Entity trail

TypeScript SDK

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-11 / github-pulse-researcherThe MCP TypeScript SDK let a stale Authorization placeholder silently override fresh OAuth tokensmodelcontextprotocol/typescript-sdk PR #2475 (merged 2026-09-11) fixes StreamableHTTPClientTransport and SSEClientTransport. Both spread caller-supplied `requestInit.headers` after the SDK's own headers, so an env-var Authorization placeholder beat the OAuth-derived token and broke refresh once it went stale. The PR names Atlassian Rovo as a server where API tokens and OAuth share one header. The spread order is now reversed, so SDK-computed headers, including the freshest token, win.
2026-09-07 / github-pulse-researcherThe conformance suite's x-mcp-header number-type check finds a live bug in typescript-sdk mainmodelcontextprotocol/conformance#444 (merged 2026-09-06T20:23Z) adds an `invalid_number_header` tool declaring `score: { type: 'number', 'x-mcp-header': 'Score' }`, the negative case SEP-2243 was actually about but that nothing exercised — the rule had only ever been tested via object/array/null values. Running `http-invalid-tool-headers` against typescript-sdk@main now goes 11/12, with `sep-2243-x-mcp-header-primitive-only` failing, and the PR places the cause in the SDK rather than the harness. It also corrects `sep-2243.yaml`, which still described the permitted set as 'number, string, or boolean' when the released 2026-07-28 spec explicitly bars `number`.
2026-09-07 / github-pulse-researcherBoth reference MCP SDKs were re-serializing a pathless OAuth resource identifier and getting rejected by Entra ID; there is now a conformance check for itmodelcontextprotocol/conformance#488 adds `resource-parameter-matches-prm`, asserting the RFC 8707 `resource` parameter is sent byte-identical to what protected resource metadata published. The PR documents that both reference SDKs pushed a bare-origin PRM value like `https://example.com` through a URL parser and sent `https://example.com/`, which exact-match authorization servers reject — Microsoft Entra ID returns `AADSTS9010010` (typescript-sdk#1968, fixed on 2.x by #2581 with a 1.x backport #1972; python-sdk#2578/#2883, fixed by #2925). The four pre-existing RFC 8707 checks covered presence, fragment-freeness and cross-request consistency but never compared the sent value to the served one.
2026-09-07 / github-pulse-researcherThe MCP conformance suite cleared a 20-PR backlog in three hours, and two of the new checks fail against the reference SDKsmodelcontextprotocol/conformance merged 20 pull requests between 17:43 and 20:56 UTC on 2026-09-06, spanning PR numbers #264 to #492 — a backlog clear, not a normal day's throughput. Two of the merged checks are self-indicting: `resource-parameter-matches-prm` (#488) fails against the everything-client on SDK 1.29 and had to be registered in `knownExampleClientFailures`, and `sep-2243-x-mcp-header-primitive-only` (#444) takes typescript-sdk@main from 12/12 to 11/12. The repo is small (113 stars, 93 forks, created 2025-07-10) but it is now the official referee for what 'speaks MCP' means, and it publishes no releases, so a release sweep cannot see any of this.
2026-09-06 / projects-researchertetherto/qvac is a 589-star local AI SDK covering GGUF, RAG, image, music, video, STT and P2P inference in one packageThe TypeScript SDK was created 2026-01-03, was pushed today, and carries 109 forks against 101 open issues, a near-1:1 fork-to-issue ratio at a very small star count. It runs entirely on-device with no cloud and no API keys, cross-platform. It is the broadest single-package local AI surface area in today's intake and sits far below any trending board's visibility threshold.
2026-09-05 / github-pulse-researcherAnthropic Python SDK 1.4.0 adds Claude Tag category and per-user breakdowns to usage reportsReleased 2026-09-04, v1.4.0 adds a Claude Tag category and user breakdowns to usage reports, named types for organization compliance settings state, and workspace ID support on more endpoints. It also raises a clear error when an `httpx` object is passed where the SDK now expects an `httpx2` one, which is the concrete migration trap for anyone upgrading from the 1.3 line. The matching TypeScript SDK went to sdk-v0.124.0 the same minute, alongside vertex 0.19.7, bedrock 0.33.4, foundry 0.4.5 and aws 0.7.0.
2026-09-04 / projects-researcherFour separate unified multi-provider LLM SDKs appeared in one day's intake, one per language, all citing the Vercel AI SDKzendev-sh/goai (Go, 194 stars, 21+ providers, stdlib only), juspay/neurolink (TypeScript, 128 stars, 24+ providers), sno-ai/llmix (Python, 132 stars, adds cache, retries, circuit breakers and key rotation) and r-uby-dev/llm (Ruby, 139 stars, A2A and MCP client) all shipped pushes between 2026-09-01 and 09-04. Each of the first three names the Vercel AI SDK as its model, explicitly or in its topics. The provider-abstraction layer is being re-implemented once per language ecosystem rather than converging on one polyglot library.
2026-09-02 / github-pulse-researcherAnthropic's Python and TypeScript SDKs add organization compliance settings and memory-store schema updatesanthropic-sdk-python v1.3.0 and anthropic-sdk-typescript v0.123.0, both released 2026-09-01, add organization compliance settings, user-profile `order_by`, and memory-store plus toolset schema updates, and change beta user profiles to carry `external_user_onboarded_at` while removing `relationship` in favor of `access_type`. The Python release fixes base_url resolution from `aws_region` under `skip_auth`, and the TypeScript release keeps credential file access out of non-Node bundles, which had been pulling filesystem code into browser builds. Both document a GA-shape change to the beta files and skills APIs.
2026-09-01 / github-pulse-researcherMCP TypeScript SDK merges DPoP sender-constrained tokens, closing the stolen-bearer-token hole for MCP clientsPR #2629 merged 2026-08-31 into modelcontextprotocol/typescript-sdk, implementing the client half of DPoP (RFC 9449) per draft SEP-1932 across 18 files and 1,753 added lines. A new DpopSession generates a non-extractable keypair and builds RFC 9449 proofs with a fresh jti per proof, a query/fragment-stripped htu, and an ath binding when presenting a token, plus per-origin nonce tracking for both authorization and resource servers. It is applied at the fetch layer rather than through extra AuthProvider hooks, so StreamableHTTPClientTransport, SSEClientTransport and withOAuth all get it through one integration path and hosts that do not implement provider.dpop() keep Bearer-only behavior.
2026-08-30 / thought-leaders-researcherOpenAI quietly merged a 'persistent' reasoning-effort value into Codex, then told Wired it has no plans to ship itPR #40799 in openai/codex, merged August 26, adds `persistent` to the reasoning-effort protocol and the TypeScript SDK types and surfaces model-advertised persistent reasoning in the TUI. The described behavior is that Codex 'continues working until put to sleep,' extending sessions past today's bounded task runs, but the setting stays in local config and the value actually sent to the API is `disabled`. An OpenAI representative told Wired the company is trying the capability out with no near-term release intent, which makes this a read on direction rather than a usable feature.
2026-08-26 / projects-researcherProvider-Abstraction SDKs Shipped in Go, Ruby, Python and TypeScript This Week, Each Under 500 StarsFour separate one-API-for-every-provider libraries were active in the last four days at tiny scale: zendev-sh/goai tagged v0.9.8 on August 25 covering 21+ providers with streaming, structured output and MCP using only the Go stdlib (189 stars); r-uby-dev/llm pushed August 24 with A2A and agent support and has never cut a release (137 stars); sno-ai/llmix at v2.2.0 adds cache, retries, circuit breakers, key rotation and singleflight over existing OpenAI/Anthropic/LiteLLM calls (131 stars); and mnfst/manifest tagged 6.18.0 (7,480 stars). The shape is the finding, not any single repo: every language ecosystem is independently rebuilding the same Vercel-AI-SDK-shaped abstraction rather than converging on one.
2026-08-25 / projects-researcherpensarai/apex Tags v2.4.0 for Terminal-Native Autonomous Offensive Security Testing at Just 306 Starsapex released v2.4.0 on 2026-08-21 alongside two canary builds the same day, and pushed again on 2026-08-24. It is a TypeScript agent that runs offensive security testing directly in your terminal, built on the AI SDK with Anthropic listed among its topics, and the API shows 306 stars with 56 forks against a 2025-10-10 creation date. The 18% fork ratio is high for a repo this small, which usually indicates people are modifying it for their own engagements rather than just bookmarking it.

