chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 (#512)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.1 to 10.1.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/v10.0.1...v10.1.0)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/conformance-weekly.yaml

@@ -125,10 +125,11 @@ jobs:
     name: Open issue on failure
     runs-on: ubuntu-latest
     needs: [server, client]
-    if: failure() && github.event_name == 'schedule'
+    if: failure()
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       GH_REPO: ${{ github.repository }}
+      EVENT_NAME: ${{ github.event_name }}
       RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
     steps:
       - name: File or comment tracking issue
@@ -140,12 +141,13 @@ jobs:
             gh issue create \
               --title '[conformance] Weekly conformance run failed' \
               --label conformance-weekly \
-              --body "Weekly conformance against \`@modelcontextprotocol/conformance@latest\` failed.
+              --body "Conformance against the newest published \`@modelcontextprotocol/conformance\` failed.
 
           - Run: $RUN_URL
-          - Triggered: $(date -u +%FT%TZ)
+          - Trigger: $EVENT_NAME
+          - Date: $(date -u +%FT%TZ)
 
-          Upstream likely published a release whose scenarios the SDK does not satisfy. Either fix the SDK, update the conformance fixtures, or add the new failure to \`tests/Conformance/conformance-baseline-2025-11-25.yml\`."
+          Upstream likely published a release whose scenarios the SDK does not satisfy. Either fix the SDK, update the conformance fixtures, or add the new failure to the matching \`tests/Conformance/conformance-baseline-<spec-version>.yml\`."
           fi
 
   publish:

.github/workflows/docs.yml

@@ -35,7 +35,7 @@ jobs:
         uses: "ramsey/composer-install@v4"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@v10.1.0
         with:
           enable-cache: true
 

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to `mcp/sdk` will be documented in this file.
 
+0.9.0
+-----
+
+* [BC Break] Remove the `providerClass` argument of `#[CompletionProvider]`. Use `provider:`, which takes the same class-string and is now the first positional argument.
+* Add `HttpTransport::getSessionId()` to read the server-minted `Mcp-Session-Id`: a request-scoped caller can persist it and pass it back through the constructor's `$headers` on a later transport. Always `null` on `2026-07-28`, which removed protocol-level sessions.
+* Fix OIDC discovery rejecting issuers with a trailing slash (e.g. Authentik, Auth0).
+
 0.8.0
 -----
 

README.md

@@ -1,19 +1,10 @@
 # MCP PHP SDK
 
-<div align="center">
-
 [![Latest Version](https://img.shields.io/packagist/v/mcp/sdk.svg)](https://packagist.org/packages/mcp/sdk)
 [![CI](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/pipeline.yaml/badge.svg)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/pipeline.yaml)
 [![PHP Version](https://img.shields.io/packagist/php-v/mcp/sdk.svg)](https://packagist.org/packages/mcp/sdk)
 [![License](https://img.shields.io/packagist/l/mcp/sdk.svg)](LICENSE)
 
-[![Server Conformance 2025-11-25](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/server-conformance-2025-11-25.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml)
-[![Client Conformance 2025-11-25](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/client-conformance-2025-11-25.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml)
-[![Server Conformance 2026-07-28](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/server-conformance-2026-07-28.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml)
-[![Client Conformance 2026-07-28](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/client-conformance-2026-07-28.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml)
-
-</div>
-
 The official PHP SDK for the Model Context Protocol (MCP). It provides a framework-agnostic API for implementing MCP
 servers and clients in PHP — tools, resources, prompts, STDIO and HTTP transports, sessions, authorization, and both
 protocol eras (the `initialize` handshake and the stateless `2026-07-28` revision).
@@ -25,6 +16,17 @@ development practices and standards from the Symfony project, including [Coding
 Until the first major release, this SDK is considered [experimental](https://symfony.com/doc/current/contributing/code/experimental.html), please see the [roadmap](./ROADMAP.md) for
 planned next steps and features.
 
