MCP TypeScript SDK 2.1.0 adds DPoP sender-constrained tokens
The Model Context Protocol TypeScript SDK 2.1.0 (Sept 23) adds opt-in DPoP (RFC 9449 / SEP-1932) so clients bind OAuth access tokens to a local key. Matching server packages return request-time insufficient_scope challenges before tools or SSE open.