Version Packages (alpha)

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

⚠️ Version Packages is in pre mode (alpha), so the packages will be published to npm with the alpha dist-tag.

Note: the auto-generated description went stale after the Version job began failing on the size of this release (141 changesets; changelog generation exceeded the runner's GraphQL stream). The version commit on this branch was generated with the same tooling locally and is complete — including @modelcontextprotocol/core, which the previous description omitted. Full release notes are in each package's CHANGELOG.md in this PR's diff.

Releases

Package	Version
@modelcontextprotocol/client	2.0.0-alpha.4
@modelcontextprotocol/server	2.0.0-alpha.4
@modelcontextprotocol/server-legacy	2.0.0-alpha.4
@modelcontextprotocol/express	2.0.0-alpha.4
@modelcontextprotocol/fastify	2.0.0-alpha.4
@modelcontextprotocol/hono	2.0.0-alpha.4
@modelcontextprotocol/node	2.0.0-alpha.4
@modelcontextprotocol/core	2.0.0-alpha.2
@modelcontextprotocol/codemod	2.0.0-alpha.2

This is the first published release containing the MCP 2026-07-28 implementation (#2286) and everything merged since: the legacy input_required fulfilment shim (#2381), the reference example pair (#2380), toWebRequest() (#2390), codemod fixes (#2383), the rebuilt documentation (#2395, #2397), and the @modelcontextprotocol/core schema realignment (#2400).

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2375

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2375

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2375

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2375

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2375

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2375

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2375

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2375

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2375

commit: 46b44ac

[claude]

LGTM — this is the auto-generated changesets release PR, and the issue I flagged earlier (missing @modelcontextprotocol/core bump) has been resolved: core is now included at 2.0.0-alpha.2 via the changeset added in #2400.

Extended reasoning...

Overview

This is the Changesets-generated "Version Packages (alpha)" PR. It contains only mechanical artifacts produced by changeset version: package.json version bumps (client/server/middleware/server-legacy → 2.0.0-alpha.4, codemod → alpha.2, core-internal → alpha.3, core → alpha.2), the corresponding CHANGELOG.md entries assembled from merged changesets, and the updated .changeset/pre.json consumed-changesets list. No source code is touched.

Resolution of prior feedback

My previous review flagged that the release omitted @modelcontextprotocol/core even though #2286 changed its public schema surface. That has been addressed on main via #2400 (3c02ffb, "add missing changeset for @modelcontextprotocol/core"); the regenerated release PR now bumps core to 2.0.0-alpha.2 with a changelog entry describing the removed RequestMetaEnvelopeSchema export and the added Subscription* schemas, keeping the published package set mutually consistent.

Security risks

None introduced by this diff itself — it is version metadata and changelog prose only. The actual behavior changes were reviewed in their originating PRs (#2286, #2381, #2390, #2393, #2394, #2400). Publishing is gated on a maintainer merging this PR, which remains a human decision about release timing.

Level of scrutiny

Low for content correctness: the diff is tool-generated and deterministic from the changesets on main. The one class of error worth checking on these PRs — a package whose source changed but is missing from the release set — was the prior finding and is now fixed. The changelog text is copied verbatim from the changeset files that were reviewed in their source PRs.

Other factors

The bug-hunting system found no issues on the current revision, and there are no outstanding human reviewer comments. Whether and when to merge (i.e., publish the alpha release) is left to the maintainers; this approval only attests that the version/changelog content is consistent.