portkey-admin-mcp 0.14.1 → 0.15.1

package/COMPATIBILITY.md

@@ -1,21 +1,20 @@
 # Compatibility and deprecations
 
-Last reviewed: 2026-10-24. Package versions, SDK versions, and negotiated MCP
+Last reviewed: 2026-10-25. Package versions, SDK versions, and negotiated MCP
 protocol revisions are separate compatibility boundaries.
 
 ## Release lines
 
 | Package release | MCP SDK | MCP protocol | Support and behavior |
 | --- | --- | --- | --- |
-| 0.14.1 | v1; dependency floor 1.32.1 | Latest supported revision: `2025-11-25` | Current published minor, 194 tools across 22 domains, Node.js 24+. Stateful HTTP sessions and optional replay stores remain active. |
-| 0.13.0 | v1; dependency floor 1.31.0 | Latest supported revision: `2025-11-25` | Historical release, 184 tools across 20 domains. Upgrade to the latest published minor for security fixes. |
-| Planned migration, minor release number unassigned | v2, exact version to be selected and tested | Native `2026-07-28` plus older clients on the same endpoint | Not shipped. Planned to retire HTTP session and replay stores and change configuration behavior. |
+| 0.15.1 | server/client 2.3.1, Node adapter 2.1.1 (exact pins) | Native `2026-07-28` plus older clients on the same endpoint | Current release, 194 tools across 22 domains, Node.js 24+. HTTP session and replay stores are retired; obsolete settings warn and are ignored. First warnings and ignored settings start in 0.15.0; session/replay behavior is removed in that release. |
+| 0.14.1 | v1; dependency floor 1.32.1 | Latest supported revision: `2025-11-25` | Previous line, 194 tools across 22 domains, Node.js 24+. Stateful HTTP sessions and optional replay stores remain active. |
+| 0.13.0 | v1; dependency floor 1.31.0 | Latest supported revision: `2025-11-25` | Historical release, 184 tools across 20 domains. Upgrade to the latest minor for security fixes. |
 
-The current SDK supports `2025-11-25`, `2025-06-18`, `2025-03-26`,
+The 0.14.x SDK supports `2025-11-25`, `2025-06-18`, `2025-03-26`,
 `2024-11-05`, and `2024-10-07`. A newer client that negotiates an older
 revision can use this server; that fallback does not mean the server natively
-supports `2026-07-28`. The migration must verify both modern and older clients
-over HTTP and stdio before release.
+supports `2026-07-28`. Release tests cover modern auto/pinned clients and default legacy clients over HTTP and stdio. Client products, deployed proxies and marketplace acceptance still need release validation.
 
 [SECURITY.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY.md) owns the security-support policy: fixes ship on the
 latest published minor line; older minor lines do not receive backports.
@@ -23,37 +22,36 @@ See [CHANGELOG.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CHAN
 
 ## Configuration lifecycle
 
-No deprecation warnings or removals for the settings below ship in 0.14.x.
-The planned migration has no assigned package release number. Its release
-notes must identify the first warning, ignored-setting, and removal versions
-before operators are asked to upgrade.
+No deprecation warnings or removals for the settings below shipped in 0.14.x.
+As of 0.15.0, the listed settings warn and are ignored, and the underlying
+session/replay behavior is removed. There was no intermediate warning-only
+release. Obsolete names remain recognized for warnings; this does not retain
+their former functionality. 0.14.x is the previous line and is unchanged.
 
