docs(examples): close review-1 M2-M9 + bot nits; in-repo OAuth-protected server, sessionful repl/, fix docs:check anchor

- oauth/server.ts: in-repo authorization-code AS (setupAuthServer) + RS
  (createMcpHandler behind requireBearerAuth(demoTokenVerifier)) so
  simpleOAuthClient.ts has an in-repo target (M2). README run-manually section.
- legacy-routing/: CORS exposedHeaders recipe (M8), explicit GET/DELETE routes
  for the sessionful arm (M9), README section on direct
  WebStandardStreamableHTTPServerTransport construction (M6).
- repl/server.ts: re-hosted on sessionful NodeStreamableHTTPServerTransport
  with an InMemoryEventStore so the REPL client's reconnect/resumability
  commands work (M7).
- elicitation/: plan_trip tool chains two form elicitations inside one tool
  call on both eras (M4).
- oauth-client-credentials/README: PrivateKeyJwtProvider section pointing at
  the client guide snippet (M3).
- examples/README: fix #backwards-compatibility -> #sse-fallback-for-legacy-servers
  (docs:check broken anchor); update oauth/ row.
- CONTRIBUTING + root package.json: drop stale examples-server / oauth/
  simpleStreamableHttpServer.ts references.
- stickynotes/client.ts: header says 2025-era (matches era pin).

Author: felixweinberger

CONTRIBUTING.md

@@ -112,16 +112,19 @@ Then:
 
 ### Running Examples
 
-See [`examples/server/README.md`](examples/server/README.md) and [`examples/client/README.md`](examples/client/README.md) for a full list of runnable examples.
+See [`examples/README.md`](examples/README.md) for the full list of runnable examples — one self-verifying client/server pair per directory.
 
 Quick start:
 
 ```bash
-# Run a server example
-pnpm --filter @modelcontextprotocol/examples-server exec tsx src/simpleStreamableHttp.ts
+# Run any story's server
+pnpm --filter @mcp-examples/tools server -- --http --port 3000
 
-# Run a client example (in another terminal)
-pnpm --filter @modelcontextprotocol/examples-client exec tsx src/simpleStreamableHttp.ts
+# Run its client (in another terminal)
+pnpm --filter @mcp-examples/tools client -- --http http://127.0.0.1:3000/
+
+# Run every story over every transport × era leg
+pnpm run:examples
 ```
 
 ## Releasing v1.x Patches

examples/README.md

@@ -56,14 +56,14 @@ Some stories mount at a different path (e.g. `/`); check the story's `package.js
 
 ## Excluded
 
-| Directory                                                                                  | What it is                                                                                                      | Why not in CI                                                                                                                                                                                                 |
-| ------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [`oauth/`](./oauth/README.md)                                                              | Interactive authorization-code OAuth flow (`simpleOAuthClient.ts`, `dualModeAuth.ts`, `simpleTokenProvider.ts`) | Opens a real browser and runs a callback server on `:8090`. The headless machine-to-machine grant is covered by [`oauth-client-credentials/`](./oauth-client-credentials/README.md).                          |
-| [`repl/`](./repl/README.md)                                                                | Fully-featured HTTP playground server + readline client                                                         | Interactive — `client.ts` reads from stdin. Run manually in two terminals.                                                                                                                                    |
-| [`sse-polling/`](./sse-polling/README.md), [`standalone-get/`](./standalone-get/README.md) | Legacy sessionful-2025 SSE stories (SEP-1699 reconnect/replay; standalone GET stream)                           | Kept for reference; long-running reconnect/timer flows that need a longer per-leg readiness wait than the harness default. Self-verifying — flip the `excluded` flag once the harness has bounded-wait knobs. |
-| [`guides/`](./guides/README.md)                                                            | Snippet collections synced into `docs/server.md` and `docs/client.md`                                           | Typecheck-only; not a runnable pair.                                                                                                                                                                          |
-| `server-quickstart/`, `client-quickstart/`                                                 | Website-tutorial sources                                                                                        | External network / API key; typecheck-only.                                                                                                                                                                   |
-| `shared/`                                                                                  | Demo OAuth provider helper library                                                                              | Not a story — imported by the OAuth examples.                                                                                                                                                                 |
+| Directory                                                                                  | What it is                                                                                                               | Why not in CI                                                                                                                                                                                                 |
+| ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`oauth/`](./oauth/README.md)                                                              | Interactive authorization-code OAuth flow: in-repo protected `server.ts` (demo AS + RS) + browser `simpleOAuthClient.ts` | Opens a real browser and runs a callback server on `:8090`. The headless machine-to-machine grant is covered by [`oauth-client-credentials/`](./oauth-client-credentials/README.md).                          |
+| [`repl/`](./repl/README.md)                                                                | Fully-featured HTTP playground server + readline client                                                                  | Interactive — `client.ts` reads from stdin. Run manually in two terminals.                                                                                                                                    |
+| [`sse-polling/`](./sse-polling/README.md), [`standalone-get/`](./standalone-get/README.md) | Legacy sessionful-2025 SSE stories (SEP-1699 reconnect/replay; standalone GET stream)                                    | Kept for reference; long-running reconnect/timer flows that need a longer per-leg readiness wait than the harness default. Self-verifying — flip the `excluded` flag once the harness has bounded-wait knobs. |
+| [`guides/`](./guides/README.md)                                                            | Snippet collections synced into `docs/server.md` and `docs/client.md`                                                    | Typecheck-only; not a runnable pair.                                                                                                                                                                          |
+| `server-quickstart/`, `client-quickstart/`                                                 | Website-tutorial sources                                                                                                 | External network / API key; typecheck-only.                                                                                                                                                                   |
+| `shared/`                                                                                  | Demo OAuth provider helper library                                                                                       | Not a story — imported by the OAuth examples.                                                                                                                                                                 |
 
