MCP TypeScript SDK 2.2.0 and 1.31.0 bind OAuth credentials to their issuer

Building the machine-to-machine OAuth providers without expectedIssuer is now deprecated and logs a warning. fetchToken() throws AuthorizationServerMismatchError when stored client information belongs to a different server.⁵ In 1.31.0, stored tokens gain an issuer field, so storage that rejects unknown fields must be changed to accept it.⁶ In 2.2.0, listTools() and the other list calls without a cursor now follow every page, capped by listMaxPages.⁵

Relevant to: Anyone running MCP clients against servers with long tool lists, or keeping OAuth tokens in a strict schema.