The official TypeScript SDK for Model Context Protocol servers and clients
modelcontextprotocol/typescript-sdk is an MCP server distributed on github, maintained by modelcontextprotocol, tracked here since August 2026. It has shipped 100 releases and exposes 2 tools. Tools include calculate-bmi, fetch-data. Its composite risk grade is E — an inferred review prompt computed from observed signals, not a verdict. 3 known CVEs on file.
3 advisories published against this server still applies to the version it ships, the most severe rated high, most recently 2026-02-04.
Reading the source raised one review prompt — dangerous code — each a pattern worth a human look rather than a finding of fault.
Since the previous scan on 2026-09-15: 2 tools added and 3 tools removed.
full security breakdown →-
calculate-bmi -
fetch-data
| version | date | src |
|---|---|---|
| @modelcontextprotocol/fastify@2.0.0 | 2026-07-27 | github |
| @modelcontextprotocol/server-legacy@2.0.0 | 2026-07-27 | github |
| @modelcontextprotocol/express@2.0.0 | 2026-07-27 | github |
| @modelcontextprotocol/server@2.0.0 | 2026-07-27 | github |
| @modelcontextprotocol/core@2.0.0 | 2026-07-27 | github |
| @modelcontextprotocol/codemod@2.0.0 | 2026-07-27 | github |
| @modelcontextprotocol/client@2.0.0 | 2026-07-27 | github |
| @modelcontextprotocol/node@2.0.0 | 2026-07-27 | github |
| @modelcontextprotocol/hono@2.0.0 | 2026-07-27 | github |
| 1.30.0 | 2026-07-27 | github |