Mirror of https://github.com/modelcontextprotocol/kotlin-sdk — The official Kotlin SDK for Model Context Protocol servers and clients. Maintained in collaboration with JetBrains
  • Kotlin 98%
  • TypeScript 1.7%
  • Shell 0.3%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
dependabot[bot] 6bea404652
Bump hono from 4.11.4 to 4.11.7 in /integration-test/src/jvmTest/typescript in the npm_and_yarn group across 1 directory (#495)
Bumps the npm_and_yarn group with 1 update in the
/integration-test/src/jvmTest/typescript directory:
[hono](https://github.com/honojs/hono).

Updates `hono` from 4.11.4 to 4.11.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.11.7</h2>
<h1>Security Release</h1>
<p>This release includes security fixes for multiple vulnerabilities in
Hono and related middleware. We recommend upgrading if you are using any
of the affected components.</p>
<h2>Components</h2>
<h3>IP Restriction Middleware</h3>
<p>Fixed an IPv4 address validation bypass that could allow IP-based
access control to be bypassed under certain configurations.</p>
<h3>Cache Middleware</h3>
<p>Fixed an issue where responses marked with <code>Cache-Control:
private</code> or <code>no-store</code> could be cached, potentially
leading to information disclosure on some runtimes.</p>
<h3>Serve Static Middleware (Cloudflare Workers adapter)</h3>
<p>Fixed an issue that could allow unintended access to internal asset
keys when serving static files with user-controlled paths.</p>
<h3>hono/jsx <code>ErrorBoundary</code></h3>
<p>Fixed a reflected Cross-Site Scripting (XSS) issue in the
<code>ErrorBoundary</code> component that could occur when untrusted
strings were rendered without proper escaping.</p>
<h2>Recommendation</h2>
<p>Users are encouraged to upgrade to this release, especially if
they:</p>
<ul>
<li>Use IP Restriction Middleware</li>
<li>Use Cache Middleware on Deno, Bun, or Node.js</li>
<li>Use Serve Static Middleware with user-controlled paths on Cloudflare
Workers</li>
<li>Render untrusted data inside <code>ErrorBoundary</code>
components</li>
</ul>
<h2>Security Advisories &amp; CVEs</h2>
<ul>
<li>
<p><strong>IP Restriction Middleware – IPv4 address validation
bypass</strong></p>
<ul>
<li>Advisory: <a
href="https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh">https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh</a></li>
<li>CVE: CVE-2026-24398</li>
</ul>
</li>
<li>
<p><strong>Cache Middleware ignores <code>Cache-Control:
private</code></strong></p>
<ul>
<li>Advisory: <a
href="https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4">https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4</a></li>
<li>CVE: CVE-2026-24472</li>
</ul>
</li>
<li>
<p><strong>Serve Static Middleware (Cloudflare Workers adapter) –
Arbitrary key read</strong></p>
<ul>
<li>Advisory: <a
href="https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p">https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p</a></li>
<li>CVE: CVE-2026-24473</li>
</ul>
</li>
<li>
<p><strong>hono/jsx <code>ErrorBoundary</code> – Cross-Site Scripting
(XSS)</strong></p>
<ul>
<li>Advisory: <a
href="https://github.com/honojs/hono/security/advisories/GHSA-9r54-q6cx-xmh5">https://github.com/honojs/hono/security/advisories/GHSA-9r54-q6cx-xmh5</a></li>
<li>CVE: Pending</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f7d272abe1"><code>f7d272a</code></a>
4.11.7</li>
<li><a
href="2cf60046d7"><code>2cf6004</code></a>
Merge commit from fork</li>
<li><a
href="cf9a78db4d"><code>cf9a78d</code></a>
Merge commit from fork</li>