-| Setting or behavior | 0.14.x | Planned migration | First warning / ignored / removal release |
+| Setting or behavior | 0.14.x | 0.15.0 behavior | First warning / ignored / removal release |
 | --- | --- | --- | --- |
-| `MCP_SESSION_MODE`, `MCP_SESSION_TIMEOUT` | Active; stateful mode is the default | Retire session storage; serve older clients without persistent sessions | Unassigned / unassigned / unassigned |
-| `MCP_EVENT_STORE`, `MCP_EVENT_TTL_SECONDS`, `MCP_EVENT_STORE_MAX_EVENTS`, `MCP_EVENT_STORE_MAX_BYTES`, `MCP_EVENT_STORE_COMMAND_TIMEOUT_MS` | Active replay configuration | Retire replay storage and warn about obsolete settings | Unassigned / unassigned / unassigned |
-| `MCP_EVENT_ENCRYPTION_KEY`, `MCP_REDIS_KEY_PREFIX` | Active Redis replay configuration | Retire with the replay store | Unassigned / unassigned / unassigned |
-| HTTP GET stream, `Last-Event-ID` recovery, session identifiers | Active under the configured HTTP mode | Retire legacy sessions and replay; document the resulting recovery changes | Unassigned / unassigned / unassigned |
+| `MCP_SESSION_MODE`, `MCP_SESSION_TIMEOUT` | Active; stateful mode is the default | Ignored with a warning; older clients use stateless requests | 0.15.0 / 0.15.0 / 0.15.0 |
+| `MCP_EVENT_STORE`, `MCP_EVENT_TTL_SECONDS`, `MCP_EVENT_STORE_MAX_EVENTS`, `MCP_EVENT_STORE_MAX_BYTES`, `MCP_EVENT_STORE_COMMAND_TIMEOUT_MS` | Active replay configuration | Ignored with a warning; authenticated GET/DELETE return 405 (auth and Origin checks still apply first: 401 without credentials when HTTP authentication is enabled, meaning `MCP_AUTH_MODE` other than `none`; 403 for a disallowed Origin) | 0.15.0 / 0.15.0 / 0.15.0 |
+| `MCP_EVENT_ENCRYPTION_KEY`, `MCP_REDIS_KEY_PREFIX` | Active Redis replay configuration | Ignored with a warning | 0.15.0 / 0.15.0 / 0.15.0 |
+| HTTP GET stream, `Last-Event-ID` recovery, session identifiers | Active under the configured HTTP mode | No session IDs are returned; authenticated GET/DELETE, including legacy session or `Last-Event-ID` headers, return 405. Unauthenticated requests get 401 when HTTP authentication is enabled (`MCP_AUTH_MODE` other than `none`), and a disallowed Origin gets 403 | 0.15.0 / 0.15.0 / 0.15.0 |
 | `RATE_LIMIT_*` | Active rate-limit configuration | Retained, including shared Redis limiting | No removal planned |
-| `RATE_LIMIT_REDIS_URL`, `MCP_REDIS_URL`, `REDIS_URL` | Rate limiter uses these URL sources in that order; replay uses the latter two | Preserve a documented Redis connection path for rate limiting when replay is retired | No removal assigned |
+| `RATE_LIMIT_REDIS_URL`, `MCP_REDIS_URL`, `REDIS_URL` | Rate limiter uses these URL sources in that order; replay uses the latter two | Documented Redis connection path for rate limiting is preserved now that replay is retired | No removal assigned |
 | `MCP_MAX_SESSIONS` | Bounds stateful sessions or active stateless request handlers | Retain the stateless concurrency bound | No removal planned |
 | `MCP_TOOL_DOMAINS`, `CORS_ORIGIN` | Supported fallbacks for `PORTKEY_TOOL_DOMAINS`, `ALLOWED_ORIGINS` | No change assigned | No removal planned |
 
 Redis rate limiting and Redis replay are separate features. Retiring the replay
 store does not remove the need for a shared rate limiter in multi-instance or
-serverless deployments. Do not remove working settings from a 0.14.x deployment
-based on the migration plan.
+serverless deployments. Keep working settings on a 0.14.x deployment until you
+upgrade to 0.15.0.
 
-## Migration preparation
+## Migration notes
 
-Work starts by 2026-12-01, or earlier if the v1 SDK stops receiving a needed
-security fix or announces end of life, a targeted client drops the older
-handshake or fails when pinned to `2026-07-28`, or 30 days pass without a v2
-server release carrying upgrade notes. Target completion is before 2027-01-27.
-These are project planning dates, not announced configuration-removal dates or
-an SDK end-of-life guarantee. [ROADMAP.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/ROADMAP.md) tracks the work.
+The migration shipped in 0.15.0, ahead of the original 2026-12-01 start-by
+date and the 2027-01-27 completion target. Those were project planning dates,
+not announced configuration-removal dates or an SDK end-of-life guarantee.
+[ROADMAP.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/ROADMAP.md) tracks follow-up work.
 