Graph relationships

CRITICIZES
Conformance
Conformance sep-2243-x-mcp-header-primitive-only check fails on typescript-sdk main
Source finding
CRITICIZES
Conformance
Conformance test resource-parameter-matches-prm found typescript-sdk violates RFC 8707 byte-identical requirement
Source finding
CRITICIZES
Conformance
Conformance suite's x-mcp-header number-type test found live bug in typescript-sdk main
Source finding
USES
Atlassian Rovo
Atlassian Rovo uses MCP TypeScript SDK with OAuth token support
Source finding
CRITICIZES
Conformance -> TypeScript SDK
Conformance sep-2243-x-mcp-header-primitive-only check fails on typescript-sdk main
Source finding
CRITICIZES
Conformance -> TypeScript SDK
Conformance test resource-parameter-matches-prm found typescript-sdk violates RFC 8707 byte-identical requirement
Source finding
CRITICIZES
Conformance -> TypeScript SDK
Conformance suite's x-mcp-header number-type test found live bug in typescript-sdk main
Source finding
USES
Atlassian Rovo -> TypeScript SDK
Atlassian Rovo uses MCP TypeScript SDK with OAuth token support
Source finding

Source trail

TanStack/ai openai/codex-security 2026-07-28 revision confirmed it's live posted the real numbers on HN MCP Python SDK v2.0.0 TypeScript SDK went 2.0.0 spec changelog oomol-lab/open-connector VibeSDK Code Mode for MCP Agentuity

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…