Tag: typescript

The GitHub Copilot SDK (1.0.18, October 8, 2026) is a thin client for the Copilot CLI runtime: your app speaks JSON-RPC to the same agent loop that powers Copilot CLI, with built-in file and shell tools, MCP, sub-agents, hooks, and BYOK. How it is wired, four things you can build with it, and the defaults that will bite you in production.

Move a local stdio MCP server to a remote Streamable HTTP server behind OAuth on MCP spec 2026-07-28 and TypeScript SDK 2.0.0. Dynamic Client Registration is now deprecated, so use Client ID Metadata Documents first and keep DCR only as a fallback. Covers the steps, a measured CIMD/DCR test matrix, and the misleading error you get when the two sides disagree.

Your MCP URL 307/308-redirects to another host, the client follows it, the Authorization header is stripped, and the target answers 401. Register the final URL.

OAuth succeeded but every MCP call gets 401 invalid_token? Make the PRM resource, the token's aud and your validator agree on one canonical server URL.

Protocol revision 2026-07-28 deleted Mcp-Session-Id, the initialize handshake, resources/subscribe, ping, logging/setLevel and SSE resumability. An automated survey of 1000 open source MCP servers found 90% reference the session ID nowhere. Here is what the other 10% has to rewrite, with verified code on @modelcontextprotocol/server 2.0.0.

A write tool that asks before it writes needs three things the MCP SDK does not give you: an approval bound to the exact diff, a precondition on the file it previewed, and an integrity-protected requestState. Verified end to end on @modelcontextprotocol/server 2.0.0 against protocol revision 2026-07-28, including the argument-swap that gets past a naive confirm.

Mapping 200 internal REST endpoints to 200 MCP tools puts 200 KB of JSON schema in front of every request. The 2026-07-28 spec also made the usual escape hatch illegal: tools/list MUST NOT vary per-connection, so per-session dynamic registration is gone. Here are the three levers that still work, with measured wire sizes and verified code on @modelcontextprotocol/server 2.0.0.

A step-by-step checklist for retiring a hand-rolled while-loop agent and running the same job on @cursor/sdk 1.0.26. The tool bodies survive, the loop does not, and three things you probably rely on have no equivalent: a system prompt string, a tool allowlist, and per-turn control.

The legacy HTTP+SSE transport used two endpoints and a sticky connection. Streamable HTTP uses one. Here is the step-by-step migration for the TypeScript and Python SDKs, the client configs you have to repoint, and the proxy buffering gotcha that makes the new endpoint look broken.

A step-by-step checklist for lifting a hand-rolled Anthropic tool-calling loop onto a standalone MCP server. The tool bodies move almost verbatim; what changes is where the schema comes from, how results are wrapped, and how errors cross the process boundary.