-Before that release, operators need a versioned upgrade guide covering:
+Operators upgrading from 0.14.x need an upgrade guide covering:
 
 - warning and removal behavior for every retired setting;
 - loss of session affinity, the GET stream, and `Last-Event-ID` recovery;
@@ -62,6 +60,36 @@ Before that release, operators need a versioned upgrade guide covering:
 - retained Redis rate-limit configuration and concurrency bounds; and
 - client, reverse-proxy, Vercel, and marketplace compatibility checks.
 
-The release must update this table, the README configuration reference,
+The release updated this table, the README configuration reference,
 [architecture](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/ARCHITECTURE.md), [Vercel guide](docs/VERCEL_DEPLOYMENT.md),
 [security assurance case](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY-ASSURANCE.md), and changelog together.
+
+## Interrupted requests
+
+The SDK v2 server keeps older `initialize` clients working on `/mcp` without
+persistent HTTP sessions. Modern clients use `server/discover` on the same URL.
+Clients and proxies must forward `MCP-Protocol-Version`, `Mcp-Method` and, for
+named operations such as `tools/call`, `Mcp-Name`. Tool filters apply to every
+request; reuse the same `?tools=` URL throughout a client workflow.
+
+GET streams, DELETE session operations and `Last-Event-ID` replay are retired.
+A disconnected request can still have changed Portkey state even when its result
+was lost. Do not automatically replay a write:
+
+1. Save the operation name, target workspace/resource ID and intended change
+   without recording credentials or secret values.
+2. Reconnect and use the matching `get_*` or `list_*` tool, or the Portkey
+   dashboard, to inspect whether the change completed. For creates, correlate
+   the intended name/metadata and time; a missing response is not proof of failure.
+3. If the desired state already exists, continue from that resource. If failure
+   is confirmed, retry once intentionally. If the outcome is still ambiguous,
+   inspect the upstream audit/usage records or ask the tenant administrator before
+   repeating creates, completions or other operations with side effects.
+
+Reads can be requested again. Neither transport reconnect nor a successful new
+handshake proves a previous mutation failed. There is no exactly-once guarantee.
+`MCP_MAX_SESSIONS` now caps concurrent request handlers; it does not restore
+sessions or replay. Redis remains available for shared rate limiting through
+`RATE_LIMIT_REDIS_URL`, `MCP_REDIS_URL`, then `REDIS_URL`. No replay encryption key
+is needed. Keep deployed 0.14.x settings until upgrading; the first
+warning, ignored-setting and feature-removal release is 0.15.0.

