The release log / Changelog
Changelog
New features, improvements, and fixes in every stable xmcp release.
All releases on GitHub ↗Minor Changes
- a0f4654: Add optional
http.maxSubscriptions to limit concurrent subscription streams
per HTTP handler across standalone HTTP, Vercel, Cloudflare, and all HTTP
adapters. Set it to 0 to reject subscriptions/listen before opening a stream;
omitting it preserves the SDK default. This does not limit stream duration or
change ordinary requests, tool-call streaming, or STDIO behavior.
Patch Changes
- d3d89ce: Refresh the package README with current positioning, a tool example, and the full set of integrations, adapters and deployment targets.
Minor Changes
- 516fc7a: Expose current-request SDK authentication through
RequestContext.authInfo and MCP middleware, including listing operations, without retaining authentication across requests.
- ad824fe: Expose a read-only registered tool metadata snapshot on
tools/call MCP middleware as ctx.tool.metadata, with normalized _meta matching discovery results for shared authorization policies.
Patch Changes
- 798942d: Update
@modelcontextprotocol/server to 2.3.0.
Patch Changes
- f42dd7d: Allow static resources to return
inputRequired results so clients can supply input before reading their contents.
Patch Changes
- 92163c9: Update the bundled MCP client SDK to 2.2.0 and its optional peer requirement. This includes upstream OAuth issuer binding, input-required result metadata preservation, and pagination fixes.
Minor Changes
-
318cc48: Add opt-in experimental.inferToolSchemas to generate tool input validation and descriptions from TypeScript types and JSDoc. Resolve imported types and re-exported handlers, refresh schemas during development, and preserve explicit schema overrides. Unsupported inputs fail compilation with actionable diagnostics.
Support property JSDoc constraints for numeric bounds, string lengths, regular expressions, and email/URI/UUID formats, with source-located errors for invalid tags. Emit compact string enums with actionable validation errors and native boolean schemas.
Minor Changes
- 5948dda: Add Hono and SvelteKit adapters for Node.js and Cloudflare Workers, sharing the stateless Fetch runtime with TanStack Start. Add framework detection, route generation, build ordering, and Workers setup to init-xmcp while preserving host TypeScript configuration.
- 5948dda: Add Nuxt, React Router Framework Mode, and Astro adapters using the shared stateless Fetch runtime, with automatic route setup and Node.js/Cloudflare Workers support.
Minor Changes
- a4950f9: Add optional component include/exclude rules by name or tag in xmcp.config.ts. Apply them before registration across tools, prompts, static resources, and resource templates, with generated UI resources following their owning tool.
- 73deb2e: Add opt-in structured execution logging for tools, prompts, and resource reads through
observability.enabled, with execution correlation, timing, safe outcomes, and HTTP trace context.
- 4f501f0: Add the Node.js
xmcp/client entry with createClient and withClient for managed HTTP and STDIO connections. Register sampling, elicitation, and roots handlers before connecting, advertise only configured capabilities, and await cleanup after failed connections or scoped operations.
Patch Changes
- 5d3fe81: Refresh workspace dependencies to Fastify 5.12.5, js-yaml 4.3.2, and Next.js 16.3.6, including the js-yaml and Next.js overrides. This maintenance release does not change public APIs.
Minor Changes
- 7a3097c: Add optional icons, tags, and enabled metadata for tools, prompts, resources, and resource templates. Expose tags under
_meta["xmcp/tags"] and omit disabled components and their generated UI resources from registration, listings, and direct requests.
Minor Changes
- c844b6d: Add
image, audio, and embeddedResource content helpers, available from xmcp and xmcp/cloudflare. Add Node-only file-reading variants under xmcp/node.
- 1656cdc: Support a named
complete export on resource template files for URI argument suggestions, including asynchronous and context-dependent completion callbacks. Export ResourceCompletions for typed callback maps.
- a1f4d67: Add a TanStack Start adapter for React applications on Node.js and Cloudflare Workers, with ESM output, stateless request handling, and automatic setup through init-xmcp.
Minor Changes
- 826c21b: Extend MCP middleware to prompts, resource reads, completion, and component listings, sharing request context across each operation. Check
ctx.method before accessing operation-specific parameters in existing tool middleware.
- 176ac1d: Support a named
mcp middleware export in src/middleware.ts for tool calls across HTTP, STDIO, and Node adapters. Middleware can inspect validated arguments, share request-local values with tools, transform results, or short-circuit execution.
- ae2658a: Allow prompt handlers to return message arrays or full prompt results, preserving message roles, order, descriptions, and metadata. Export the
PromptMessage and GetPromptResult types for typed prompt handlers.
