.github/workflows/conformance-weekly.yaml

@@ -125,11 +125,10 @@ jobs:
     name: Open issue on failure
     runs-on: ubuntu-latest
     needs: [server, client]
-    if: failure()
+    if: failure() && github.event_name == 'schedule'
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       GH_REPO: ${{ github.repository }}
-      EVENT_NAME: ${{ github.event_name }}
       RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
     steps:
       - name: File or comment tracking issue
@@ -141,13 +140,12 @@ jobs:
             gh issue create \
               --title '[conformance] Weekly conformance run failed' \
               --label conformance-weekly \
-              --body "Conformance against the newest published \`@modelcontextprotocol/conformance\` failed.
+              --body "Weekly conformance against \`@modelcontextprotocol/conformance@latest\` failed.
 
           - Run: $RUN_URL
-          - Trigger: $EVENT_NAME
+          - Triggered: $(date -u +%FT%TZ)
-          - Date: $(date -u +%FT%TZ)
 
-          Upstream likely published a release whose scenarios the SDK does not satisfy. Either fix the SDK, update the conformance fixtures, or add the new failure to the matching \`tests/Conformance/conformance-baseline-<spec-version>.yml\`."
+          Upstream likely published a release whose scenarios the SDK does not satisfy. Either fix the SDK, update the conformance fixtures, or add the new failure to \`tests/Conformance/conformance-baseline-2025-11-25.yml\`."
           fi
 
   publish:

.github/workflows/docs.yml

@@ -35,7 +35,7 @@ jobs:
         uses: "ramsey/composer-install@v4"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.1.0
+        uses: astral-sh/setup-uv@v10.0.1
         with:
           enable-cache: true
 

CHANGELOG.md

@@ -2,13 +2,6 @@
 
 All notable changes to `mcp/sdk` will be documented in this file.
 
-0.9.0
------
-
-* [BC Break] Remove the `providerClass` argument of `#[CompletionProvider]`. Use `provider:`, which takes the same class-string and is now the first positional argument.
-* Add `HttpTransport::getSessionId()` to read the server-minted `Mcp-Session-Id`: a request-scoped caller can persist it and pass it back through the constructor's `$headers` on a later transport. Always `null` on `2026-07-28`, which removed protocol-level sessions.
-* Fix OIDC discovery rejecting issuers with a trailing slash (e.g. Authentik, Auth0).
-
 0.8.0
 -----
 

README.md

@@ -1,10 +1,19 @@
 # MCP PHP SDK
 
+<div align="center">
+
 [![Latest Version](https://img.shields.io/packagist/v/mcp/sdk.svg)](https://packagist.org/packages/mcp/sdk)
 [![CI](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/pipeline.yaml/badge.svg)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/pipeline.yaml)
 [![PHP Version](https://img.shields.io/packagist/php-v/mcp/sdk.svg)](https://packagist.org/packages/mcp/sdk)
 [![License](https://img.shields.io/packagist/l/mcp/sdk.svg)](LICENSE)
 
+[![Server Conformance 2025-11-25](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/server-conformance-2025-11-25.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml)
+[![Client Conformance 2025-11-25](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/client-conformance-2025-11-25.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml)
+[![Server Conformance 2026-07-28](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/server-conformance-2026-07-28.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml)
+[![Client Conformance 2026-07-28](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/client-conformance-2026-07-28.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml)
+
+</div>
+
 The official PHP SDK for the Model Context Protocol (MCP). It provides a framework-agnostic API for implementing MCP
 servers and clients in PHP — tools, resources, prompts, STDIO and HTTP transports, sessions, authorization, and both
 protocol eras (the `initialize` handshake and the stateless `2026-07-28` revision).
@@ -16,17 +25,6 @@ development practices and standards from the Symfony project, including [Coding
 Until the first major release, this SDK is considered [experimental](https://symfony.com/doc/current/contributing/code/experimental.html), please see the [roadmap](./ROADMAP.md) for
 planned next steps and features.
 