package/ENDPOINTS.md

@@ -209,7 +209,7 @@ Routes:
 |---|---|
 | `create_prompt` | Create a new prompt template and initial version. Use this for first-time setup; use migrate_prompt for idempotent CI/CD flows. Accepts plain text or structured chat messages, creates a new version immediately, and returns the prompt id, slug, and version id. For multi-message chat prompts pass messages (preferred) or a JSON-encoded array as string. |
 | `list_prompts` | List prompts across the workspace, with optional collection, workspace, or search filters. Returns a paginated summary with id, name, slug, model, and status so you can choose a prompt_id before get_prompt, update_prompt, or render_prompt. |
-| `get_prompt` | Fetch a prompt's full definition, active version, and version history. Use this before updating, publishing, rendering, or copying a prompt when you need the stored template and metadata. For multi-message chat prompts pass messages (preferred) or a JSON-encoded array as string. |
+| `get_prompt` | Fetch a prompt's full definition, active version, and version history. Use this before updating, publishing, rendering, or copying a prompt when you need the stored template and metadata. template_format in the result shows whether the stored template is a plain string or a JSON messages array. |
 | `update_prompt` | Update an existing prompt and create a new archived version. Only provided fields change, and publish_prompt is what makes the new version active. For multi-message chat prompts pass messages (preferred) or a JSON-encoded array as string. |
 | `delete_prompt` | Delete a prompt and all its versions by id. This cannot be undone, immediately breaks callers using the slug, and should only be used after checking list_prompt_versions or confirming you do not need an audit trail. |
 | `publish_prompt` | Publish a specific version of a prompt as the active default, unlike promote_prompt which copies across environments or update_prompt which creates a new draft. This immediately routes all callers using the slug to that version and there is no rollback, so use list_prompt_versions to pick the version and update_prompt first if you need to create new content before promoting it. |
@@ -238,11 +238,11 @@ Routes:
 | `get_error_rate_analytics` | Get error-rate time-series data with summary.error_rate_percent and per-bucket percentages of total requests. Use this for reliability and SLA trends; use get_error_analytics for absolute error counts instead. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_cache_hit_latency` | Get cache-hit-only latency time-series data with summary.total_latency, summary.avg_latency, and per-bucket total/avg latency. Use this to evaluate cached-response speed; use get_latency_analytics for all requests. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_cache_hit_rate` | Get cache-effectiveness time-series data with summary.hit_rate, summary.total_hits, summary.total_misses, and per-bucket hits/misses/rate. Use this to measure cache effectiveness; use get_cache_hit_latency for speed rather than hit/miss ratio. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
-| `get_cache_summary` | Enterprise-gated. Get cache summary metrics for one workspace and time range: hits, average cache-hit latency, total requests, and percentage speedup. Use the graph cache tools when you need changes over time instead of one aggregate. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
+| `get_cache_summary` | Enterprise-gated. Get cache summary metrics for a workspace or organisation and time range: hits, average cache-hit latency, total requests, and percentage speedup. Choose workspace_slug, include_all_workspaces=true, or exclude_workspace_slugs. Use the graph cache tools when you need changes over time instead of one aggregate. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_users_analytics` | Get user-growth time-series data with summary.total_active_users, summary.total_new_users, and per-bucket active/new user counts. Use this for growth and adoption trends; use get_user_requests_analytics for per-user traffic or get_analytics_group_users for per-user cost and token detail. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_users` | Get a paginated per-user breakdown with total_groups, group_count, and a users array containing request count, cost, and token usage. Use this for billing, audits, or top-consumer analysis; use get_users_analytics for aggregate active and new user trends. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_models` | Get a paginated per-model breakdown with total_groups, group_count, and a models array containing request count, cost, and token usage. Use this to compare model cost, popularity, and efficiency; use get_token_analytics or get_cost_analytics for time-series trends instead. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
-| `get_analytics_group_providers` | Enterprise-gated. Get provider-grouped analytics for one workspace and time range with selectable metrics, ordering, pagination, and optional total count. Use this when comparing provider traffic or reliability; requested metric fields are preserved in each provider row. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
+| `get_analytics_group_providers` | Enterprise-gated. Get provider-grouped analytics for one workspace or organisation-wide and a time range with selectable metrics, ordering, pagination, and optional total count. Choose workspace_slug, include_all_workspaces=true, or exclude_workspace_slugs. Use this when comparing provider traffic or reliability; requested metric fields are preserved in each provider row. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_metadata` | Get a paginated metadata breakdown with total_groups, group_count, and a metadata_groups array grouped by the required metadata_key. Use this for custom breakdowns like per-environment or per-feature analysis; pass metadata_key in addition to the time window. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_mcp` | Get a paginated per-MCP-server breakdown with total_groups, group_count, and an mcp_servers array containing each server name and its request count. Use this to see which MCP servers receive the most traffic; use get_analytics_group_a2a for A2A agents or get_analytics_group_users and get_analytics_group_models for other breakdowns. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_a2a` | Get a paginated per-agent breakdown with total_groups, group_count, and an agents array containing each A2A (agent-to-agent) agent name and its request count. Use this to see which agents receive the most traffic; use get_analytics_group_mcp for MCP servers instead. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
@@ -461,7 +461,7 @@ Routes:
 | `disconnect_mcp_server_connection` | Disconnect one user's active session from a Portkey-managed MCP server. This immediately ends that connection but does not revoke future access; use update_mcp_server_user_access when access itself should be removed. Provide user_id with service keys (user keys derive it), and workspace_id with organisation admin keys. Inspect list_mcp_server_connections first when the target is uncertain. |
 | `list_mcp_servers` | List MCP servers in the organization. Returns paginated server records plus total for discovering server IDs; use get_mcp_server for one server's details and list_mcp_integrations for the parent integration. |
 | `create_mcp_server` | Create an MCP server under an existing integration. Registers the server and returns the new id and slug; use list_mcp_integrations first to find the parent integration, then capabilities or access tools to configure it. |
-| `get_mcp_server` | Retrieve one MCP server by id or slug. Returns server details including the parent integration, status, and created time; use get_mcp_server when you need the server record rather than the integration config. |
+| `get_mcp_server` | Retrieve one MCP server by id or slug. Returns server details including the parent integration, status, and created time; use get_mcp_server for the server record, and get_mcp_integration for the parent integration's URL, auth, and transport configuration. |
 | `update_mcp_server` | Update an MCP server's name or description. Changes apply immediately, but URL and auth live on the parent integration, so use update_mcp_integration for those fields. |
 | `delete_mcp_server` | Delete an MCP server instance. This is irreversible, removes connected users' access immediately, and should be used only after confirming no workflows depend on the server. |
 | `test_mcp_server` | Test connectivity to an MCP server. Sends a live check and returns success, response time, HTTP status, and any error; use this before changing configuration or when diagnosing reachability. |

