| Filename | Latest commit message | Latest commit date |
|---|---|---|
22a0efa577
Every wire-serialized record in McpSchema now validates spec-required
fields at construction time. Wire deserialization is intentionally
lenient: a missing required field is replaced with a documented default
and a WARN is logged, instead of failing the parse. A required-first
builder convention is introduced across the schema so it is no longer
possible to obtain a builder that is missing required state.
Required-field guards
---------------------
Every wire record's compact constructor asserts non-null (and non-empty
for String identifiers like name, uri, uriTemplate, version) on its
spec-required components. Passing null now throws
IllegalArgumentException at construction time instead of silently
producing invalid JSON via @JsonInclude(NON_ABSENT). This applies to
the JSON-RPC envelopes, lifecycle types, resource/prompt/tool requests
and results, sampling and elicitation, content records, root, complete,
logging and progress notifications, and the two CompleteReference
implementations. See MIGRATION-2.0.md for the full list.
Lenient wire deserialization
----------------------------
For each of those records (except JSONRPCResponse.JSONRPCError, which
still fails fast) a @JsonCreator static `fromJson` factory substitutes
a documented default for any absent required field — "" for strings,
[] for collections, {} for maps, 0 / 0.0 for numerics, INFO for
LoggingLevel, USER for SamplingMessage.role, ASSISTANT for
CreateMessageResult.role, CANCEL for ElicitResult.action, {values=[]}
for CompleteResult.completion — and logs a WARN naming the field and
the value used. Application code can still observe a malformed message
and react, but the SDK no longer halts the conversation.
Builder convention
------------------
Records that have a builder gain a required-first factory method
`builder(req1, req2, …)`; setters for required fields are removed from
the builder so it cannot be left in an invalid state. Existing no-arg
`builder()` factories and required-field setters are kept where source
compatibility demands it but are marked @Deprecated. New builders are
also added for several records that previously had none (ProgressNotification,
JSONRPCError, CompleteRequest, list/result types, content records, ...).
JSON-RPC envelope ergonomics
----------------------------
Previously every JSON-RPC envelope had to be constructed via the
canonical record constructor and the literal "2.0" string had to be
threaded through every call site, e.g.
new JSONRPCRequest("2.0", "tools/call", id, params)
new JSONRPCResponse("2.0", id, result, null)
new JSONRPCResponse("2.0", id, null, new JSONRPCError(code, message, null))
Now:
new JSONRPCRequest("tools/call", id, params) // jsonrpc defaulted
new JSONRPCNotification("notifications/initialized") // params optional
JSONRPCResponse.result(id, result) // factory
JSONRPCResponse.error(id, new JSONRPCError(code, message)) // 2-arg error
JSONRPCResponse's compact constructor additionally enforces the
JSON-RPC invariant that exactly one of `result` / `error` is set —
previously the SDK could build envelopes that violated the protocol.
CompleteReference changes
-------------------------
- PromptReference.equals/hashCode now key on `name` only (previously
derived from identifier()+type()). Two refs with the same name but
different titles now compare equal — code using PromptReference as a
map/set key should be audited.
- PromptReference's compact constructor pins `type` to "ref/prompt"
and logs a WARN if the caller supplies a different non-null value.
The legacy two-arg `PromptReference(String type, String name)`
constructor remains @Deprecated.
- ResourceReference's record components are reduced from (type, uri)
to (uri) — positional construction breaks. The legacy
`ResourceReference(String type, String uri)` constructor stays
@Deprecated and ignores `type`.
- CompleteReference.identifier() is @Deprecated and now returns null
via a default method on the interface.
Tests / refactor
----------------
Conformance harness, integration tests, sample apps, and internal
callers were migrated to the new builder factories and convenience
constructors. No semantic changes to client/server runtime behaviour
beyond the McpSchema changes above.
Docs
----
- MIGRATION-2.0.md: required-field section now covers the broader
record set and the lenient-deserialization behaviour; PromptReference
WARN behaviour and ResourceReference component reduction are
documented; the JSON-RPC envelope section is rewritten to compare the
pre-2.0 surface with the new one.
- CONTRIBUTING.md: the "Evolving wire-serialized records" recipe is
split into two cases — adding a new optional field (existing rules)
and adding/maintaining a spec-required field (new rules covering
Assert in compact constructor, @JsonCreator fromJson with defaults
and WARN, required-first builder factory).
Signed-off-by: Dariusz Jędrzejczyk <2554306+chemicL@users.noreply.github.com>
|
||
| .. | ||
| src/main | ||
| pom.xml | ||
| README.md | ||
MCP Conformance Tests - Spring HTTP Client (Auth Suite)
This module provides a conformance test client implementation for the Java MCP SDK's auth suite.