- 0ca4841: Add request-local
set/get values and progress/log helpers to getRequestContext(). Progress is optional without a request token, and logging respects the SDK's capability and level checks.
- b5ca4c8: Add
getRequestContext() for read-only access to client identity, HTTP request details, and the cancellation signal from tool handlers and their async helpers.
Patch Changes
-
e2c4a5b: Fix Vercel deployments logging Vercel Runtime Timeout Error: Task timed out after 300 seconds on every cold start. The build copied dist/http.js into the function, and that entry starts a server of its own and exports nothing. Vercel's Node launcher fell back to serving the port the entry listened on, and the listening socket kept the instance's event loop alive: the invocation that booted the server never settled and was killed once the function's maximum duration was reached, even though the response had already been sent in milliseconds. The instance died with it, so the next request cold started and repeated the cycle.
--vercel builds now use a runtime that exports a request handler and never listens, so the platform owns the server and each invocation ends with its response. Standalone (dist/http.js), adapter, and Cloudflare builds are unchanged.
No release notes provided.
Patch Changes
- 01faeb8: Fix
xmcp build --cf / xmcp dev --cf failing with Module not found: Can't resolve '.../node_modules/xmcp/src/runtime/platforms/cloudflare/worker.ts' since src/ stopped shipping in the published package (0.7.1). The Cloudflare worker runtime is now prebuilt into dist/runtime/cloudflare-worker.js like the other runtimes, and the compiler uses that artifact as the --cf entry instead of bundling xmcp's TypeScript source from node_modules.
Minor Changes
- bbe742e: Add
extra.sample() so tool handlers can request LLM completions from the connected client via MCP sampling (sampling/createMessage), mirroring extra.elicit(). Supports text/image/audio messages, systemPrompt, maxTokens, modelPreferences, temperature, stopSequences, includeContext, and metadata, and exports the SampleRequest/SampleResult types. The tools/toolChoice sampling loop and task-augmented sampling are rejected with a clear error until the client tool-call flow is wired.
Patch Changes
- 10bdd57: Upgrade to MCP protocol revision 2026-07-28 via the TypeScript SDK v2 (
@modelcontextprotocol/server and @modelcontextprotocol/client replace the v1 @modelcontextprotocol/sdk monolith as optional peers, bundled into the runtime).
- All transports (HTTP, STDIO, Cloudflare Workers, Next.js/Express/Fastify/NestJS adapters) serve both protocol generations: 2026-07-28 envelope requests (including
server/discover, resultType, cacheable list results) natively, and 2025-era clients through the SDK's stateless fallback. HTTP stays strictly stateless — a fresh server per request on both paths.
- New multi round-trip input API for tools:
inputRequired, acceptedContent, inputResponse, and createRequestStateCodec are re-exported from xmcp, and tool extras expose inputResponses/requestState. Tools returning inputRequired(...) serve both eras (the legacy shim converts to real elicitation for 2025 clients). extra.elicit() keeps working on 2025-era connections and throws a descriptive error on 2026-07-28 requests.
- Tool/prompt/resource schemas are registered through the Standard Schema interface with per-field conversion, keeping the
zod ^3.25.76 || ^4.0.0 peer range working without cross-instance zod composition.
- Default CORS
allowedHeaders now include the Mcp-Method and Mcp-Name headers required on Streamable HTTP POSTs by 2026-07-28.
- Client helpers (
createHTTPClient, createSTDIOClient) negotiate the protocol version automatically (server/discover probe with fallback to initialize).
- Server bundles remain single-file (the SDK's lazy validator imports are inlined by the compiler and the runtime prebuild).
- Fix: the Express adapter no longer references never-injected CORS globals; it reads the injected
HTTP_CORS_CONFIG like the other adapters.
Changes
- Split the development compiler into
@xmcp-dev/compiler. Existing xmcp dev,
xmcp build, and xmcp create scripts continue to work through a small shim,
but projects must install the matching compiler version as a development
dependency: npm i -D @xmcp-dev/compiler@0.8.0.
- Production installs no longer include Rspack or TypeScript. Built HTTP and
stdio artifacts remain self-contained and can run without
node_modules.
- Added the
xmcp/config export so compiler validation uses the config schema
from the installed runtime package.
- Removed the duplicate runtime embedded in the CLI and removed compiler-only
schema and Chalk code from the HTTP runtime.
Measures the split independently with the same HTTP fixture on xmcp@0.7.1 and xmcp@0.8.0: the production install falls 89.99% (101.12 MiB to 10.12 MiB), while the generated HTTP artifact remains nearly flat (-1.07%).
Patch Changes
- e3a9f60: Stop shipping
src in the published package. Every entry point in main,
types, bin, exports, and typesVersions resolves into dist, and no
source maps reference src, so the directory was dead weight in the tarball:
223 files down to 71.
