Menu
Search
24 August 2026

Release: lastfm-mcp v2.5.0 — Latest MCP protocol support

Project
lastfm-mcp
Summary
Last.fm MCP server.
URL
lastfm-mcp.com

The server now speaks the current MCP revision (2026-07-28, the stateless one) natively, while older clients keep working through the SDK’s compatibility lane. Tool responses also got smarter about what to call next, and two long-standing crash bugs in the public catalog tools are gone.

Breaking changes

  • The Mcp-Session-Id header is no longer read or echoed, since the 2026-07-28 spec removed protocol sessions. If you connected through the manual /login flow, pass ?session_id= on the /mcp URL, which was always the documented way. Nothing changes for OAuth clients such as Claude.ai, Claude Code, or Claude Desktop.

What’s new

  • MCP 2026-07-28 support: server/discover, the _meta request envelope, and the MCP-Protocol-Version, Mcp-Method, and Mcp-Name headers. Clients on the 2024 and 2025 revisions still connect with initialize and get the same tools.
  • Every tool response ends with a “Next steps” block listing the most likely follow-up calls with their exact arguments. Where the response has a clear top item (your top artist this month, the most recent week in a chart list), the first suggestion is filled in with it. The server also ships instructions naming the recommended tool path per entity, so a model lands on the right verb without reading all 21 descriptions.
  • Numeric parameters (limit, page, from, to) accept strings, because some clients send numbers that way. The same bounds still apply.
  • Resource templates advertise a description and MIME type.
  • /mcp is rate limited per IP at 60 requests a minute to protect the shared Last.fm API budget. That is well above what any interactive client does.

Fixes

  • get_album_info, get_track_info, and get_artist_info no longer throw for an album, track, or artist with exactly one tag, one track, or one similar artist, or with none at all. Last.fm sends those as a bare object or leaves the key out; the tools handle all three shapes now. This was producing a few dozen errors a week in production.
  • A failed Last.fm fetch raised a second, unhandled rejection alongside the error the caller already received.
  • The discovery card and server_info reported protocol 2024-11-05. Both now report 2026-07-28.

Under the hood

  • @modelcontextprotocol/server 2.0 and @modelcontextprotocol/client 2.0 replace the v1 SDK, with Cloudflare Agents SDK 0.21 (createMcpHandler from agents/mcp/server) and @cloudflare/workers-oauth-provider 0.10. npm audit on production dependencies reports zero vulnerabilities, down from 14.
  • All tool, prompt, and resource registrations use the register* APIs with z.object() schemas.
  • Two OAuth workarounds for Claude.ai’s RFC 8707 resource parameter are gone; the provider handles it correctly now.
  • Test stack is vitest 4, @cloudflare/vitest-pool-workers 0.22, and Node 22. CI runs the suite again (174 tests) after a long stretch with that step disabled. New tests drive a real SDK client through the Worker on both protocol lanes and snapshot the advertised catalogue.
  • Dead code removed: the session-logging utilities, leftover type files, and an unused OAuth registration wrapper.