Source: github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fclient%402.4.0
The release adds the Skills extension (SEP-2640) under new ext/skills subpaths, while package root exports stay unchanged. On the server, SkillsExtension serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template. On the client, SkillsClient provides list(), get(), read() and readDirectory(), and read() checks size, digest and SKILL.md frontmatter, throwing SkillVerificationError on a mismatch.
Token refresh gains an opt-in for authorization servers that reject refresh requests without a scope. OAuthClientProvider can implement an optional scopeForRefresh(tokens) method, and refreshAuthorization() accepts an optional scope. Microsoft Entra ID is cited as a server that answers AADSTS90009 when the client and resource share one app registration. Without either option, the refresh request and saved tokens are unchanged.
Two other changes affect tool definitions. The bundled Ajv validator now uses fast-uri 3.1.8, which rejects $id or $ref values whose text before the first colon is not a valid URI scheme, such as my_tool:output, so those schemas no longer compile. Separately, x-mcp-header on number-typed tool parameters is now rejected, matching the 2026-07-28 spec.
Why it matters if you build agents
Teams building MCP servers or clients that handle agent skills can use the Skills extension, and clients can rely on read() to catch corrupted or altered files. Developers should check tool schemas for $id or $ref values containing a colon, and for number-typed x-mcp-header parameters, since both now fail. Refresh flows against servers like Microsoft Entra ID may need the new scope option.
Get stories like this every weekday
One short email with the day's agent tooling news.