 ## Multi-node deployment patterns
 
@@ -165,5 +165,5 @@ For scenarios where local in-memory state must be maintained on specific nodes,
 
 ## Backwards compatibility (Streamable HTTP ↔ legacy SSE)
 
-A client that needs to fall back from Streamable HTTP to the legacy HTTP+SSE transport (for servers that only implement the older transport) follows the [`connect_sseFallback`](../docs/client.md#backwards-compatibility) recipe in the client guide — try
+A client that needs to fall back from Streamable HTTP to the legacy HTTP+SSE transport (for servers that only implement the older transport) follows the [`connect_sseFallback`](../docs/client.md#sse-fallback-for-legacy-servers) recipe in the client guide — try
 `StreamableHTTPClientTransport` first, fall back to `SSEClientTransport` on a 4xx. There is no runnable pair for this in `examples/` (the legacy SSE server transport is deprecated); the snippet in `guides/clientGuide.examples.ts` is the complete pattern.

examples/elicitation/README.md

@@ -8,7 +8,8 @@ Server requests user input. One factory, both protocol eras: elicitation works o
 | **url** (`link_account`)           | `await ctx.mcpReq.elicitInput({ mode: 'url', url, elicitationId })` + `createElicitationCompletionNotifier(elicitationId)` for the out-of-band `notifications/elicitation/complete` | `return inputRequired({ inputRequests: { auth: inputRequired.elicitUrl(...) } })` — no `elicitationId` / complete notification on this era                            |
 | **url, throw** (`confirm_payment`) | `throw new UrlElicitationRequiredError([...])` — the wire `-32042`; the client catches the typed error and reads `.elicitations`                                                    | n/a — a throw on this era fails loudly with a steer to `inputRequired.elicitUrl(...)`                                                                                 |
 
-The form schema includes an `enumNames` field (display labels for the `plan` enum). For the secure `requestState` round-trip pattern see [`../mrtr/`](../mrtr/README.md).
+`plan_trip` chains **two** form elicitations inside one tool call (destination → dates for that destination): two sequential `ctx.mcpReq.elicitInput` pushes on 2025, two `inputRequired` rounds with `requestState` carry-over on 2026. The `register_user` form schema includes an
+`enumNames` field (display labels for the `plan` enum). For the secure `requestState` round-trip pattern see [`../mrtr/`](../mrtr/README.md).
 