-## Protocol Conformance
-
-Measured weekly against the [MCP Conformance Test Framework](https://github.com/modelcontextprotocol/conformance),
-as passing checks out of total. The `2026-07-28` scores run against the framework's `alpha` releases, so they move as
-upstream publishes new scenarios.
-
-| Revision | Server | Client |
-|:--------:|:------:|:------:|
-| `2026-07-28` | [![Server conformance 2026-07-28](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/server-conformance-2026-07-28.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml) | [![Client conformance 2026-07-28](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/client-conformance-2026-07-28.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml) |
-| `2025-11-25` | [![Server conformance 2025-11-25](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/server-conformance-2025-11-25.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml) | [![Client conformance 2025-11-25](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/client-conformance-2025-11-25.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml) |
-
 ## Installation
 
 ```bash

docs/advanced/events.md

@@ -35,7 +35,6 @@ The SDK dispatches 4 broad event types at the protocol level, allowing you to ob
 **Dispatched**: When any request is received from the client, before it's processed by handlers.
 
 **Properties**:
-
 - `getRequest(): Request` - The incoming request
 - `setRequest(Request $request): void` - Modify the request before processing
 - `getSession(): SessionInterface` - The current session
@@ -46,7 +45,6 @@ The SDK dispatches 4 broad event types at the protocol level, allowing you to ob
 **Dispatched**: When a successful response is ready to be sent to the client, after handler execution.
 
 **Properties**:
-
 - `getResponse(): Response` - The response being sent
 - `setResponse(Response $response): void` - Modify the response before sending
 - `getRequest(): Request` - The original request
@@ -58,7 +56,6 @@ The SDK dispatches 4 broad event types at the protocol level, allowing you to ob
 **Dispatched**: When an error occurs during request processing.
 
 **Properties**:
-
 - `getError(): Error` - The error being sent
 - `setError(Error $error): void` - Modify the error before sending
 - `getRequest(): Request` - The original request. Messages that fail to parse are rejected before this event, so a listener never sees them.
@@ -70,7 +67,6 @@ The SDK dispatches 4 broad event types at the protocol level, allowing you to ob
 **Dispatched**: When a notification is received from the client, before it's processed by handlers.
 
 **Properties**:
-
 - `getNotification(): Notification` - The incoming notification
 - `setNotification(Notification $notification): void` - Modify the notification before processing
 - `getSession(): SessionInterface` - The current session

docs/client/connecting.md

@@ -169,7 +169,6 @@ $client->connect($transport);
 ```
 
 The `connect()` method performs the MCP initialization handshake:
-
 1. Opens the transport connection
 2. Sends InitializeRequest with client capabilities
 3. Waits for InitializeResult from server

docs/client/transports.md

@@ -18,7 +18,6 @@ $transport = new StdioTransport(
 ```
 
 **Parameters:**
-
 - `command` (string): The command to execute
 - `args` (array): Command arguments
 - `cwd` (string|null): Working directory for the process
@@ -40,7 +39,6 @@ $transport = new HttpTransport(
 ```
 
 **Parameters:**
-
 - `endpoint` (string): The MCP server URL
 - `headers` (array): Additional HTTP headers
 - `httpClient` (ClientInterface|null): PSR-18 HTTP client (auto-discovered)
@@ -52,7 +50,6 @@ $transport = new HttpTransport(
 **PSR-18 Auto-Discovery:**
 
 The transport automatically discovers PSR-18 HTTP clients from:
-
 - `php-http/guzzle7-adapter`
 - `php-http/curl-client`
 - `symfony/http-client`

docs/run/server-builder.md

@@ -54,7 +54,6 @@ $server = Server::builder()
 ```
 
 **Parameters:**
-
 - `$name` (string): The server name
 - `$version` (string): Version string (semantic versioning recommended)
 - `$description` (string|null): Optional description
@@ -153,7 +152,6 @@ $server = Server::builder()
 ```
 
