Commit graph

596 commits

Author SHA1 Message Date
Daniel Garnier-Moiroux
5ed6063a07 Update conformance tests with DNS rebinding protection
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2026-02-05 10:20:27 +01:00
Daniel Garnier-Moiroux
96c9bbe745 Add Origin header validation
- Fixes #695
- Does not implement Host header validation yet

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2026-02-05 10:20:27 +01:00
Daniel Garnier-Moiroux
a47920ca07 Update JUnit 5.10.2 -> 6.0.2
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2026-02-04 15:33:26 +01:00
Filip Hrisafov
67db591ecf Use junit.version for all junit dependencies 2026-02-04 14:41:04 +01:00
Dariusz Jędrzejczyk
4fe8f3efef
Add MCP conformance tests with client and server test suites (#767)
Implement conformance testing modules with comprehensive client/server test scenarios,
sync conversion for client/servlet code, CI integration, and documentation updates.

---------

Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>
2026-01-30 15:51:19 +01:00
Dariusz Jędrzejczyk
0a8cb1e038
Decouple mcp-test and mcp-spring modules from Jackson implementation (#760)
This is a follow-up to #742.

The `mcp-test`, `mcp-spring-webflux`, and `mcp-spring-webmvc` depended
on `mcp` module which transitively brought in Jackson 3 dependencies.
These modules are now decoupled and only depend on `mcp-core`.

The test dependencies bring in Jackson 2 for the time being.

This is a breaking change but it is required to allow easily exchanging
Jackson2 and Jackson3 modules.

Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>
2026-01-27 15:47:28 +01:00
Filip Hrisafov
2456a0e433
Add Support for Jackson 3 (#742)
This change adds Jackson 3 support and aligns package naming in the existing Jackson 2 module.

Specific changes:
* Deprecated classes for removal in `io.modelcontextprotocol.json.jackson`/`io.modelcontextprotocol.json.schema.jackson`
* Copied the above to `io.modelcontextprotocol.json.jackson2`/`io.modelcontextprotocol.json.schema.jackson2` in non-deprecated form.
* Added tests for the default McpJsonMapper and JsonSchemaValidator
2026-01-26 11:43:35 +01:00
Dariusz Jędrzejczyk
af65356416
Fix everything-server-based integration tests (#756)
* Pin `npx @modelcontextprotocol/server-everything` version to `2025.12.18`.
* Replace `tzolov/mcp-everything-server` Docker image with `node:lts-alpine` + `npx` command.
* Handle HTTP 202 special case.
* Fix test assertions.

The recent rollout of everything-server broke integration tests which take the latest version from the node registry.
This PR unifies the everything-server usage - the Testcontainers Docker setup uses the same version as the STDIO npx-based tests and no longer relies on tzolov/mcp-everything-server.

Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>
2026-01-20 16:09:41 +01:00
Sébastien Deleuze
f7a460fb50
Upgrade to testcontainers 1.21.4 (#743)
To fix a "docker-machine executable was not found on PATH"
error with recent Docker versions (impact at least Docker
4.55 and 4.56).
2026-01-12 15:55:20 +01:00
Jordan Zimmerman
b518393cfd
Expose resourcesUpdateConsumer() in sync client (#735)
`resourcesUpdateConsumer()` was missing from the sync client. Add it.
2026-01-08 20:29:05 +01:00
Christian Tzolov
cb533b2e0e Fix fomratting
Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2026-01-08 20:26:39 +01:00
Sergio del Amo
dce48929a5
add 2025-11-25 version to ProtocolVersions (#733) 2026-01-08 20:25:43 +01:00
Rohit
e7901da010
fix: Support form and url fields in Elicitation capability per 2025-11-25 spec (#731)
Update the ClientCapabilities.Elicitation record to accept optional "form"
and "url" fields as defined in the MCP 2025-11-25 specification.

Previously, deserializing an InitializeRequest with
`{"capabilities":{"elicitation":{"form":{}}}}` would fail with
UnrecognizedPropertyException because the Elicitation record was empty.

