1e9520e731* [Docs] Add deprecation policy doc (SEP-2596) Formalizes the Active -> Deprecated -> Removed lifecycle and the twelve-month deprecation window the SDK already applies via SEP-2577, and states the SDK's own BC promise ahead of 1.0. * [Docs] Add SDK Tier 2 gap analysis (SEP-1730) * [Docs] Wire deprecation policy and SDK tier docs into the guide nav Adds both pages under a new Project section in mkdocs.yml, links them from index.md's "Where to go next", and points their repo-root references at GitHub URLs instead of paths escaping docs/ (dead under Zensical's --strict build). * [Docs] Add CONTRIBUTING.md Root-level contribution guide: dev setup, the make ci checks to run before a PR, coding standards, testing expectations, the docs-guide link-resolution rule Zensical enforces, and licensing terms. Linked from README's existing Contributing section. * [Docs] Trim deprecation policy per review Drop the worked SEP-2577 example and the "relationship to the protocol lifecycle" section; both were redundant restating of detail that lives in the code/CHANGELOG and protocol-versions.md already. * [Docs] Cite the Tier 3 audit and add a versioning policy (SEP-1730) Replace our own hand-rolled conformance numbers with the authoritative audit in modelcontextprotocol/modelcontextprotocol#3274: SDK is currently Tier 3, blocked from Tier 2 by client OAuth conformance (20%) and no stable 1.0.0+ release. Add the Versioning section the audit found missing — SemVer commitment pre-1.0, Symfony's BC promise after — and point CONTRIBUTING.md at it. * [Docs] Link Symfony's BC promise from the deprecation policy Was plain text; sdk-tier.md's Versioning section already links it. * [Docs] Drop the "process gaps addressed" aside from sdk-tier.md * Apply suggestion from @chr-hertel * Apply suggestion from @chr-hertel
68 lines
3.1 KiB
Markdown
68 lines
3.1 KiB
Markdown
# SDK Tier Target (SEP-1730)
|
|
|
|
The MCP spec defines three SDK tiers: Tier 1 (Fully Supported), Tier 2
|
|
(Commitment to Full Support), and Tier 3 (Experimental). This document tracks
|
|
where the PHP SDK stands and what's still missing to move up a tier.
|
|
|
|
## Current standing
|
|
|
|
**Tier 3**, per the official audit in
|
|
[modelcontextprotocol/modelcontextprotocol#3274](https://github.com/modelcontextprotocol/modelcontextprotocol/issues/3274)
|
|
(2026-08-19, superseding the earlier Tier 3 assessment in #2305). Two things
|
|
block Tier 2:
|
|
|
|
- **Client conformance is 20% (10/50)**, against the ≥80% bar. Almost
|
|
entirely OAuth: 38 of 39 scored auth scenarios fail. Every one of those
|
|
failures is pre-declared in the SDK's own
|
|
[`tests/Conformance/conformance-baseline-*.yml`](https://github.com/modelcontextprotocol/php-sdk/tree/main/tests/Conformance)
|
|
files and tracked in `ROADMAP.md` — a known, scoped gap, not silent
|
|
breakage. Server conformance is 100% (67/67).
|
|
- **No stable release ≥ 1.0.0 has ever shipped** (latest: v0.7.1). Tier 2
|
|
requires at least one.
|
|
|
|
Tier 1 needs both of those plus full (not ≥80%) client conformance and
|
|
closing 10 documentation gaps the audit lists by name (mostly small
|
|
per-feature additions — legacy SSE transport and the elicitation
|
|
complete-notification need either an implementation or an explicit
|
|
"intentionally not implemented" note).
|
|
|
|
## Target
|
|
|
|
**Tier 2 next, Tier 1 after the 1.0 release.** Tier 1's "stable release"
|
|
requirement is structurally out of reach until 1.0 ships regardless of how
|
|
complete every other Tier 1 criterion is.
|
|
|
|
## Path to Tier 2
|
|
|
|
Roughly in priority order, per the audit's own recommendation:
|
|
|
|
1. **OAuth client conformance.** The single highest-leverage fix — it
|
|
accounts for 38 of 40 client failures and blocks both tiers on its own.
|
|
Already scoped: token endpoint auth methods, scope handling (step-up,
|
|
retry-limit, from-`WWW-Authenticate`, from `scopes_supported`), dynamic
|
|
client registration, issuer validation, `offline_access`,
|
|
authorization-server migration — see `ROADMAP.md` and the
|
|
`2026-07-28`-labeled auth issues.
|
|
2. **Fix the two non-auth client failures** (`sse-retry`,
|
|
`elicitation-sep1034-client-defaults`, both scored at 2025-11-25).
|
|
3. **Ship a stable 1.0.0+ release.**
|
|
|
|
## Versioning
|
|
|
|
The SDK follows [Semantic Versioning](https://semver.org/):
|
|
`MAJOR.MINOR.PATCH`. Pre-1.0, that means any digit can carry a breaking
|
|
change per SemVer §4 — every one is logged with a `[BC Break]` marker in
|
|
[`CHANGELOG.md`](https://github.com/modelcontextprotocol/php-sdk/blob/main/CHANGELOG.md).
|
|
|
|
Once at 1.0, the SDK adopts Symfony's
|
|
[Backward Compatibility Promise](https://symfony.com/doc/current/contributing/code/bc.html):
|
|
PATCH releases never break BC, MINOR releases only add functionality (gated
|
|
by the deprecation window in [Deprecation policy](deprecation-policy.md)),
|
|
and a breaking change ships only in a MAJOR release.
|
|
|
|
## Roadmap
|
|
|
|
See [ROADMAP.md](https://github.com/modelcontextprotocol/php-sdk/blob/main/ROADMAP.md)
|
|
for the feature-level plan toward 1.0. This document only tracks the
|
|
process/tier-classification gap, which is narrower and more mechanical than
|
|
the feature roadmap.
|