The MCP SDK just shipped DPoP and scope challenges. Here's what to do about it.

Version 2.1.0 of the official Model Context Protocol TypeScript SDK adds support for DPoP sender-constrained OAuth tokens and request-time OAuth scope challenges, implementing security measures from the 2026-07-28 MCP authorization specification. DPoP binds access tokens to a client-held key pair, requiring signed proofs on requests so stolen tokens cannot be reused without the private key; the SDK automates proof signing, nonce retries, and token-flow integration through a new OAuth client provider method and shared cryptographic helpers. Server packages now allow tools, resources, and prompts to issue HTTP 403 scope challenges before execution, with a requireScopes helper for static permissions and callbacks for conditional authorization. The release also adds Streamable HTTP limits for request body sizes and JSON-RPC batch lengths. MCP server operators are encouraged to evaluate DPoP support in their authorization systems and adopt narrowly scoped, on-demand permissions for sensitive actions rather than relying solely on broadly authorized bearer tokens.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.