Changes:
- Add nested Form and Url marker records to Elicitation
- Add no-arg constructor for backward compatibility (serializes to {})
- Add elicitation(boolean form, boolean url) builder method
- Add comprehensive tests for deserialization and serialization

Fixes #724
2026-01-08 19:29:39 +01:00
Jonathan Hefner
fa9dac88c5
fix: Enable javadoc generation for modules with OSGi metadata (#705)
fix: enable javadoc HTML generation by using legacyMode
2025-12-15 15:52:13 +01:00
ashakirin
d3d88425e8
fix: Fixed html encoding in javadoc (#727) 2025-12-15 15:44:31 +01:00
Christian Tzolov
082444e18f Next development version
Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-12-04 15:57:27 +01:00
Christian Tzolov
06fdc71ef2
Revert "WebClientStreamableHttpTransport: use Spring-5 compatible methods (#649)" (#696)
This reverts commit 67f8eabb7a.
2025-11-28 13:35:10 +01:00
Daniel Garnier-Moiroux
e6045f7287 Basic version negotiation capabilities
- We do not support full version negotiation, but this commit allows the
  client to the send the correct version to match that of the server.
- There is one limitation: the GET /mcp request happens too early,
  before we have deserialized the initialization response, so we do not
  know the negotiated version yet. This request will have the client
  latest version as Mcp-Protocol-Version value.

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-11-21 14:29:47 +01:00
codeboyzhou
7e950ebb6c
refactor: use builder pattern for CallToolResult and Resource (#652)
* use builder pattern for CallToolResult
* use builder pattern for Resource
* simplify lambda expressions in tests
2025-11-21 13:44:29 +01:00
Daniel Garnier-Moiroux
c561675e74 WebMvcSseServerTransportProvider: do not include session ID in SSE event
- This aligns messages with WebFluxSseServerTransportProvider

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-11-20 10:03:18 +01:00
lance
86991c1e49 fix the baseUrl is configured with a trailing slash
Signed-off-by: lance <leehaut@gmail.com>
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-11-19 14:20:16 +01:00
He-Pin(kerr)
67f8eabb7a
WebClientStreamableHttpTransport: use Spring-5 compatible methods (#649)
Signed-off-by: He-Pin <hepin1989@gmail.com>
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-11-19 10:50:44 +01:00
Daniel Garnier-Moiroux
87bdf1ee49
Client transports: make #protocolVersions() configurable (#669)
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-11-18 14:53:50 +01:00
mingo007
bc308573f3 Fix typo in test name: testPingWithEaxctExceptionType -> testPingWithExactExceptionType 2025-11-18 13:44:41 +01:00
Daniel Garnier-Moiroux
2d22868e1e
Fix experimental client capabilities tests (#670)
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-11-18 10:20:08 +01:00
Christian Tzolov
e3079270d5 Next development version
Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-11-12 16:13:08 +01:00
Christian Tzolov
b74f6de9dc
feat(schema): support Object type for progressToken (#663)
Change progressToken from String to Object throughout McpSchema
to allow both String and Number token types.
This makes it compliant with the MCP spec.

Resolves: #659

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-11-12 15:20:44 +01:00
Viliam Sun
738525308d
fix(docs): Remove broken @see link in resourceTemplates Javadoc (#614) 2025-11-12 14:44:35 +01:00
Michael Vorburger
afa00902a4
fix: JSONRPCResponse JavaDoc (#657) 2025-11-12 14:21:57 +01:00
Uladzislau Arlouski
ed85f7ee3e
Bump json-schema-validator from 1.5.7 to 2.0.0 (#660) 2025-11-12 14:21:09 +01:00
Christian Tzolov
476f9db36f
feat: enhance error handling with custom error code preservation (#653)
- Improve McpClientSession error handling to preserve custom error codes
and data from McpError instances.
- Add aggregated exception messages to error data field for better debugging.
- Include test coverage for various McpClientSession error scenarios.