 **stdio-only** in the harness: push server→client requests need either a stdio connection or a sessionful HTTP transport (see `../legacy-routing/`); the harness's `--http` arm is the stateless per-request `createMcpHandler`.
 

examples/elicitation/client.ts

@@ -44,6 +44,12 @@ runClient('elicitation', async () => {
             }
             return { action: 'accept' };
         }
+        if (params.requestedSchema?.properties?.['destination']) {
+            return { action: 'accept', content: { destination: 'Tokyo' } };
+        }
+        if (params.requestedSchema?.properties?.['departure']) {
+            return { action: 'accept', content: { departure: '2026-09-01', nights: 7 } };
+        }
         check.ok(params.requestedSchema?.properties?.['username'], 'elicitation should carry the requestedSchema');
         if (formAction === 'decline') return { action: 'decline' };
         return { action: 'accept', content: { username: 'alice', email: 'alice@example.com', plan: 'pro' } };
@@ -60,6 +66,10 @@ runClient('elicitation', async () => {
     const declined = await client.callTool({ name: 'register_user' });
     check.match(declined.content?.[0]?.type === 'text' ? declined.content[0].text : '', /registration decline/);
 
+    // ---- Multi-step form (two chained elicitations inside one tool call) -----
+    const trip = await client.callTool({ name: 'plan_trip' });
+    check.match(trip.content?.[0]?.type === 'text' ? trip.content[0].text : '', /trip planned: Tokyo on 2026-09-01 for 7 nights/);
+
     // ---- URL mode (push-style on 2025, inputRequired.elicitUrl on 2026) ------
     const linked = await client.callTool({ name: 'link_account', arguments: { provider: 'github' } });
     check.match(linked.content?.[0]?.type === 'text' ? linked.content[0].text : '', /linked github/);

examples/elicitation/server.ts

@@ -89,6 +89,61 @@ function buildServer(reqCtx: McpRequestContext): McpServer {
         }
     );
 
+    // ---- Multi-step / chained form elicitation (two sequential prompts) ------
+    server.registerTool(
+        'plan_trip',
+        { description: 'Plan a trip by collecting a destination and then dates for that destination' },
+        async (ctx): Promise<CallToolResult | InputRequiredResult> => {
+            const DEST: ElicitRequestFormParams['requestedSchema'] = {
+                type: 'object',
+                properties: { destination: { type: 'string', title: 'Destination' } },
+                required: ['destination']
+            };
+            const datesFor = (dest: string): ElicitRequestFormParams['requestedSchema'] => ({
+                type: 'object',
+                properties: {
+                    departure: { type: 'string', title: `Departure date for ${dest}`, format: 'date' },
+                    nights: { type: 'integer', title: 'Nights', minimum: 1, maximum: 30 }
+                },
+                required: ['departure', 'nights']
+            });
+            if (reqCtx.era === 'legacy') {
+                // 2025-era: two sequential `elicitation/create` pushes inside one tool call.
+                const step1 = await ctx.mcpReq.elicitInput({ mode: 'form', message: 'Where to?', requestedSchema: DEST });
+                if (step1.action !== 'accept' || !step1.content) {
+                    return { content: [{ type: 'text', text: `trip ${step1.action}` }] };
+                }
+                const dest = step1.content.destination as string;
+                const step2 = await ctx.mcpReq.elicitInput({ mode: 'form', message: 'When?', requestedSchema: datesFor(dest) });
+                if (step2.action !== 'accept' || !step2.content) {
+                    return { content: [{ type: 'text', text: `trip ${step2.action}` }] };
+                }
+                return {
+                    content: [
+                        { type: 'text', text: `trip planned: ${dest} on ${step2.content.departure} for ${step2.content.nights} nights` }
+                    ]
+                };
+            }
+            // 2026-07-28: two `inputRequired` rounds — the second carries the
+            // first answer back via `requestState` (an opaque server-minted
+            // string) so the chain survives the stateless retry. See ../mrtr/
+            // for integrity-protecting `requestState` in production.
+            const dates = acceptedContent<{ departure: string; nights: number }>(ctx.mcpReq.inputResponses, 'dates');
+            const destination =
+                ctx.mcpReq.requestState ?? acceptedContent<{ destination: string }>(ctx.mcpReq.inputResponses, 'dest')?.destination;
+            if (!destination) {
+                return inputRequired({ inputRequests: { dest: inputRequired.elicit({ message: 'Where to?', requestedSchema: DEST }) } });
+            }
+            if (!dates) {
+                return inputRequired({
+                    requestState: destination,
+                    inputRequests: { dates: inputRequired.elicit({ message: 'When?', requestedSchema: datesFor(destination) }) }
+                });
+            }
+            return { content: [{ type: 'text', text: `trip planned: ${destination} on ${dates.departure} for ${dates.nights} nights` }] };
+        }
+    );
+
     // ---- URL-mode elicitation (push style + completion notification) ---------
     server.registerTool(
         'link_account',

examples/legacy-routing/README.md

@@ -2,4 +2,25 @@
 
 `isLegacyRequest` routing: keep an **existing** sessionful 1.x Streamable HTTP deployment serving 2025-era clients, add a strict `createMcpHandler({ legacy: 'reject' })` for 2026-07-28 traffic, on the **same port**. The predicate decides per request which arm handles it.
 
