Skip to content

Conversation

grimmerk
Copy link
Contributor

@grimmerk grimmerk commented Aug 13, 2025

Summary

Upgrades @modelcontextprotocol/sdk peer dependency to v1.17.2 to incorporate a critical bug fix for transport handling in multi-client scenarios.

Problem

The previous SDK version (^1.12.0) contained a bug where the Protocol class would overwrite its internal transport reference when handling concurrent requests from multiple clients. This caused responses to be incorrectly routed to the wrong client connection.

This issue particularly affected production deployments using StreamableHTTP transport where multiple clients connect to the same server instance.

Solution

The SDK v1.17.2 includes the fix from modelcontextprotocol/typescript-sdk#820 which ensures proper transport context isolation by capturing the transport reference at request time through closure.

Compatibility

No breaking changes affecting mcp-adapter

  • All existing tests pass with v1.17.2
  • The v1.14.0 breaking change (reject → decline) doesn't affect this codebase
  • New features between v1.12.0 and v1.17.2 are mostly additive (DNS rebinding protection, OIDC support, enhanced type safety)

Impact

  • ✅ Fixes response routing in multi-client scenarios
  • ✅ Prevents cross-client data leakage
  • ✅ Ensures reliable message delivery in production environments
  • ✅ All existing tests continue to pass
  • ✅ Backward compatible with existing implementations

Testing

pnpm test
# All 19 tests pass ✓
  • Existing unit tests continue to pass
  • Multi-client scenarios now correctly route responses to originating clients
  • Compatible with all current Next.js versions (>=13.0.0)

Related Issues

…ing fix

Upgrades the MCP SDK to version 1.17.2 which includes a critical fix for
transport handling in multi-client scenarios.

The previous SDK version had a bug where the Protocol class would overwrite
its transport reference, causing responses to be sent to the wrong client
when multiple clients were connected. This was particularly problematic for
StreamableHTTP transport in production environments.

The fix ensures that each request maintains its proper transport context
through closure capture, guaranteeing responses are sent to the correct client.

All existing tests pass with the new version, confirming compatibility.

Related: modelcontextprotocol/typescript-sdk#820
@quuu
Copy link
Collaborator

quuu commented Aug 13, 2025

this is great! cc @allenzhou101

@quuu quuu merged commit fc9b09a into vercel:main Sep 10, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants