2.8.0 2.9.0
modelcontextprotocol/inspectorSep 23, 2026 → Sep 30, 20267 days between releases
What's New
Upgraded MCP TypeScript SDK to 2.2.0 and improved OAuth token security
New Features
- Store acquired OAuth tokens in the secret store with clobber-safe writes
- Upgrade to MCP Apps extension SDK 2.0.3
Improvements
- Upgrade MCP TypeScript SDK to 2.2.0
- Security improvements for OAuth token persistence using AES-GCM auth tag length
- Enhanced PR flow documentation and automation
Bug Fixes
- Fixes for secret masking in web forms, CLI, and TUI request/response bodies
- Fix skills to require ttlMs and cacheScope on modern skills/get results
- Fix gate-lease to serve queued runs in arrival order
- Fix CLI to end long-lived streams cleanly on EPIPE
Upgrade Notes
Upgrading requires the new MCP TypeScript SDK 2.2.0. OAuth tokens are now stored in the secret store with clobber-safe writes. No configuration changes are required.
The Two Releases
2.8.0
Sep 23, 2026· 29 days ago
Release 2.8.0 improves security through secret key file support, adds a security advisory skill, and fixes bugs related to authentication and schema rendering.
Full release notes2.9.0
Sep 30, 2026· 21 days ago
This release focuses on bug fixes, dependency upgrades (MCP TypeScript SDK to 2.2.0), and security improvements regarding OAuth token persistence and secret masking. It also includes documentation enhancements for the PR flow and fixes for various issues in the web and TUI interfaces.
Full release notes