<li><a
href="edbf6eea8e"><code>edbf6ee</code></a>
Merge commit from fork</li>
<li><a
href="12c511745b"><code>12c5117</code></a>
Merge commit from fork</li>
<li><a
href="7343487e62"><code>7343487</code></a>
4.11.6</li>
<li><a
href="b6e5a97cd4"><code>b6e5a97</code></a>
feat(bun): export getBunServer (<a
href="https://redirect.github.com/honojs/hono/issues/4626">#4626</a>)</li>
<li><a
href="2a9cd953b6"><code>2a9cd95</code></a>
fix(sse): handle <code>\r</code> and <code>\r\n</code> line endings in
writeSSE (<a
href="https://redirect.github.com/honojs/hono/issues/4644">#4644</a>)</li>
<li><a
href="8078bbf759"><code>8078bbf</code></a>
docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant (<a
href="https://redirect.github.com/honojs/hono/issues/4630">#4630</a>)</li>
<li><a
href="a5be555b31"><code>a5be555</code></a>
refactor: use <code>unique symbol</code> for more accurate typing. (<a
href="https://redirect.github.com/honojs/hono/issues/4651">#4651</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.11.4...v4.11.7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.11.4&new-version=4.11.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/kotlin-sdk/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-06 00:40:21 +02:00
.github ci: integrate Detekt static analysis tool (#493) 2026-01-26 19:02:22 +02:00
.idea ci: integrate Detekt static analysis tool (#493) 2026-01-26 19:02:22 +02:00
buildSrc ci: integrate Detekt static analysis tool (#493) 2026-01-26 19:02:22 +02:00
config/detekt Detekt configuration (#501) 2026-02-04 17:02:58 +02:00
conformance-test fix conformance tests (#483) 2026-01-19 15:45:54 +02:00
docs Add module documentation and enhance Dokka configuration (#261) 2025-09-15 17:44:43 +02:00
gradle Bump kotest from 6.1.1 to 6.1.2 (#499) 2026-02-05 15:19:08 +02:00
integration-test Bump hono from 4.11.4 to 4.11.7 in /integration-test/src/jvmTest/typescript in the npm_and_yarn group across 1 directory (#495) 2026-02-06 00:40:21 +02:00
kotlin-sdk Kotlin-MCP can't be used without ktor-bom starting from 0.7.5 (#390) (#392) 2025-11-12 15:32:54 +02:00
kotlin-sdk-client [WIP]test(integration): Add Streamable HTTP transport integration tests (#486) 2026-02-05 14:49:47 +02:00
kotlin-sdk-core Deprecation cycle (#498) 2026-02-04 20:04:11 +01:00
kotlin-sdk-server Deprecation cycle (#498) 2026-02-04 20:04:11 +01:00
samples Fix kotlin-mcp-server sample (#459) 2025-12-08 23:25:55 +02:00
test-utils fix conformance tests (#483) 2026-01-19 15:45:54 +02:00
.editorconfig Detekt configuration (#501) 2026-02-04 17:02:58 +02:00
.gitignore ci: integrate Detekt static analysis tool (#493) 2026-01-26 19:02:22 +02:00
AGENTS.md Mark DSL functions for types as public (#472) 2026-01-10 01:12:29 +02:00
build.gradle.kts Detekt configuration (#501) 2026-02-04 17:02:58 +02:00
CODE_OF_CONDUCT.md Update license 2024-12-16 21:20:35 +01:00
CONTRIBUTING.md Update package name across the project (#2) 2024-12-17 07:28:51 +01:00
gradle.properties bump: update version to 0.8.3 (#488) 2026-01-21 12:21:11 +02:00
gradlew Update Gradle to version 9.2.0 across all projects (#377) 2025-11-07 17:07:20 +02:00
gradlew.bat Update Gradle to version 9.2.0 across all projects (#377) 2025-11-07 17:07:20 +02:00
LICENSE chore: update licensing to Apache 2.0 for new contributions (#481) 2026-01-13 14:21:52 +02:00
README.md chore: update licensing to Apache 2.0 for new contributions (#481) 2026-01-13 14:21:52 +02:00
settings.gradle.kts test: Refactor test utilities, fix conformance (#476) 2026-01-10 16:51:15 +02:00