+`server.ts` also shows the browser-client CORS `exposedHeaders` recipe and explicit `GET` (standalone SSE stream) / `DELETE` (session termination per the MCP spec) routes for the sessionful arm.
+
 **HTTP-only** by definition; see also `dual-era/` for the simple case where you don't have a sessionful deployment to keep.
+
+## Direct transport construction (without `createMcpHandler`)
+
+If you need full control over the per-request transport on a web-standards runtime (Hono, Cloudflare Workers, …) instead of `createMcpHandler`, construct `WebStandardStreamableHTTPServerTransport` directly:
+
+```ts
+import { McpServer, WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+
+const transport = new WebStandardStreamableHTTPServerTransport({
+    sessionIdGenerator: () => crypto.randomUUID()
+});
+const server = new McpServer({ name: 'direct-transport', version: '1.0.0' });
+await server.connect(transport);
+
+// Any Request/Response runtime (fetch handler, Hono `c.req.raw`, …):
+export default { fetch: (request: Request) => transport.handleRequest(request) };
+```
+
+`NodeStreamableHTTPServerTransport` (used in this story's legacy arm) is the Node.js `IncomingMessage`/`ServerResponse` equivalent.

examples/legacy-routing/package.json

@@ -11,10 +11,12 @@
         "@modelcontextprotocol/express": "workspace:*",
         "@modelcontextprotocol/node": "workspace:*",
         "@modelcontextprotocol/server": "workspace:*",
+        "cors": "catalog:runtimeServerOnly",
         "express": "catalog:runtimeServerOnly",
         "zod": "catalog:runtimeShared"
     },
     "devDependencies": {
+        "@types/cors": "catalog:devTools",
         "tsx": "catalog:devTools"
     },
     "example": {

examples/legacy-routing/server.ts

@@ -16,6 +16,7 @@ import { createMcpExpressApp } from '@modelcontextprotocol/express';
 import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { McpRequestContext } from '@modelcontextprotocol/server';
 import { createMcpHandler, isInitializeRequest, isLegacyRequest, McpServer } from '@modelcontextprotocol/server';
+import cors from 'cors';
 import type { Request, Response } from 'express';
 import * as z from 'zod/v4';
 
@@ -56,7 +57,19 @@ const handleLegacy = async (req: Request, res: Response) => {
 const modern = createMcpHandler((ctx: McpRequestContext) => buildServer(ctx.era), { legacy: 'reject' });
 
 const app = createMcpExpressApp();
-app.all('/', async (req: Request, res: Response) => {
+// Browser-client CORS recipe: expose the response headers a browser-based MCP
+// client must be able to read (`Mcp-Session-Id` for session correlation,
+// `WWW-Authenticate` for the auth challenge, `Last-Event-Id` for resumability,
+// `Mcp-Protocol-Version` for negotiation). DEMO ONLY — restrict `origin` in
+// production.
+app.use(
+    cors({
+        origin: '*',
+        exposedHeaders: ['Mcp-Session-Id', 'WWW-Authenticate', 'Last-Event-Id', 'Mcp-Protocol-Version']
+    })
+);
+
+app.post('/', async (req: Request, res: Response) => {
     // The predicate inspects the same headers + body the entry does. Express
     // has parsed the JSON body; pass it as `parsedBody` so the predicate need
     // not re-read the stream.
@@ -66,6 +79,11 @@ app.all('/', async (req: Request, res: Response) => {
     });
     await ((await isLegacyRequest(probe, req.body)) ? handleLegacy(req, res) : modern.node(req, res, req.body));
 });
+// GET (standalone SSE stream / reconnect with Last-Event-ID) and DELETE
+// (explicit session termination per the MCP spec) are sessionful-2025-only —
+// route them straight to the legacy arm; the transport handles each verb.
+app.get('/', (req, res) => void handleLegacy(req, res));
+app.delete('/', (req, res) => void handleLegacy(req, res));
 
 const argv = process.argv.slice(2);
 const portIdx = argv.indexOf('--port');