---
title: "MCP TypeScript SDK 2.1.0 ships DPoP OAuth support"
slug: "mcp-typescript-sdk-210-ships-dpop-oauth-support"
published: "2026-10-15"
beat: "Tools"
tags: ["Tools"]
creator: "Agentry Newsroom"
editor: "Susanne Sperling, Editor — Human in the Loop"
tools: ["Claude (Anthropic)", "Perplexity Sonar"]
creativeWorkStatus: "verified"
dateReviewed: "2026-10-15"
aiActArticle50: "compliant"
humanView: "https://agentry.news/tools/mcp-typescript-sdk-210-ships-dpop-oauth-support"
agentView: "https://agentry.news/agent/mcp-typescript-sdk-210-ships-dpop-oauth-support"
---# MCP TypeScript SDK 2.1.0 ships DPoP OAuth support

> The Model Context Protocol TypeScript SDK released version 2.1.0 with optional DPoP sender-constrained access tokens and request-time OAuth scope-challenge handling, strengthening authentication betwe

*Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. [AI policy](/ai-policy).*

The Model Context Protocol TypeScript SDK released version 2.1.0 with optional **DPoP (Demonstration of Proof-of-Possession) sender-constrained access-token support** and **request-time OAuth scope-challenge handling**, according to [Agentry News](https://agentry.news/agent/mcp-typescript-sdk-210-ships-dpop-oauth-auth). The update affects core packages including `@modelcontextprotocol/core`, `@modelcontextprotocol/client`, `@modelcontextprotocol/server`, and `@modelcontextprotocol/node`.

## DPoP Proof Generation for Agents

DPoP is a cryptographic mechanism that binds access tokens to a specific client's public key, preventing token theft and replay attacks. The MCP SDK now includes the `OAuthClientProvider.dpop()` method, which returns a `DpopSession` capable of generating DPoP proofs automatically during agent-to-server communication [WorkOS](https://workos.com/blog/mcp-sdk-dpop-and-scope-challenges). This is critical for agent infrastructure because agents frequently make autonomous requests to external services—a stolen token without proof-of-possession binding becomes useless to an attacker.

When an OAuth server challenges a client with a `use_dpop_nonce` response, the SDK now handles proof regeneration and retries the authorization request transparently. This allows agents to complete authentication flows without developer intervention, reducing the complexity of building multi-hop credential systems.

## Scope-Challenge Handling at Request Time

The second major feature addresses a common OAuth limitation: insufficient permissions discovered mid-request. Previously, agents would simply fail when hitting an endpoint that required scopes they hadn't requested upfront. Version 2.1.0 now supports **`insufficient_scope` challenges** triggered via HTTP 403 responses. Rather than terminating the request, the SDK can detect these challenges and prompt the OAuth provider to grant the missing permissions before retrying [Agentry News](https://agentry.news/agent/mcp-typescript-sdk-210-ships-dpop-oauth-auth).

This is particularly valuable in agent workflows where the full scope of required permissions cannot be known in advance—for example, an agent might discover mid-execution that it needs write access to a resource it initially only read. The request-time challenge pattern lets agents adapt their permission model dynamically.

## Developer Impact

Both features remain optional; existing MCP SDK applications continue to work without modification. Developers building agents that interact with OAuth-protected APIs can adopt DPoP incrementally by switching from standard token providers to the new `dpop()` variant. The scope-challenge handling operates transparently once enabled, requiring no changes to business logic.

Activity on the MCP TypeScript SDK GitHub repository, including a package-version pull request dated September 23, 2026, corroborates ongoing development and publication of the 2.1.0 release line.