 **Parameters:**
-
 - `$basePath` (string): Base directory for discovery (typically `__DIR__`)
 - `$scanDirs` (array): Directories to recursively scan for `#[McpTool]`, `#[McpResource]`, etc. All subdirectories are included. (default: `['.', 'src']`)
 - `$excludeDirs` (array): Directory names to exclude **within** the scanned directories during recursive scanning
@@ -191,7 +189,6 @@ $server = Server::builder()
 ```
 
 **How `excludeDirs` works:**
-
 - If scanning `src/` and there's `src/vendor/`, it will be excluded
 - If scanning `lib/` and there's `lib/tests/`, it will be excluded
 - But if `vendor/` and `tests/` are at the same level as `src/`, they're not scanned anyway (not in `scanDirs`)
@@ -220,7 +217,6 @@ $server = Server::builder()
 ```
 
 **Basic Container Features:**
-
 - Supports constructor auto-wiring for classes with parameterless constructors
 - Resolves dependencies where all parameters are type-hinted classes/interfaces known to the container
 - Supports parameters with default values

docs/run/sessions.md

@@ -74,7 +74,6 @@ $server = Server::builder()
 ```
 
 **Parameters:**
-
 - `$gcProbability` (int): The numerator of the GC probability fraction (default: `1`). Set to `0` to disable GC.
 - `$gcDivisor` (int): The denominator of the GC probability fraction (default: `100`). Must be >= 1.
 
@@ -82,7 +81,6 @@ $server = Server::builder()
 > the `gcProbability` and `gcDivisor` settings are ignored — you control GC behavior in your own implementation.
 
 **Available Session Stores:**
-
 - `InMemorySessionStore`: Fast in-memory storage (default)
 - `FileSessionStore`: Persistent file-based storage
 - `Psr16SessionStore`: PSR-16 compliant cache-based storage

docs/servers/completions.md

@@ -87,7 +87,6 @@ public function getUserProfile(
 ```
 
 **Provider Resolution:**
-
 - **Class strings** (`Provider::class`) → Resolved from PSR-11 container
 - **Instances** (`new Provider()`) → Used directly
 - **Values** (`['a', 'b']`) → Wrapped in `ListCompletionProvider`

docs/servers/prompts.md

@@ -100,7 +100,6 @@ makes the prompt handler throw.
 ### Error Handling
 
 Prompt handlers can throw any exception, but the type determines how it's handled:
-
 - **`PromptGetException`**: Converted to JSON-RPC error response with the actual exception message
 - **Any other exception**: Converted to JSON-RPC error response, but with a generic error message
 

docs/servers/registration.md

@@ -6,7 +6,6 @@ registry somehow. There are three ways to get it there, and they mix freely.
 ## Attribute-Based Discovery
 
 **Advantages:**
-
 - Declarative and readable
 - Automatic parameter inference
 - DocBlock integration
@@ -26,7 +25,6 @@ Register MCP elements programmatically without using attributes. The handler is
 any PHP callable.
 
 **Advantages:**
-
 - Fine-grained control
 - Runtime configuration
 - Conditional registration

src/Capability/Attribute/CompletionProvider.php

@@ -24,9 +24,9 @@ class CompletionProvider
      * @param class-string<ProviderInterface>|ProviderInterface|null $provider if a class-string, it will be resolved
      *                                                                         from the container at the point of use
      * @param ?array<int, int|float|string>                          $values   a list of values to use for completion
-     * @param class-string|null                                      $enum     an enum whose cases are the completions
      */
     public function __construct(
+        public ?string $providerClass = null,
         public string|ProviderInterface|null $provider = null,
         public ?array $values = null,
         public ?string $enum = null,

src/Capability/Discovery/Discoverer.php

@@ -325,6 +325,8 @@ final class Discoverer implements DiscovererInterface
 
                 if ($attributeInstance->provider) {
                     $completionProviders[$param->getName()] = $attributeInstance->provider;
+                } elseif ($attributeInstance->providerClass) {
+                    $completionProviders[$param->getName()] = $attributeInstance->provider;
                 } elseif ($attributeInstance->values) {
                     $completionProviders[$param->getName()] = new ListCompletionProvider($attributeInstance->values);
                 } elseif ($attributeInstance->enum) {

src/Capability/Registry/Loader/ReflectedElementLoader.php

@@ -287,7 +287,7 @@ final class ReflectedElementLoader implements LoaderInterface
     }
 