+## Protocol Conformance
+
+Measured weekly against the [MCP Conformance Test Framework](https://github.com/modelcontextprotocol/conformance),
+as passing checks out of total. The `2026-07-28` scores run against the framework's `alpha` releases, so they move as
+upstream publishes new scenarios.
+
+| Revision | Server | Client |
+|:--------:|:------:|:------:|
+| `2026-07-28` | [![Server conformance 2026-07-28](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/server-conformance-2026-07-28.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml) | [![Client conformance 2026-07-28](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/client-conformance-2026-07-28.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml) |
+| `2025-11-25` | [![Server conformance 2025-11-25](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/server-conformance-2025-11-25.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml) | [![Client conformance 2025-11-25](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/modelcontextprotocol/php-sdk/badges/client-conformance-2025-11-25.json)](https://github.com/modelcontextprotocol/php-sdk/actions/workflows/conformance-weekly.yaml) |
+
 ## Installation
 
 ```bash

docs/advanced/events.md

@@ -35,6 +35,7 @@ The SDK dispatches 4 broad event types at the protocol level, allowing you to ob
 **Dispatched**: When any request is received from the client, before it's processed by handlers.
 
 **Properties**:
+
 - `getRequest(): Request` - The incoming request
 - `setRequest(Request $request): void` - Modify the request before processing
 - `getSession(): SessionInterface` - The current session
@@ -45,6 +46,7 @@ The SDK dispatches 4 broad event types at the protocol level, allowing you to ob
 **Dispatched**: When a successful response is ready to be sent to the client, after handler execution.
 
 **Properties**:
+
 - `getResponse(): Response` - The response being sent
 - `setResponse(Response $response): void` - Modify the response before sending
 - `getRequest(): Request` - The original request
@@ -56,6 +58,7 @@ The SDK dispatches 4 broad event types at the protocol level, allowing you to ob
 **Dispatched**: When an error occurs during request processing.
 
 **Properties**:
+
 - `getError(): Error` - The error being sent
 - `setError(Error $error): void` - Modify the error before sending
 - `getRequest(): Request` - The original request. Messages that fail to parse are rejected before this event, so a listener never sees them.
@@ -67,6 +70,7 @@ The SDK dispatches 4 broad event types at the protocol level, allowing you to ob
 **Dispatched**: When a notification is received from the client, before it's processed by handlers.
 
 **Properties**:
+
 - `getNotification(): Notification` - The incoming notification
 - `setNotification(Notification $notification): void` - Modify the notification before processing
 - `getSession(): SessionInterface` - The current session

docs/client/connecting.md

@@ -169,6 +169,7 @@ $client->connect($transport);
 ```
 
 The `connect()` method performs the MCP initialization handshake:
+
 1. Opens the transport connection
 2. Sends InitializeRequest with client capabilities
 3. Waits for InitializeResult from server

docs/client/transports.md

@@ -18,6 +18,7 @@ $transport = new StdioTransport(
 ```
 
 **Parameters:**
+
 - `command` (string): The command to execute
 - `args` (array): Command arguments
 - `cwd` (string|null): Working directory for the process
@@ -39,6 +40,7 @@ $transport = new HttpTransport(
 ```
 
 **Parameters:**
+
 - `endpoint` (string): The MCP server URL
 - `headers` (array): Additional HTTP headers
 - `httpClient` (ClientInterface|null): PSR-18 HTTP client (auto-discovered)
@@ -50,6 +52,7 @@ $transport = new HttpTransport(
 **PSR-18 Auto-Discovery:**
 
 The transport automatically discovers PSR-18 HTTP clients from:
+
 - `php-http/guzzle7-adapter`
 - `php-http/curl-client`
 - `symfony/http-client`

docs/run/server-builder.md

@@ -54,6 +54,7 @@ $server = Server::builder()
 ```
 
 **Parameters:**
+
 - `$name` (string): The server name
 - `$version` (string): Version string (semantic versioning recommended)
 - `$description` (string|null): Optional description
@@ -152,6 +153,7 @@ $server = Server::builder()
 ```
 
 **Parameters:**
+
 - `$basePath` (string): Base directory for discovery (typically `__DIR__`)
 - `$scanDirs` (array): Directories to recursively scan for `#[McpTool]`, `#[McpResource]`, etc. All subdirectories are included. (default: `['.', 'src']`)
 - `$excludeDirs` (array): Directory names to exclude **within** the scanned directories during recursive scanning
@@ -189,6 +191,7 @@ $server = Server::builder()
 ```
 
 **How `excludeDirs` works:**
+
 - If scanning `src/` and there's `src/vendor/`, it will be excluded
 - If scanning `lib/` and there's `lib/tests/`, it will be excluded
 - But if `vendor/` and `tests/` are at the same level as `src/`, they're not scanned anyway (not in `scanDirs`)
@@ -217,6 +220,7 @@ $server = Server::builder()
 ```
 