MCP Kotlin SDK

Maven Central Build Conformance Tests Kotlin Kotlin Multiplatform JVM License

Kotlin Multiplatform implementation of the Model Context Protocol (MCP), providing both client and server capabilities for integrating with LLM surfaces across various platforms.

Overview

The Model Context Protocol allows applications to provide context for LLMs in a standardized way, separating the concerns of providing context from the actual LLM interaction. This SDK implements the MCP specification for Kotlin, enabling you to build applications that can communicate using MCP on the JVM, WebAssembly and iOS.

  • Build MCP clients that can connect to any MCP server
  • Create MCP servers that expose resources, prompts and tools
  • Use standard transports like stdio, SSE, and WebSocket
  • Handle all MCP protocol messages and lifecycle events

Samples

  • kotlin-mcp-server: demonstrates a multiplatform (JVM, Wasm) MCP server setup with various features and transports.
  • weather-stdio-server: shows how to build a Kotlin MCP server providing weather forecast and alerts using STDIO transport.
  • kotlin-mcp-client: demonstrates building an interactive Kotlin MCP client that connects to an MCP server via STDIO and integrates with Anthropic’s API.

Installation

Add the new repository to your build file:

repositories {
    mavenCentral()
}

Add the dependency:

dependencies {
    // See the badge above for the latest version
    implementation("io.modelcontextprotocol:kotlin-sdk:$mcpVersion")
}

MCP SDK uses Ktor, but does not come with a specific engine dependency. You should add Ktor client and/or Ktor server dependency to your project yourself, e.g.:

dependencies {
    // for client:
    implementation("io.ktor:ktor-client-cio:$ktorVersion")
    // for server:
    implementation("io.ktor:ktor-server-netty:$ktorVersion")
    
}

Quick Start

Creating a Client

import io.modelcontextprotocol.kotlin.sdk.client.Client
import io.modelcontextprotocol.kotlin.sdk.client.StdioClientTransport
import io.modelcontextprotocol.kotlin.sdk.Implementation

val client = Client(
    clientInfo = Implementation(
        name = "example-client",
        version = "1.0.0"
    )
)

val transport = StdioClientTransport(
    inputStream = processInputStream,
    outputStream = processOutputStream
)

// Connect to server
client.connect(transport)

// List available resources
val resources = client.listResources()

// Read a specific resource
val resourceContent = client.readResource(
    ReadResourceRequest(uri = "file:///example.txt")
)

Creating a Server

import io.modelcontextprotocol.kotlin.sdk.server.Server
import io.modelcontextprotocol.kotlin.sdk.server.ServerOptions
import io.modelcontextprotocol.kotlin.sdk.server.StdioServerTransport
import io.modelcontextprotocol.kotlin.sdk.ServerCapabilities

val server = Server(
    serverInfo = Implementation(
        name = "example-server",
        version = "1.0.0"
    ),
    options = ServerOptions(
        capabilities = ServerCapabilities(
            resources = ServerCapabilities.Resources(
                subscribe = true,
                listChanged = true
            )
        )
    )
){ 
    "This server provides example resources and demonstrates MCP capabilities." 
}

// Add a resource
server.addResource(
    uri = "file:///example.txt",
    name = "Example Resource",
    description = "An example text file",
    mimeType = "text/plain"
) { request ->
    ReadResourceResult(
        contents = listOf(
            TextResourceContents(
                text = "This is the content of the example resource.",
                uri = request.uri,
                mimeType = "text/plain"
            )
        )
    )
}

// Start server with stdio transport
val transport = StdioServerTransport()
server.connect(transport)

Using SSE Transport

Directly in Ktor's Application:

import io.ktor.server.application.*
import io.modelcontextprotocol.kotlin.sdk.server.mcp

fun Application.module() {
    mcp {
        Server(
            serverInfo = Implementation(
                name = "example-sse-server",
                version = "1.0.0"
            ),
            options = ServerOptions(
                capabilities = ServerCapabilities(
                    prompts = ServerCapabilities.Prompts(listChanged = null),
                    resources = ServerCapabilities.Resources(subscribe = null, listChanged = null)
                )
            ),
        ) { 
            "This SSE server provides prompts and resources via Server-Sent Events."
        }
    }
}

Inside a custom Ktor's Route:

import io.ktor.server.application.*
import io.ktor.server.sse.SSE
import io.modelcontextprotocol.kotlin.sdk.server.mcp

fun Application.module() {
    install(SSE)

    routing {
        route("myRoute") {
            mcp {
                Server(
                    serverInfo = Implementation(
                        name = "example-sse-server",
                        version = "1.0.0"
                    ),
                    options = ServerOptions(
                        capabilities = ServerCapabilities(
                            prompts = ServerCapabilities.Prompts(listChanged = null),
                            resources = ServerCapabilities.Resources(subscribe = null, listChanged = null)
                        )
                    ),
                ) {
                    "Connect via SSE to interact with this MCP server."
                }
            }
        }
    }
}

Contributing

Please see the contribution guide and the Code of conduct before contributing.

License

This project is licensed under Apache 2.0 for new contributions, with existing code under MIT—see the LICENSE file for details.