     /**
-     * @return array<string, class-string<ProviderInterface>|ProviderInterface>
+     * @return array<string, ProviderInterface>
      */
     private function getCompletionProviders(\ReflectionMethod|\ReflectionFunction $reflection): array
     {
@@ -307,6 +307,8 @@ final class ReflectedElementLoader implements LoaderInterface
 
                 if ($attributeInstance->provider) {
                     $completionProviders[$param->getName()] = $attributeInstance->provider;
+                } elseif ($attributeInstance->providerClass) {
+                    $completionProviders[$param->getName()] = $attributeInstance->providerClass;
                 } elseif ($attributeInstance->values) {
                     $completionProviders[$param->getName()] = new ListCompletionProvider($attributeInstance->values);
                 } elseif ($attributeInstance->enum) {

src/Client/Transport/HttpTransport.php

@@ -121,22 +121,6 @@ class HttpTransport extends BaseTransport implements HeaderAwareTransportInterfa
         $this->headerCallback = $callback;
     }
 
-    /**
-     * The session ID minted by the server for this connection, if any.
-     *
-     * Captured from the Mcp-Session-Id response header of a handshake-era
-     * server; always null on 2026-07-28, which removed protocol-level sessions
-     * (SEP-2567). A caller that cannot keep the transport alive between
-     * interactions can persist it and pass it back through the constructor's
-     * $headers on a later transport, where it wins over the tracked value.
-     *
-     * @return string|null null until the server mints a session, and again after close()
-     */
-    public function getSessionId(): ?string
-    {
-        return $this->sessionId;
-    }
-
     public function send(string $data): void
     {
         $request = $this->requestFactory->createRequest('POST', $this->endpoint)

src/Schema/JsonRpc/Notification.php

@@ -74,7 +74,7 @@ abstract class Notification implements HasMethodInterface, MessageInterface
             $array['params'] = $params;
         }
 
-        if (null !== $this->meta && !isset($params['_meta'])) {
+        if (null !== $this->meta && !isset($params['meta'])) {
             $array['params']['_meta'] = $this->meta;
         }
 

src/Schema/JsonRpc/Request.php

@@ -122,7 +122,7 @@ abstract class Request implements HasMethodInterface, MessageInterface
             $array['params'] = $params;
         }
 
-        if (null !== $this->meta && !isset($params['_meta'])) {
+        if (null !== $this->meta && !isset($params['meta'])) {
             $array['params']['_meta'] = $this->meta;
         }
 

src/Server/Protocol.php

@@ -303,11 +303,9 @@ class Protocol
                             $notification = $result['notification'];
                             $this->sendNotification($notification, $session);
                         } elseif ('request' === $result['type']) {
-                            // Keep $request untouched: it is the inbound request the catch
+                            $request = $result['request'];
-                            // blocks below answer under, not this outbound one.
-                            $outboundRequest = $result['request'];
                             $timeout = $result['timeout'] ?? 120;
-                            $this->sendRequest($outboundRequest, $timeout, $session);
+                            $this->sendRequest($request, $timeout, $session);
                         }
                     }
 

src/Server/Session/FileSessionStore.php

@@ -14,8 +14,6 @@ namespace Mcp\Server\Session;
 use Mcp\Exception\RuntimeException;
 use Mcp\Server\NativeClock;
 use Psr\Clock\ClockInterface;
-use Psr\Log\LoggerInterface;
-use Psr\Log\NullLogger;
 use Symfony\Component\Uid\Uuid;
 