package/README.md

@@ -77,10 +77,10 @@
 
 You need a **Portkey API key** with appropriate scopes. Get one from your [Portkey dashboard](https://app.portkey.ai/) under API Keys.
 
-Version 0.14.0 uses MCP SDK v1 and supports protocol revisions through
-`2025-11-25`. Session and replay settings remain active. See
-[compatibility and deprecations](./COMPATIBILITY.md) before upgrading; the
-planned MCP v2 migration has no assigned release number or removal date.
+Version 0.15.0 uses MCP SDK v2 and serves protocol revision `2026-07-28` and
+older clients on the same endpoint. It retires HTTP sessions and replay;
+obsolete settings warn and are ignored. See
+[compatibility and deprecations](./COMPATIBILITY.md) before upgrading from 0.14.x.
 
 ### Claude Code
 
@@ -175,7 +175,7 @@ Then use this config:
 | **Egress Allowlist** | 5 | Organisation trust for custom outbound hosts |
 | **Usage Limits** | 7 | Cost and token consumption limits |
 | **Rate Limits** | 5 | Request frequency controls |
-| **Analytics** | 25 | Cost, latency, errors, tokens, cache, feedback, provider, MCP, A2A, and workspace groups |
+| **Analytics** | 25 | Cost, latency, errors, tokens, cache, feedback, provider, MCP, A2A, and workspace groups; organisation scope and workspace exclusions |
 | **Logging** | 10 | Log retrieval, ingestion, export, and field restrictions |
 | **Tracing** | 2 | Feedback creation and updates on traces |
 | **Users & Workspaces** | 24 | User management, invites, workspace members, SCIM group mappings |
@@ -279,17 +279,9 @@ For local-only HTTP use, leave `MCP_HOST` at its default `127.0.0.1`. Set `MCP_H
 | `CLERK_ALLOWED_ORGANIZATION_IDS` / `CLERK_ALLOWED_ROLES` | — | Optional CSV organization and role constraints; every configured constraint must match |
 | `CLERK_REQUIRED_PERMISSIONS` | — | Optional CSV permissions that must all be present in the verified Clerk JWT |
 | `MCP_ALLOW_UNAUTHENTICATED_HTTP` | — | Set to `true` only for intentional local unauthenticated HTTP debugging |
-| `MCP_SESSION_MODE` | `stateful` | `stateful` or `stateless` |
-| `MCP_SESSION_TIMEOUT` | `3600000` | Idle timeout for stateful sessions, in milliseconds; `0` or more |
-| `MCP_MAX_SESSIONS` | `100` | Maximum concurrent stateful sessions or active stateless request handlers |
-| `MCP_EVENT_STORE` | `off` | `off`, `memory`, or `redis`; stateless `GET /mcp` replay requires `memory` or `redis` |
-| `MCP_EVENT_TTL_SECONDS` | `300` | Replay retention in seconds |
-| `MCP_EVENT_STORE_MAX_EVENTS` | `10000` | Maximum events retained by the in-memory replay store; oldest events are evicted first |
-| `MCP_EVENT_STORE_MAX_BYTES` | `67108864` | Approximate maximum serialized bytes retained by the in-memory replay store |
-| `MCP_EVENT_STORE_COMMAND_TIMEOUT_MS` | `5000` | Redis command timeout for the event store, in milliseconds; `0` disables the timeout (restores unbounded pre-v6 behavior) |
-| `MCP_REDIS_URL` | — | Redis URL for shared event store; production requires `rediss://` and ACL-scoped credentials |
-| `MCP_EVENT_ENCRYPTION_KEY` | — | Required 32-byte base64 AES key for Redis replay payloads; generate with `openssl rand -base64 32` |
-| `MCP_REDIS_KEY_PREFIX` | `mcp:event-store` | Dedicated Redis namespace for replay data |
+| `MCP_MAX_SESSIONS` | `100` | Maximum concurrent HTTP MCP request handlers (retained name) |
+| `MCP_REDIS_URL` | — | Fallback Redis URL for shared rate limiting, after `RATE_LIMIT_REDIS_URL` and before `REDIS_URL`; production requires `rediss://` |
+| `MCP_SESSION_MODE`, `MCP_SESSION_TIMEOUT`, `MCP_EVENT_*`, `MCP_REDIS_KEY_PREFIX` | Ignored as of 0.15.0 | Old session/replay settings produce a warning containing names only. 0.14.x behavior is unchanged; see [compatibility](./COMPATIBILITY.md). |
 | `MCP_TLS_KEY_PATH` | — | TLS key for native HTTPS |
 | `MCP_TLS_CERT_PATH` | — | TLS cert for native HTTPS |
 | `MCP_TLS_CA_PATH` | — | Optional CA bundle for native HTTPS; only used when the TLS key and cert are set |
@@ -322,7 +314,7 @@ Production containers must choose their rate-limit topology explicitly: set
 Vercel support is kept as a reference proof of concept — we do not run a hosted deployment. See [docs/VERCEL_DEPLOYMENT.md](./docs/VERCEL_DEPLOYMENT.md) if you want to self-deploy.
 