OAuth2 support is not implemented in the SDK itself, but we provide hooks to implement the Authorization section of the specification. One such implementation is done in Spring, with Sprign AI and the mcp-client-security library.
This is a Spring web application, we interact with it through a normal HTTP-client that follows redirects and performs OAuth2 authorization flows.
Overview
The conformance test client is designed to work with the MCP Conformance Test Framework. It validates that the Java MCP SDK client, combined with Spring Security's OAuth2 support, properly implements the MCP authorization specification.
Test with @modelcontextprotocol/conformance@0.1.15.
Conformance Test Results
Status: 178 passed, 1 failed, 1 warning across 14 scenarios
| Scenario | Result | Details |
|---|---|---|
| auth/metadata-default | ✅ Pass | 12/12 |
| auth/metadata-var1 | ✅ Pass | 12/12 |
| auth/metadata-var2 | ✅ Pass | 12/12 |
| auth/metadata-var3 | ✅ Pass | 12/12 |
| auth/basic-cimd | ⚠️ Warning | 12/12 passed, 1 warning |
| auth/scope-from-www-authenticate | ✅ Pass | 13/13 |
| auth/scope-from-scopes-supported | ✅ Pass | 13/13 |
| auth/scope-omitted-when-undefined | ✅ Pass | 13/13 |
| auth/scope-step-up | ✅ Pass | 12/12 |
| auth/scope-retry-limit | ✅ Pass | 11/11 |
| auth/token-endpoint-auth-basic | ✅ Pass | 17/17 |
| auth/token-endpoint-auth-post | ✅ Pass | 17/17 |
| auth/token-endpoint-auth-none | ✅ Pass | 17/17 |
| auth/pre-registration | ✅ Pass | 6/6 |
See VALIDATION_RESULTS.md for the full project validation results.
Architecture
The client is a Spring Boot application that reads test scenarios from environment variables and accepts the server URL as a command-line argument, following the conformance framework's conventions:
- MCP_CONFORMANCE_SCENARIO: Environment variable specifying which test scenario to run
- MCP_CONFORMANCE_CONTEXT: Environment variable with JSON context (used by
auth/pre-registration) - Server URL: Passed as the last command-line argument
Scenario Routing
The application uses Spring's conditional configuration to select the appropriate scenario at startup:
DefaultConfiguration— Activated for all scenarios exceptauth/pre-registration. Uses the OAuth2 Authorization Code flow with dynamic client registration viaMcpClientOAuth2Configurer.PreRegistrationConfiguration— Activated only forauth/pre-registration. Uses the Client Credentials flow with pre-registered client credentials read fromMCP_CONFORMANCE_CONTEXT.
Key Dependencies
- Spring Boot 4.0 with Spring Security OAuth2 Client
- Spring AI MCP Client (
spring-ai-starter-mcp-client) - mcp-client-security — Community library providing MCP-specific OAuth2 integration (metadata discovery, dynamic client registration, transport context)
Building
Build the executable JAR:
cd conformance-tests/client-spring-http-client
../../mvnw clean package -DskipTests
This creates an executable JAR at:
target/client-spring-http-client-2.0.0-SNAPSHOT.jar
Running Tests
Using the Conformance Framework
Run the full auth suite:
npx @modelcontextprotocol/conformance@0.1.15 client \
--spec-version 2025-11-25 \
--command "java -jar conformance-tests/client-spring-http-client/target/client-spring-http-client-2.0.0-SNAPSHOT.jar" \
--suite auth
Run a single scenario:
npx @modelcontextprotocol/conformance@0.1.15 client \
--spec-version 2025-11-25 \
--command "java -jar conformance-tests/client-spring-http-client/target/client-spring-http-client-2.0.0-SNAPSHOT.jar" \
--scenario auth/metadata-default
Run with verbose output:
npx @modelcontextprotocol/conformance@0.1.15 client \
--spec-version 2025-11-25 \
--command "java -jar conformance-tests/client-spring-http-client/target/client-spring-http-client-2.0.0-SNAPSHOT.jar" \
--scenario auth/metadata-default \
--verbose
Manual Testing
You can also run the client manually if you have a test server:
export MCP_CONFORMANCE_SCENARIO=auth/metadata-default
java -jar conformance-tests/client-spring-http-client/target/client-spring-http-client-2.0.0-SNAPSHOT.jar http://localhost:3000/mcp
Known Issues
- auth/scope-step-up (1 failure) — The client does not fully handle scope step-up challenges where the server requests additional scopes after initial authorization.
- auth/basic-cimd (1 warning) — Minor conformance warning in the basic Client-Initiated Metadata Discovery flow.