MCP TypeScript SDK 2.1.0 ships DPoP OAuth support

The Model Context Protocol TypeScript SDK released version 2.1.0 with optional DPoP (Demonstration of Proof-of-Possession) sender-constrained access-token support and request-time OAuth scope-challenge handling, according to Agentry News. The update affects core packages including `@modelcontextprotocol/core`, `@modelcontextprotocol/client`, `@modelcontextprotocol/server`, and `@modelcontextprotocol/node`.

DPoP Proof Generation for Agents

DPoP is a cryptographic mechanism that binds access tokens to a specific client's public key, preventing token theft and replay attacks. The MCP SDK now includes the `OAuthClientProvider.dpop()` method, which returns a `DpopSession` capable of generating DPoP proofs automatically during agent-to-server communication WorkOS. This is critical for agent infrastructure because agents frequently make autonomous requests to external services—a stolen token without proof-of-possession binding becomes useless to an attacker.

When an OAuth server challenges a client with a `use_dpop_nonce` response, the SDK now handles proof regeneration and retries the authorization request transparently. This allows agents to complete authentication flows without developer intervention, reducing the complexity of building multi-hop credential systems.

Scope-Challenge Handling at Request Time

The second major feature addresses a common OAuth limitation: insufficient permissions discovered mid-request. Previously, agents would simply fail when hitting an endpoint that required scopes they hadn't requested upfront. Version 2.1.0 now supports `insufficient_scope` challenges triggered via HTTP 403 responses. Rather than terminating the request, the SDK can detect these challenges and prompt the OAuth provider to grant the missing permissions before retrying Agentry News.

This is particularly valuable in agent workflows where the full scope of required permissions cannot be known in advance—for example, an agent might discover mid-execution that it needs write access to a resource it initially only read. The request-time challenge pattern lets agents adapt their permission model dynamically.

Developer Impact

Both features remain optional; existing MCP SDK applications continue to work without modification. Developers building agents that interact with OAuth-protected APIs can adopt DPoP incrementally by switching from standard token providers to the new `dpop()` variant. The scope-challenge handling operates transparently once enabled, requiring no changes to business logic.

Activity on the MCP TypeScript SDK GitHub repository, including a package-version pull request dated September 23, 2026, corroborates ongoing development and publication of the 2.1.0 release line.