---
title: "Model Context Protocol API changes, deprecations and deadlines | Harbyn"
description: "Model Context Protocol: 0 upcoming deadlines and 7 recorded changes as of 2026-10-25, each with its source."
canonical: "https://harbyn.com/vendors/mcp"
last-updated: 2026-10-25
---

# Model Context Protocol: API changes and deadlines

Markdown version of <https://harbyn.com/vendors/mcp>.

Developer tools. 0 upcoming deadlines, 7 recorded changes. Every entry cites the Model Context Protocol page we read it from.

## What we read

The Model Context Protocol pages and feeds our ingestion visits, politely and on a schedule.

- **Changelog**: <https://modelcontextprotocol.io/specification/draft/changelog>
- **Releases**: <https://api.github.com/repos/modelcontextprotocol/typescript-sdk/releases?per_page=20>
- **Changelog**: <https://api.github.com/advisories?affects=@modelcontextprotocol/sdk,mcp,fastmcp&per_page=20&sort=published&direction=desc>

## What the scanner looks for

How `harbyn scan` recognises Model Context Protocol in a repository, on your machine. Nothing leaves it.

- **Packages**: `npm @modelcontextprotocol/sdk`, `pypi mcp`, `pypi fastmcp`, `npm @modelcontextprotocol/client`

## Upcoming deadlines

No upcoming Model Context Protocol deadline in the feed right now.

## Change history

Newest first, by the date Model Context Protocol announced it. This is the archive: past changes are not warnings, and changes we recorded after they took effect are marked as such.

### October 2026

- Oct 23, 2026, Security: [FastMCP: Post-transform component authorization is skipped on direct calls](https://github.com/advisories/GHSA-7xgj-8392-5q4r)
- Oct 20, 2026, Security: [MCP TypeScript SDK: Experimental tasks were not tied to the session that created them](https://github.com/advisories/GHSA-22jm-h49p-29qw)
- Oct 20, 2026, Security: [MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation](https://github.com/advisories/GHSA-46jr-4wx8-v453)
- Oct 20, 2026, Security: [MCP TypeScript SDK: Cross-origin redirects re-send custom headers and request bodies](https://github.com/advisories/GHSA-6prh-2h8m-c8cw)
- Oct 20, 2026, Security: [MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service](https://github.com/advisories/GHSA-rvq5-wwqv-78pq)
- Oct 15, 2026, Security: [MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion](https://github.com/advisories/GHSA-84m7-p3x7-pcfv)
- Oct 6, 2026, Security: [MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server](https://github.com/advisories/GHSA-6qxp-vccf-f47h)