Minor Changes
- d5c0f46: Add a Fastify adapter, serve the MCP Server Card at
/.well-known/mcp/server-card.json, fix stateless HTTP handling of repeated
clientInfo headers, and update dependencies to resolve known security
advisories.
Core Changes
- Release to address security issues
Core Changes
- feat: introducing customHome config option
- automatically setup path alias on init-xmcp
- feat: skip type check on nextjs adapter mode
- feat: update adapter mode tool generated syntax
- fix: include tsx files in tsconfig for default templates
- add CSS module type declarations for zero-config ts support
- feat: example initialization via cli
- add globals.css auto-detection
Contributors
@valebearzotti
@fveiraswww
@mdottavio
Full Changelog: https://github.com/basementstudio/xmcp/compare/v0.5.6...v0.5.7
Core Changes
- Integrate MCP apps protocol
- update all React & Next dependencies
- Replace CDN externals with direct bundling
- replace individual inputs with toggle selector for init-xmcp
- Support Zod v4 - backwards compatible with v3
- Tailwind and CSS loaders to React tools
- always preserve mcp-protocol-version and mcp-session-id headers
- bump better-auth to v1.4.5 - address security issues
Full Changelog: https://github.com/basementstudio/xmcp/compare/v0.5.4...v0.5.5
Core Changes
- Improve runtime file selection - smaller output size
- Skip type checking config
- Reduce download size by 30%
- Swap webpack compiler with rspack - improve compilation times
- Rework config workflow
- React code transpilation with rspack
- Update template UI
Full Changelog: https://github.com/basementstudio/xmcp/compare/v0.4.0...v0.5.0
Core Changes
- Add support for Structured Content output
- Complete OpenAI widget metadata & handling
- Experimental SSR + Hydration feature. Support returning React components in tool handlers.
- Fix toggle off paths from config on unselection (create-xmcp-app)
- bug fixing & improvements
New Contributors
- @fedealvarezcampos made their first contribution
- @fveiraswww made their first contribution
Full Changelog: https://github.com/basementstudio/xmcp/compare/v0.3.4...v0.3.5
What's Changed
- Support for tools returning UI & automatically handling resource creation & injection.
- Simpler Apps SDK DX
What's Changed
- Added support for resources
- Added option to customize initialized components (create-xmcp-app)
- Added CLI support for resources
- Next.js adapter - Improved support to work on any route
Contributors
@valebearzotti
New Contributors
@FranFigueroa
Full Changelog: https://github.com/basementstudio/xmcp/compare/v0.2.1...v0.3.0
What's Changed
- import { tools } compatible with the AI SDK
- Adds autocomplete to tools registry
- Fix generate-config in init-xmcp to output valid paths object
Misc
- Added xmcp <> AI SDK example
- Added xmcp <> MCP UI example
- Update docs to reflect prompts
- Update docs to reflect Cursor and Claude Desktop connections
New Contributors
- @joelachance contributed on the AI SDK tools POC
Full Changelog: https://github.com/basementstudio/xmcp/compare/v0.2.0...v0.2.1
Core changes
What's Changed
- Support for prompts
- Upgrade server registration to newer API
- Tools / prompts return content to fail gracefully and indicate errors
- Prompts path handling in xmcp.config.ts
- Fix: support comments and trailing commas in tsconfig.json
Full Changelog: https://github.com/basementstudio/xmcp/compare/v0.1.13...v0.2
Patch Changes
- Add template link to xmcp.dev
Patch Changes
- Fix copying full URL on template
Core changes
- Add
ToolExtraArguments arguments type + usage example
- remove useLocalXmcp flag from cli
- add nvmrc config
- support for Bun package manager
- HTTP transport to use dynamic port allocation & normalize config usage
- Shorten string/number tool response syntax
Misc
- Contribution Guidelines setup
Full Changelog: https://github.com/basementstudio/xmcp/compare/v0.1.7...v0.1.8
No release notes provided.
The TypeScript MCP Framework
xmcp is a framework for building and shipping MCP applications with TypeScript. Designed with DX in mind, it streamlines development and lowers the barrier to entry for anyone looking to create and deploy powerful tools on top of the Model Context Protocol ecosystem.
Features
⊹ File System Routing - Tools are auto-registered from a tools directory
⊹ Hot Reloading - Instant development feedback
⊹ Middlewares - Toolkit for shipping authentication and custom middlewares
⊹ Extensible Configuration - Customizable configuration for your MCP server
⊹ Deploy Anywhere - Flexible deployment across any platform
⊹ Vercel Support - Deploy-ready for Vercel out of the box