 **Basic Container Features:**
+
 - Supports constructor auto-wiring for classes with parameterless constructors
 - Resolves dependencies where all parameters are type-hinted classes/interfaces known to the container
 - Supports parameters with default values

docs/run/sessions.md

@@ -74,6 +74,7 @@ $server = Server::builder()
 ```
 
 **Parameters:**
+
 - `$gcProbability` (int): The numerator of the GC probability fraction (default: `1`). Set to `0` to disable GC.
 - `$gcDivisor` (int): The denominator of the GC probability fraction (default: `100`). Must be >= 1.
 
@@ -81,6 +82,7 @@ $server = Server::builder()
 > the `gcProbability` and `gcDivisor` settings are ignored — you control GC behavior in your own implementation.
 
 **Available Session Stores:**
+
 - `InMemorySessionStore`: Fast in-memory storage (default)
 - `FileSessionStore`: Persistent file-based storage
 - `Psr16SessionStore`: PSR-16 compliant cache-based storage

docs/servers/completions.md

@@ -87,6 +87,7 @@ public function getUserProfile(
 ```
 
 **Provider Resolution:**
+
 - **Class strings** (`Provider::class`) → Resolved from PSR-11 container
 - **Instances** (`new Provider()`) → Used directly
 - **Values** (`['a', 'b']`) → Wrapped in `ListCompletionProvider`

docs/servers/prompts.md

@@ -100,6 +100,7 @@ makes the prompt handler throw.
 ### Error Handling
 
 Prompt handlers can throw any exception, but the type determines how it's handled:
+
 - **`PromptGetException`**: Converted to JSON-RPC error response with the actual exception message
 - **Any other exception**: Converted to JSON-RPC error response, but with a generic error message
 

docs/servers/registration.md

@@ -6,6 +6,7 @@ registry somehow. There are three ways to get it there, and they mix freely.
 ## Attribute-Based Discovery
 
 **Advantages:**
+
 - Declarative and readable
 - Automatic parameter inference
 - DocBlock integration
@@ -25,6 +26,7 @@ Register MCP elements programmatically without using attributes. The handler is
 any PHP callable.
 
 **Advantages:**
+
 - Fine-grained control
 - Runtime configuration
 - Conditional registration

src/Capability/Attribute/CompletionProvider.php

@@ -24,9 +24,9 @@ class CompletionProvider
      * @param class-string<ProviderInterface>|ProviderInterface|null $provider if a class-string, it will be resolved
      *                                                                         from the container at the point of use
      * @param ?array<int, int|float|string>                          $values   a list of values to use for completion
+     * @param class-string|null                                      $enum     an enum whose cases are the completions
      */
     public function __construct(
-        public ?string $providerClass = null,
         public string|ProviderInterface|null $provider = null,
         public ?array $values = null,
         public ?string $enum = null,

src/Capability/Discovery/Discoverer.php

@@ -325,8 +325,6 @@ final class Discoverer implements DiscovererInterface
 
                 if ($attributeInstance->provider) {
                     $completionProviders[$param->getName()] = $attributeInstance->provider;
-                } elseif ($attributeInstance->providerClass) {
-                    $completionProviders[$param->getName()] = $attributeInstance->provider;
                 } elseif ($attributeInstance->values) {
                     $completionProviders[$param->getName()] = new ListCompletionProvider($attributeInstance->values);
                 } elseif ($attributeInstance->enum) {

src/Capability/Registry.php

@@ -88,10 +88,27 @@ final class Registry implements RegistryInterface
             return;
         }
 
+        $this->loadFrom($this->loader);
+
+        $this->loaded = true;
+    }
+
+    /**
+     * Runs $loader with the change events its registrations would dispatch suppressed, since they
+     * describe the registry filling up rather than changing.
+     *
+     * Re-entrant-safe, and failure propagates. Does not mark the registry loaded: $loader is the
+     * caller's, and the one the constructor took is still owed its run.
+     */
+    public function loadFrom(LoaderInterface $loader): void
+    {
+        if ($this->loading) {
+            return;
+        }
+
         $this->loading = true;
         try {
-            $this->loader->load($this);
+            $loader->load($this);
-            $this->loaded = true;
         } finally {
             $this->loading = false;
         }

src/Capability/Registry/Loader/ReflectedElementLoader.php

@@ -287,7 +287,7 @@ final class ReflectedElementLoader implements LoaderInterface
     }
 
