Support resource subscriptions (#839)

Clients can now subscribe to specific resources and receive targeted
notifications when those resources change. Previously, calling
`notifyResourceUpdated` on the server would broadcast the notification
to every connected client regardless of interest — now only sessions
that have explicitly subscribed to a given resource URI receive the
update, making resource change propagation both correct and efficient.
The subscription lifecycle is fully handled: clients can subscribe and
unsubscribe at any time, and the server cleans up subscription state
when a session closes.

Supersedes #838.
Resolves #837, #776.

---------

Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>
This commit is contained in:
Dariusz Jędrzejczyk 2026-03-02 15:26:03 +01:00 • committed by GitHub
commit 7f68ea5bc0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 506 additions and 60 deletions

View file

@ -2,27 +2,22 @@
## Summary
**Server Tests:** 37/40 passed (92.5%)
**Server Tests:** 40/40 passed (100%)
**Client Tests:** 3/4 scenarios passed (9/10 checks passed)
**Auth Tests:** 12/14 scenarios fully passing (178 passed, 1 failed, 1 warning, 85.7% scenarios, 98.9% checks)
## Server Test Results
### Passing (37/40)
### Passing (40/40)
- **Lifecycle & Utilities (4/4):** initialize, ping, logging-set-level, completion-complete
- **Tools (11/11):** All scenarios including progress notifications ✨
- **Elicitation (10/10):** SEP-1034 defaults (5 checks), SEP-1330 enums (5 checks)
- **Resources (4/6):** list, read-text, read-binary, templates-read
- **Resources (6/6):** list, read-text, read-binary, templates-read, subscribe, unsubscribe
- **Prompts (4/4):** list, simple, with-args, embedded-resource, with-image
- **SSE Transport (2/2):** Multiple streams
- **Security (2/2):** Localhost validation passes, DNS rebinding protection
### Failing (3/40)
1. **resources-subscribe** - Not implemented in SDK
2. **resources-unsubscribe** - Not implemented in SDK
## Client Test Results
### Passing (3/4 scenarios, 9/10 checks)
@ -68,10 +63,9 @@ Uses the `client-spring-http-client` module with Spring Security OAuth2 and the
## Known Limitations
1. **Resource Subscriptions:** SDK doesn't implement `resources/subscribe` and `resources/unsubscribe` handlers
2. **Client SSE Retry:** Client doesn't parse or respect the `retry:` field, reconnects immediately, and doesn't send Last-Event-ID header
3. **Auth Scope Step-Up:** Client does not fully handle scope step-up challenges where the server requests additional scopes after initial authorization
4. **Auth Basic CIMD:** Minor conformance warning in the basic Client-Initiated Metadata Discovery flow
1. **Client SSE Retry:** Client doesn't parse or respect the `retry:` field, reconnects immediately, and doesn't send Last-Event-ID header
2. **Auth Scope Step-Up:** Client does not fully handle scope step-up challenges where the server requests additional scopes after initial authorization
3. **Auth Basic CIMD:** Minor conformance warning in the basic Client-Initiated Metadata Discovery flow
## Running Tests
@ -118,6 +112,5 @@ npx @modelcontextprotocol/conformance@0.1.15 client \
### High Priority
1. Fix client SSE retry field handling in `HttpClientStreamableHttpTransport`
2. Implement resource subscription handlers in `McpStatelessAsyncServer`
3. Implement CIMD
4. Implement scope step up
2. Implement CIMD
3. Implement scope step up

View file

@ -2,11 +2,6 @@
# This file lists known failing scenarios that are expected to fail until fixed.
# See: https://github.com/modelcontextprotocol/conformance/blob/main/SDK_INTEGRATION.md
server:
# Resource subscription not implemented in SDK
- resources-subscribe
- resources-unsubscribe
client:
# SSE retry field handling not implemented
# - Client does not parse or respect retry: field timing

View file

@ -4,7 +4,7 @@ This module contains a comprehensive MCP (Model Context Protocol) server impleme
## Conformance Test Results
**Status: 37 out of 40 tests passing (92.5%)**
**Status: 40 out of 40 tests passing (100%)**
The server has been validated against the official [MCP conformance test suite](https://github.com/modelcontextprotocol/conformance). See [VALIDATION_RESULTS.md](../VALIDATION_RESULTS.md) for detailed results.
@ -22,9 +22,8 @@ The server has been validated against the official [MCP conformance test suite](
- SEP-1034: Default values for all primitive types
- SEP-1330: All enum schema variants
✅ **Resources** (4/6)
- List, read text/binary, templates
- ⚠️ Subscribe/unsubscribe (SDK limitation)
✅ **Resources** (6/6)
- List, read text/binary, templates, subscribe, unsubscribe
✅ **Prompts** (4/4)
- Simple, parameterized, embedded resources, images
@ -191,12 +190,7 @@ curl -X POST http://localhost:8080/mcp \
## Known Limitations
See [VALIDATION_RESULTS.md](../VALIDATION_RESULTS.md) for details on:
1. **Resource Subscriptions** - Not implemented in Java SDK
2. **DNS Rebinding Protection** - Missing Host/Origin validation
These are SDK-level limitations that require fixes in the core framework.
See [VALIDATION_RESULTS.md](../VALIDATION_RESULTS.md) for details on remaining client-side limitations.
## References