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-11-07 11:56:21 +02:00
Christian Tzolov
6e9af40bcb Next development version
Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-10-30 19:02:32 +01:00
Dmitry Bedrin
14ff4a385d
Support o.s.h.HttpHeaders from both 6.x and 7.x branches to enable migration to Spring 7 (#639) 2025-10-30 16:27:08 +01:00
Dmitry Bedrin
0980f08e94
Update dependencies minor versions to fix build on JDK 25 (#640) 2025-10-30 16:26:25 +01:00
Christian Tzolov
5c46626260
chore: standardize client/server implementation names and version (#642)
Unifies client/server implementation names under "Java SDK" branding
and updates all versions to 0.15.0.

Resolves: #638

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-10-30 12:17:42 +01:00
lance
e91fe7fbc5
Fix: McpAsyncClient#listTools prevent infinite recursion (#631)
* Fix: prevent infinite recursion in listTools() when nextCursor is empty string

Signed-off-by: lance <leehaut@gmail.com>
2025-10-30 11:59:34 +01:00
Daniel Garnier-Moiroux
9bbfbe573a
Close McpTransportSession on transport close (#632)
* Client HTTP transports: use McpTransportSession interface instead of concrete types
* Streamable HTTP tranports: .closeGracefully closes the session

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-10-28 14:26:21 +01:00
Christian Tzolov
2ee58533d0
fix: allow additional properties by default per JSON Schema spec (#617)
- Remove automatic additionalProperties: false injection (JSON Schema spec compliance)
- Support String input for structuredContent in validate() method
- Move tests to mcp-json-jackson2 module with proper dependencies
- Replace wildcard imports with explicit imports

Complies with JSON Schema Test Suite:
15e4505/tests/draft2020-12/additionalProperties.json\#L112

Fixes #584

BREAKING CHANGE: Additional properties now allowed by default when not explicitly specified.

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-10-14 09:30:59 +02:00
Sheegan Sri G M
19a8c00a47 fix: improve URI template matching to properly escape special characters (#599)
- Enhanced DefaultMcpUriTemplateManager to use Pattern.quote() for escaping special regex characters like '?'
- Replaced simple string replacement regex generation with robust pattern building
- Added test case to verify URI matching with query parameters (e.g., "file://name/search?={search}")
- Fixed typo: renamed DeafaultMcpUriTemplateManagerFactory to DefaultMcpUriTemplateManagerFactory
- Updated all references across server classes and tests

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-10-07 00:21:51 +02:00
Christian Tzolov
a63d32a5ea
refactor: change int to Integer for optional numeric fields (#604)
Convert primitive int types to Integer wrapper class for:
- JSONRPCError.code
- CreateMessageRequest.maxTokens (including constructor and builder)

This allows these fields to be nullable, properly representing
optional parameters in the MCP protocol schema.

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-10-06 23:04:42 +02:00
Sergio del Amo
94a8b53d88
fix remove name when using deduction (#600)
This pull-request removes the name member from the @JsonSubTypes.Type annotations when using JsonTypeInfo.Id.DEDUCTION.

With DEDUCTION, Jackson ignores the name entirely because it's inferring the type from the structure.
2025-10-06 23:00:54 +02:00
Sergio del Amo
83fc4f79de
define explicitely that values should always be included in code completions (#601)
* define explicitely that values should always be included

