MCP TypeScript SDK 2.4.0 ships the Skills extension so servers can publish agent skills

What the MCP maintainers released

The Model Context Protocol project published TypeScript SDK 2.4.0 on 23 October 2026. The release moves the client, server, core, server-legacy and codemod packages to 2.4.0 and the Node adapter to 2.1.2. MCP was introduced by Anthropic and is now governed under the Agentic AI Foundation.

The headline feature is Skills over MCP. A server publishes a folder of skills with loadSkills(folder) and attaches them with attach(server), which serves skills/list, skills/get, directory reads and a skill:// resource template. On the client side, SkillsClient lists skills, fetches them and reads files, checking each file's size, digest and SKILL.md frontmatter and raising an error on a mismatch. The feature works on both the 2025-11-25 and 2026-07-28 protocol revisions. The maintainers mark the attach wiring as experimental.

Where the Skills extension comes from

The SDK implements SEP-2640, the Skills Extension proposal merged into the MCP repository on 13 September 2026 under the identifier io.modelcontextprotocol/skills. It was written by the Skills Over MCP Working Group. The proposal lists reference work in the Python, C# and Go SDKs, host prototypes in gemini-cli, fast-agent, goose, Codex and Claude Code, and the GitHub MCP Server.

The extension's documentation defines a skill as a directory holding a SKILL.md file and optional supporting files, following the Agent Skills specification. Servers must declare both the resources capability and the extension. Reading SKILL.md does not activate a skill by itself: the host decides how skills reach the model and applies any user approval first.

Other changes in 2.4.0

An OAuth client can now opt in to sending a scope on token refresh through scopeForRefresh(tokens). The notes name Microsoft Entra ID, which rejects a refresh without scope in some app registrations. The default request does not change. The v1 to v2 upgrade guide is now also packaged as an installable agent skill.

Three upgrade notes need attention. A tool that puts x-mcp-header on a number parameter is now rejected with error -32020, as the 2026-07-28 specification requires. Some zod-generated output schemas are no longer wrapped in { result } on 2025-11-25 connections. The bundled validator now rejects $id or $ref values with an invalid URI scheme.

Why it matters and what to watch

Skills have so far been files that each agent product loads from local folders. Serving them over MCP lets a company ship instructions next to the service they describe and update them in one place, while digest checks give hosts a way to detect tampered or stale copies. The open question is host support: the SDK only provides the building blocks, and each client still has to decide how to surface skills and ask for approval. More MCP coverage, including GitHub's 2.0 server, is collected under AI Agents.

Questions people ask

What is Skills over MCP?

An MCP extension, defined in SEP-2640, that lets a server publish agent skills (folders with a SKILL.md file) and lets clients list, fetch and verify them through MCP resources.

Is the Skills API in the TypeScript SDK stable?

Mostly. The release notes say SkillsExtension.attach is experimental and may change in a minor release, while the rest of the Skills API is stable.

Does the Skills extension need the newest MCP specification?

No. The SDK supports it on revisions 2025-11-25 and 2026-07-28; the caching fields ttlMs and cacheScope are only sent on 2026-07-28.

Sources

1. TypeScript SDK 2.4.0 (Model Context Protocol, 23 Oct 2026)
2. @modelcontextprotocol/server 2.4.0 (Model Context Protocol, 23 Oct 2026)
3. SEP-2640: Skills Extension (Model Context Protocol, 13 Sep 2026)
4. Skills extension overview (Model Context Protocol, 28 Oct 2026)
5. MCP joins the Agentic AI Foundation (Model Context Protocol, 9 Dec 2025)