 Key points:
-- Uses stateless request handling with encrypted, principal-bound Redis replay and a shared atomic Redis rate limiter
+- Uses stateless request handling and a shared atomic Redis rate limiter (SDK v2); GET replay is retired
 - Requires Clerk or bearer auth
 - Leave `MCP_TLS_*` unset (Vercel terminates HTTPS)
 - Set `MCP_PUBLIC_BASE_URL` to your deployment URL so advertised MCP endpoints never depend on request headers
@@ -405,11 +397,10 @@ for the public threat model and assurance case.
 
 <h2 align="center" id="roadmap">Roadmap</h2>
 
-Release 0.14.0 adds access policies, egress allowlists, and security maintenance.
+Release 0.15.0 moves to MCP SDK v2 and the 2026-07-28 spec.
 The [roadmap](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/ROADMAP.md) separates completed work from upstream contract and
-tenant-verification gates. The planned MCP v2 migration keeps older clients on
-the same endpoint; its package version and configuration-removal releases are
-still unassigned. See [compatibility and deprecations](./COMPATIBILITY.md).
+tenant-verification gates. The MCP v2 migration shipped in 0.15.0 and keeps older
+clients on the same endpoint while retiring session and replay storage. See [compatibility and deprecations](./COMPATIBILITY.md).
 
 <hr>
 
@@ -428,7 +419,7 @@ tool catalog in this repository as authoritative when a third-party index lags.
 <h2 align="center" id="built-with">Built With</h2>
 
 [![TypeScript](https://img.shields.io/badge/TypeScript_7.0-3178C6?logo=typescript&logoColor=fff)](https://www.typescriptlang.org/)
-[![MCP SDK](https://img.shields.io/badge/MCP_SDK_1.32-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
+[![MCP SDK](https://img.shields.io/badge/MCP_SDK_2.3-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
 [![Zod 4](https://img.shields.io/badge/Zod_4-3E67B1?logo=zod&logoColor=fff)](https://zod.dev/)
 [![Biome](https://img.shields.io/badge/Biome_2.5-60a5fa?logo=biome&logoColor=fff)](https://biomejs.dev/)
 [![Node 24](https://img.shields.io/badge/Node_24-339933?logo=nodedotjs&logoColor=fff)](https://nodejs.org/)