* spring  apply
2025-10-06 21:55:23 +02:00
Christian Tzolov
95323b3371 Update theREADME team section
Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-10-03 10:56:50 +02:00
Dariusz Jędrzejczyk
8a0eb130ad Add section describing our architectural and design choices (#595)
Co-authored-by: Adib Saikali <asaikali@gmail.com>
Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>
2025-10-03 10:53:34 +02:00
Christian Tzolov
c734b2a5c1 Next development version
Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-10-02 00:03:36 +01:00
Anurag Pant
8e11fa82ae feat(client): add client tool output schema validation and caching (#302)
- Add JSON schema validation for tool call results against output schemas
- Implement automatic tool output schema caching during initialization
- Add `enableCallToolSchemaCaching` configuration option to enable/disable
  schema caching
- Add `JsonSchemaValidator` integration to McpClient builder APIs
- Introduce post-initialization hook mechanism for performing operations
  after successful client initialization
- Cache tool output schemas during `listTools` operations when caching
  is enabled
- Validate tool results against cached schemas in `callTool` operations
- Return error CallToolResult when validation fails
- Add test coverage
- Convert validateToolResult from Mono to synchronous method
- Throw IllegalArgumentException on validation errors

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>

Co-authored-by: Anurag Pant <pantanurag555@github>
Co-authored-by: Christian Tzolov <christian.tzolov@broadcom.com>
Co-authored-by: Daniel Garnier-Moiroux <git@garnier.wf>
Co-authored-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>
2025-10-01 23:12:33 +01:00
Christian Tzolov
3f7578b3ce
fix: Handle non-compliant notification responses (#589)
Ensure warnings are logged for all non-compliant responses to JSON-RPC
notifications, including empty responses. Empty responses now display
as "[empty]" in log messages for better clarity.

Resolves #586

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-10-01 23:14:29 +02:00
Daniel Garnier-Moiroux
080098e48c Client: handle server responses with Content-Length: 0
- When the client sends `notification/initalized`, servers must respond
  with HTTP 202 and an empty body. We checked for the absence of a
  Content-Type header to verify whether the body was empty.
- However, some servers will send an empty body with a Content-Type
  header, and that header may have an unsupported, default type such as
  `text/html` or `text/plain`.
- Now we we also use the Content-Length header to check for an empty
  body. This header is optional in HTTP/2, so we do not make it our
  primary mechanism for detecting empty bodies.
- As part of this PR, we also move hard-coded HTTP header names to the
  HttpHeaders interface. While they are not defined by the MCP spec,
  they are used by it and are core to implementing the protocol.
  Therefore, they have their place in a core interface.
- Fixes #582

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-10-01 13:09:30 +02:00
Sergio del Amo
12292ab598
fix: when using JsonTypeInfo.DEDUCTION don’t add include (#587)
From the JSonTypeInfo Javadocs:

> If deduction is being used annotation properties visible, property and include are ignored.

This is causing issues with serialization downstream.
2025-09-30 15:59:17 +02:00
Christian Tzolov
c1cde20002
refactor: improve MCP server resilience and error handling (#579)
- Replace McpError with appropriate standard exceptions (IllegalArgumentException, IllegalStateException) for validation errors
- Change tool/prompt registration to replace existing items instead of rejecting duplicates with warningsi
  - Change addTool behavior to replace existing tools instead of throwing errors
  - Change addPrompt() to allow replacing existing prompts with warning instead of throwing error
- Make removal operations idempotent - log warnings instead of throwing errors for non-existent items
  - Change removePrompt() to log warning instead of throwing error for non-existent prompts
  - Change removeTool() to gracefully handle non-existent tools with warnings instead of errors
- Add listTools() and listPrompts() methods to all server variants (async, sync, stateless)
  - Add listTools() method to all server classes for tool enumeration
  - Add listPrompts() method to all server implementations for retrieving registered prompts
- Improve error construction using McpError.builder() pattern for protocol-specific errors
- Update error handling in session classes to properly propagate McpError JSON-RPC errors
  - Use proper error codes (INVALID_PARAMS) for prompt not found scenarios
- Update tests to reflect new lenient behavior for duplicate registrations and removals
- Add aggregateExceptionMessages() utility method utility to aggregate the exception chains
- Update McpServerSession and McpStreamableServerSession to use the aggregated errors in the json-rpc-error data section

This change makes the MCP server APIs more resilient and user-friendly by using appropriate exception types,
supporting item replacement, and providing listing capabilities while maintaining backward compatibility.

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
2025-09-30 11:10:04 +02:00