---
summary: "Framework bump to mcp-ts-core 0.12.3 adopts MCP SDK v2: tool inputs are now strict and reject an undeclared argument key instead of silently stripping it, advertised schemas move to JSON Schema 2020-12 with outputSchema declaring the error envelope, and bun audit clears from 35 advisories to 0 across 345 packages."
breaking: false
security: true
---

# 0.3.3 — 2026-08-24

## Changed

- **`@cyanheads/mcp-ts-core`** `^0.11.0` → `^0.12.3` — adopts MCP SDK v2 (`@modelcontextprotocol/sdk` replaced by `@modelcontextprotocol/server` + `@modelcontextprotocol/client`). No `src/` file in this server changed; every behavior change below is inherited from the framework:
  - Tool inputs are now strict — an undeclared argument key is rejected as a tool result with `isError: true` naming the key, instead of being silently stripped; the handler never runs.
  - Advertised schemas move to JSON Schema 2020-12 (from draft-07); `inputSchema` carries `additionalProperties: false`, and `outputSchema` now declares the error envelope.
  - Protocol revision 2026-07-28 is served alongside the 2025 era on HTTP.
  - `ctx.log` output also reaches the client as `notifications/message`.
  - Tool input-validation failures now read as flat `path: message` sentences instead of a serialized Zod blob.
- **Bun pins move to `1.4.0`** — both stages of `Dockerfile` and `packageManager` in `package.json`; `engines.bun` stays `>=1.3.0`.
- **Production Docker image** installs with `--omit=peer`, dropping the framework's optional peer tiers (test runner, service SDKs, parsers) from the shipped image — nothing this server imports is lost, since anything it actually uses is declared in its own `dependencies`.
- **`MCP_SESSION_MODE`** documented in `.env.example` and the README config table — defaults to `auto` (resolves to `stateful`); the previous comment omitted the `auto` mode and implied `stateful` was the default.
- **Vulnerability reports** now route to `security@caseyjhand.com` (`.github/SECURITY.md`), a dedicated alias rather than the general contact address.
- Added `.github/CONTRIBUTING.md` and `.github/CODE_OF_CONDUCT.md` community-health files.

## Dependencies

- `@cyanheads/mcp-ts-core` `^0.11.0` → `^0.12.3`
- `@biomejs/biome` `2.5.5` → `2.5.10`
- `@types/node` `26.1.1` → `26.2.0`
- `tsc-alias` `^1.9.1` → `^1.9.2`
- `vitest` `^4.1.10` → `^4.1.11`
- `bun` `1.3.14` → `1.4.0` (packageManager pin)
- Clears `bun audit` from 35 advisories (17 high, 16 moderate, 2 low) to 0 across 345 packages — the SDK v2 swap drops the transitive `express` / `ajv` / `express-rate-limit` chain that `@modelcontextprotocol/sdk` pulled in.

393 tests pass across 12 files; `bun run devcheck` clean.