diff --git a/CHANGELOG.md b/CHANGELOG.md
index e72e98a..a0f87ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -81,3 +81,10 @@ All notable changes to this project are documented here. The format is based on
   union to its concrete member (optionality is already carried by the field's `required` flag).
   The IR for the vendored `codegen/openapi.yaml` is byte-identical before and after, so no
   generated SDK changes.
+
+### Security
+
+- **Bumped `@modelcontextprotocol/sdk` to `^1.30.0`** in `sdk-typescript/packages/mcp-server`.
+  SDK 1.30.0 widens its `@hono/node-server` range to `^1.19.9 || ^2.0.5`, moving the transitive
+  dependency from 1.19.14 to 2.1.1 and clearing the moderate advisory affecting versions
+  below 2.0.5. No override or pin needed; the SDK update is the whole fix. (#49)
diff --git a/sdk-typescript/packages/mcp-server/package.json b/sdk-typescript/packages/mcp-server/package.json
index a99d37a..4b2458e 100644
--- a/sdk-typescript/packages/mcp-server/package.json
+++ b/sdk-typescript/packages/mcp-server/package.json
@@ -64,7 +64,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^3.23.0"
   },
   "devDependencies": {
diff --git a/sdk-typescript/pnpm-lock.yaml b/sdk-typescript/pnpm-lock.yaml
index 0942963..23ae2e9 100644
--- a/sdk-typescript/pnpm-lock.yaml
+++ b/sdk-typescript/pnpm-lock.yaml
@@ -548,8 +548,8 @@ importers:
   packages/mcp-server:
     dependencies:
       '@modelcontextprotocol/sdk':
-        specifier: ^1.0.0
-        version: 1.29.0(zod@3.25.76)
+        specifier: ^1.30.0
+        version: 1.30.0(zod@3.25.76)
       zod:
         specifier: ^3.23.0
         version: 3.25.76
@@ -1385,9 +1385,9 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@hono/node-server@1.19.14':
-    resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==}
-    engines: {node: '>=18.14.1'}
+  '@hono/node-server@2.1.1':
+    resolution: {integrity: sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==}
+    engines: {node: '>=20'}
     peerDependencies:
       hono: ^4
 
@@ -1404,8 +1404,8 @@ packages:
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
-  '@modelcontextprotocol/sdk@1.29.0':
-    resolution: {integrity: sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==}
+  '@modelcontextprotocol/sdk@1.30.0':
+    resolution: {integrity: sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==}
     engines: {node: '>=18'}
     peerDependencies:
       '@cfworker/json-schema': ^4.1.1
@@ -2582,7 +2582,7 @@ snapshots:
   '@esbuild/win32-x64@0.27.7':
     optional: true
 
-  '@hono/node-server@1.19.14(hono@4.12.32)':
+  '@hono/node-server@2.1.1(hono@4.12.32)':
     dependencies:
       hono: 4.12.32
 
@@ -2600,9 +2600,9 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)':
+  '@modelcontextprotocol/sdk@1.30.0(zod@3.25.76)':
     dependencies:
-      '@hono/node-server': 1.19.14(hono@4.12.32)
+      '@hono/node-server': 2.1.1(hono@4.12.32)
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
       content-type: 1.0.5