 /**
@@ -28,13 +26,9 @@ class FileSessionStore implements SessionStoreInterface
         private readonly string $directory,
         private readonly int $ttl = 3600,
         private readonly ClockInterface $clock = new NativeClock(),
-        private readonly LoggerInterface $logger = new NullLogger(),
     ) {
-        if (!is_dir($this->directory) && !@mkdir($this->directory, 0775, true) && !is_dir($this->directory)) {
+        if (!is_dir($this->directory)) {
-            $this->logger->warning('Failed to create session directory.', [
+            @mkdir($this->directory, 0775, true);
-                'directory' => $this->directory,
-                'error' => error_get_last()['message'] ?? 'unknown',
-            ]);
         }
 
         if (!is_dir($this->directory) || !is_writable($this->directory)) {
@@ -65,23 +59,13 @@ class FileSessionStore implements SessionStoreInterface
 
         $mtime = @filemtime($path) ?: 0;
         if (($this->clock->now()->getTimestamp() - $mtime) > $this->ttl) {
-            if (!@unlink($path) && is_file($path)) {
+            @unlink($path);
-                $this->logger->warning('Failed to delete expired session file.', [
-                    'path' => $path,
-                    'error' => error_get_last()['message'] ?? 'unknown',
-                ]);
-            }
 
             return false;
         }
 
         $data = @file_get_contents($path);
         if (false === $data) {
-            $this->logger->warning('Failed to read session file.', [
-                'path' => $path,
-                'error' => error_get_last()['message'] ?? 'unknown',
-            ]);
-
             return false;
         }
 
@@ -94,11 +78,6 @@ class FileSessionStore implements SessionStoreInterface
 
         $tmp = $path.'.tmp';
         if (false === @file_put_contents($tmp, $data, \LOCK_EX)) {
-            $this->logger->warning('Failed to write session file.', [
-                'path' => $tmp,
-                'error' => error_get_last()['message'] ?? 'unknown',
-            ]);
-
             return false;
         }
 
@@ -106,10 +85,6 @@ class FileSessionStore implements SessionStoreInterface
         if (!@rename($tmp, $path)) {
             // Fallback if rename fails cross-device
             if (false === @copy($tmp, $path)) {
-                $this->logger->warning('Failed to move session file into place.', [
-                    'path' => $path,
-                    'error' => error_get_last()['message'] ?? 'unknown',
-                ]);
                 @unlink($tmp);
 
                 return false;
@@ -126,11 +101,8 @@ class FileSessionStore implements SessionStoreInterface
     {
         $path = $this->pathFor($id);
 
-        if (is_file($path) && !@unlink($path) && is_file($path)) {
+        if (is_file($path)) {
-            $this->logger->warning('Failed to delete session file.', [
+            @unlink($path);
-                'path' => $path,
-                'error' => error_get_last()['message'] ?? 'unknown',
-            ]);
         }
 
         return true;
@@ -147,11 +119,6 @@ class FileSessionStore implements SessionStoreInterface
 
         $dir = @opendir($this->directory);
         if (false === $dir) {
-            $this->logger->warning('Failed to open session directory for garbage collection.', [
-                'directory' => $this->directory,
-                'error' => error_get_last()['message'] ?? 'unknown',
-            ]);
-
             return $deleted;
         }
 
@@ -173,15 +140,7 @@ class FileSessionStore implements SessionStoreInterface
 
             $mtime = @filemtime($path) ?: 0;
             if (($now - $mtime) > $this->ttl) {
-                if (!@unlink($path) && is_file($path)) {
+                @unlink($path);
-                    $this->logger->warning('Failed to delete expired session file.', [
-                        'path' => $path,
-                        'error' => error_get_last()['message'] ?? 'unknown',
-                    ]);
-
-                    continue;
-                }
-
                 $deleted[] = Uuid::fromString($entry);
             }
         }