# MCP TypeScript SDK 2.4.0 adds Skills extension and refresh-token scope option

published: 2026-10-23T20:05:57.009Z
topic: mcp
source: https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/%40modelcontextprotocol%2Fclient%402.4.0
url: https://aiagentnews.io/stories/mcp-typescript-sdk-2-4-0-adds-skills-extension-and-refresh-token-scope-option

The Model Context Protocol TypeScript SDK released client version 2.4.0 with a new Skills extension and an opt-in scope parameter for token refresh. The release also tightens validation of number-typed tool parameters marked with x-mcp-header and updates the bundled Ajv validator.

The release adds the Skills extension (SEP-2640) under new ext/skills subpaths, while package root exports stay unchanged. On the server, SkillsExtension serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template. On the client, SkillsClient provides list(), get(), read() and readDirectory(), and read() checks size, digest and SKILL.md frontmatter, throwing SkillVerificationError on a mismatch.

Token refresh gains an opt-in for authorization servers that reject refresh requests without a scope. OAuthClientProvider can implement an optional scopeForRefresh(tokens) method, and refreshAuthorization() accepts an optional scope. Microsoft Entra ID is cited as a server that answers AADSTS90009 when the client and resource share one app registration. Without either option, the refresh request and saved tokens are unchanged.

Two other changes affect tool definitions. The bundled Ajv validator now uses fast-uri 3.1.8, which rejects $id or $ref values whose text before the first colon is not a valid URI scheme, such as my_tool:output, so those schemas no longer compile. Separately, x-mcp-header on number-typed tool parameters is now rejected, matching the 2026-07-28 spec.

## Why it matters if you build agents

Teams building MCP servers or clients that handle agent skills can use the Skills extension, and clients can rely on read() to catch corrupted or altered files. Developers should check tool schemas for $id or $ref values containing a colon, and for number-typed x-mcp-header parameters, since both now fail. Refresh flows against servers like Microsoft Entra ID may need the new scope option.