     /**
-     * @return array<string, ProviderInterface>
+     * @return array<string, class-string<ProviderInterface>|ProviderInterface>
      */
     private function getCompletionProviders(\ReflectionMethod|\ReflectionFunction $reflection): array
     {
@@ -307,8 +307,6 @@ final class ReflectedElementLoader implements LoaderInterface
 
                 if ($attributeInstance->provider) {
                     $completionProviders[$param->getName()] = $attributeInstance->provider;
-                } elseif ($attributeInstance->providerClass) {
-                    $completionProviders[$param->getName()] = $attributeInstance->providerClass;
                 } elseif ($attributeInstance->values) {
                     $completionProviders[$param->getName()] = new ListCompletionProvider($attributeInstance->values);
                 } elseif ($attributeInstance->enum) {

src/Capability/Registry/ReferenceHandler.php

@@ -97,10 +97,32 @@ final class ReferenceHandler implements ReferenceHandlerInterface
         $finalArgs = [];
 
         foreach ($reflection->getParameters() as $parameter) {
-            // TODO: Handle variadic parameters.
             $paramName = $parameter->getName();
             $paramPosition = $parameter->getPosition();
 
+            if ($parameter->isVariadic()) {
+                // Each element is cast individually below; a non-array value is
+                // wrapped as a single element, since prompt arguments arrive as
+                // plain strings (Record<string,string> per the protocol) even
+                // though tool arguments follow the advertised "array" schema.
+                $values = $arguments[$paramName] ?? [];
+                if (!\is_array($values)) {
+                    $values = [$values];
+                } elseif (!array_is_list($values)) {
+                    throw RegistryException::invalidParams(\sprintf('Parameter `%s` must be a list of values, not an object.', $paramName));
+                }
+                foreach ($values as $index => $value) {
+                    try {
+                        $finalArgs[] = $this->castArgumentType($value, $parameter);
+                    } catch (InvalidArgumentException $e) {
+                        throw RegistryException::invalidParams(\sprintf('Parameter `%s[%d]`: %s', $paramName, $index, $e->getMessage()), $e);
+                    } catch (\Throwable $e) {
+                        throw RegistryException::internalError(\sprintf('Error processing parameter `%s[%d]`: %s', $paramName, $index, $e->getMessage()), $e);
+                    }
+                }
+                continue;
+            }
+
             // Check if parameter is a special injectable type
             $type = $parameter->getType();
             if ($type instanceof \ReflectionNamedType && !$type->isBuiltin()) {

src/Client/Transport/HttpTransport.php

@@ -121,6 +121,22 @@ class HttpTransport extends BaseTransport implements HeaderAwareTransportInterfa
         $this->headerCallback = $callback;
     }
 
+    /**
+     * The session ID minted by the server for this connection, if any.
+     *
+     * Captured from the Mcp-Session-Id response header of a handshake-era
+     * server; always null on 2026-07-28, which removed protocol-level sessions
+     * (SEP-2567). A caller that cannot keep the transport alive between
+     * interactions can persist it and pass it back through the constructor's
+     * $headers on a later transport, where it wins over the tracked value.
+     *
+     * @return string|null null until the server mints a session, and again after close()
+     */
+    public function getSessionId(): ?string
+    {
+        return $this->sessionId;
+    }
+
     public function send(string $data): void
     {
         $request = $this->requestFactory->createRequest('POST', $this->endpoint)

src/Schema/JsonRpc/Notification.php

@@ -74,7 +74,7 @@ abstract class Notification implements HasMethodInterface, MessageInterface
             $array['params'] = $params;
         }
 
-        if (null !== $this->meta && !isset($params['meta'])) {
+        if (null !== $this->meta && !isset($params['_meta'])) {
             $array['params']['_meta'] = $this->meta;
         }
 

src/Schema/JsonRpc/Request.php

@@ -122,7 +122,7 @@ abstract class Request implements HasMethodInterface, MessageInterface
             $array['params'] = $params;
         }
 
-        if (null !== $this->meta && !isset($params['meta'])) {
+        if (null !== $this->meta && !isset($params['_meta'])) {
             $array['params']['_meta'] = $this->meta;
         }