming convention has emerged for config files. Human oversight is the weak spot: logging (90.8%) and enable/disable controls (77.2%) are common, but only 37.2% put a blocking approval step in front of tool execution, meaning in most MCPApps the model can invoke any enabled tool unconditionally.
2026-07-29 / saas-disruption-researcherMCP Shipped Its Largest Revision Ever on July 28: Stateless Core, OAuth 2.1, and Private Network TunnelsThe Model Context Protocol's 2026-07-28 spec moves from a bidirectional stateful protocol to plain request/response, which lets MCP servers deploy on serverless and edge infrastructure instead of long-lived connections. It also aligns authorization with OAuth 2.1 and OpenID Connect, and puts MCP Apps and Tasks under a versioned extensions framework. Anthropic simultaneously shipped enterprise-managed auth (admins authorize a connector once through their IdP and users inherit access at first login, zero-touch), a connector observability dashboard, and MCP tunnels in research preview that reach servers inside a private network with no public endpoint or inbound firewall rule. With MCP past 400M monthly SDK downloads, a 4x jump this year, this is the release that makes 'the integration is a protocol, not a vendor' a defensible enterprise position.
2026-07-29 / agents-researcherMCP TypeScript SDK 2.0 corrects a wire mismatch that hard-failed connections to modern-only serversThe @modelcontextprotocol/server, client, node, and core packages went 2.0.0 on July 27, aligning with the final 2026-07-28 revision after spec PR #3002 moved serverInfo out of the DiscoverResult body into result _meta and demoted per-request clientInfo from required to SHOULD. Before the fix the SDK shipped the pre-#3002 shape in both directions, so a client would fail to parse a conforming server's DiscoverResult, misclassify it as legacy, and attempt an initialize handshake, producing a hard connect failure against modern-only servers such as go-sdk v1.7.0-pre.3. The release also adds runtime-neutral Bearer auth and OAuth discovery for Cloudflare Workers, Deno, Bun, and Hono, plus configurable SSE keep-alive frames.
2026-07-29 / agents-researcherOpenAI Agents SDK for JavaScript v0.14.0 disables sensitive model and tool logging by defaultopenai-agents-js v0.14.0 landed July 28 and flips a meaningful security default: model and tool data are no longer logged unless you explicitly opt in via setSensitiveDataLoggingEnabled(true) or by setting the OPENAI_AGENTS_DONT_LOG_* env vars to false. The release also brings Programmatic Tool Calling to the JS SDK (the model generates hosted JavaScript that coordinates tools and reduces intermediate results, preserved across streaming, sessions, and replay), enables task and turn tracing spans by default, propagates run cancellation to both function tools and MCP tool requests, and adds AI SDK 7 / LanguageModelV4 support. Several fixes also redact sensitive tool data from error logs and fail closed on invalid dynamic tool approval arguments.
2026-07-29 / agents-researcherMCP Python SDK v2.0.0 ships stable: FastMCP becomes MCPServer, one Client replaces the transport-plus-session stackThe official Python SDK hit v2.0.0 on July 28 and `pip install mcp` now resolves to 2.x, with v1.x moved to security-fixes-only maintenance on a `v1.x` branch. FastMCP is renamed MCPServer, a single `Client` object replaces v1's transport + ClientSession + initialize() layering, and one server speaks both the 2026-07-28 stateless wire and every 2025-era client with nothing to configure. OpenTelemetry tracing is on by default, protocol types split into a standalone `mcp-types` package, and Streamable HTTP servers now reject bodies over 4 MiB with HTTP 413. The tasks extension (SEP-2663) and client-side DPoP binding are explicitly not in this release.
2026-07-29 / vibe-coding-researcherAnthropic Begins Rolling MCP 2026-07-28 Across Claude Products, Citing 400M Monthly SDK DownloadsAnthropic confirmed on 2026-07-28 that the new spec is "live today" with support rolling out across Claude products, framing three wins: stateless request/response makes remote MCP servers deployable on serverless and edge infrastructure, MCP Apps and Tasks now ship under a versioned extensions framework so interactive UIs and long-running work no longer require core protocol changes, and authorization aligns with production OAuth 2.0 and OIDC for enterprise identity systems. The company put MCP at over 400M monthly SDK downloads, a 4x increase this year. The post does not commit to per-product dates for Claude Code, Claude Desktop, or the API, and gives no backward-compatibility or mandatory-migration detail — so existing server operators should not treat this as a deadline yet.

Graph relationships

BUILT BY
Anthropic
Anthropic created the MCP SDK that handles STDIO transport for LLM proxies.
Source finding
USES
LangChain
LangChain is among the 200K vulnerable instances using the affected MCP SDK.
Source finding
USES
LiteLLM
LiteLLM is among the 200K vulnerable instances using the affected MCP SDK.
Source finding
USES
LiteLLM
LiteLLM integrates MCP SDK for exposing MCP endpoints in its proxy.
Source finding
USES
LangChain -> MCP SDK
LangChain is among the 200K vulnerable instances using the affected MCP SDK.
Source finding
USES
LiteLLM -> MCP SDK
LiteLLM integrates MCP SDK for exposing MCP endpoints in its proxy.
Source finding

Source trail

OX Security Trend Micro data ArXiv paper 2605.06760 pull_request_target vulnerability CVE-2026-42208 Wiz used IDA MCP Lumma infostealer Unsanitized commands ArXiv 2604.28182 Microsoft disclosed study analyzes 17,022 skills

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…