Mirror of https://github.com/modelcontextprotocol/ruby-sdk — The official Ruby SDK for the Model Context Protocol servers and clients.
  • Ruby 99.8%
  • Shell 0.2%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Koichi ITO 09d4bf41aa Let the embedding application refuse an authorization request
## Motivation and Context

An MCP server chooses the authorization server its users sign in to. It names one in `authorization_servers`
in its Protected Resource Metadata, and states the scopes it wants in `scopes_supported`
or in the `WWW-Authenticate` challenge. Nothing binds either choice to the server's own identity.

No origin rule can settle this, because an authorization server is legitimately a different origin
from the resource it protects. Validating that a token was issued for the intended audience is a responsibility
the specification places on MCP servers rather than on clients, and there is no portable way for a client
to perform it either: access tokens are frequently opaque, and an authorization server is not required to honor
the `resource` parameter or to report an audience in the token response.

Two things follow from that, and they are separate.

The first is a judgement, and it belongs to whoever embeds this SDK, because an application often knows
which providers its users deal with. `authorization_request_validator` is handed an `AuthorizationRequest` describing
the authorization server, the scopes, the MCP server, and the RFC 8707 resource, and can refuse.
It is one object rather than keyword arguments so that later revisions of the specification can add to it
without changing the shape implementers wrote. It runs on all three grants, and on the authorization-code grant it
runs before dynamic client registration, which is why scope resolution moved above `ensure_client_registered`:
a refusal must not leave this client registered at an authorization server the host just rejected.

The second is not a judgement and is enforced here rather than asked about. `refresh!` rediscovers
the authorization server on every call, so the server named for a session can differ from the one
the stored tokens came from. SEP-2352 already binds client credentials to their issuer,
but that check passes when the issuer was never recorded and is deliberately skipped for a Client ID Metadata Document URL,
which is portable across authorization servers. The issuer that minted the tokens is now recorded with them,
and `refresh!` refuses to present them to a different one. The transport answers that refusal by running
a full authorization, which brings the new authorization server to the validator above. Tokens stored before
this carry no issuer and keep refreshing.

The hook decides whether to proceed, not what to ask for. The scopes reach the authorization server unchanged either way,
because the specification requires a client to treat the scopes in the challenge as authoritative for the operation,
and narrowing them silently would break that.

## How Has This Been Tested?

New tests in `test/mcp/client/oauth/flow_test.rb` assert what the validator receives, that a refusal raises
before any registration request is sent and before the redirect handler runs, and that the `client_credentials`
and `jwt-bearer` grants consult it too. Others cover the issuer recorded on authorization, the refusal to refresh against
a different one, and that tokens stored without an issuer still refresh. A test in `test/mcp/client/oauth/http_oauth_test.rb`
drives the two halves together: a stale issuer makes the refresh fail, the transport reauthorizes, and the validator sees
the newly named authorization server while no refresh token is ever posted to it. Each of them fails with its half of
this change removed. `bundle exec rake` (tests, RuboCop, and conformance baseline) passes.

## Breaking Changes

Refreshing now fails when the authorization server named for a session differs from the one that issued the stored tokens,
and the caller reauthorizes instead. Tokens stored before this change carry no recorded issuer and are unaffected
until their next authorization. The validator itself is additive: it defaults to `nil`, and a provider that does not offer
it authorizes as before.
2026-08-31 02:33:10 +09:00
.github Bump actions/setup-node from 6 to 7 2026-07-20 20:13:45 +00:00
bin Add API documentation with GitHub Pages deployment 2025-11-21 12:21:38 -06:00
conformance Drive the http-standard-headers scenario in the conformance client 2026-08-14 04:22:23 +09:00
docs Let the embedding application refuse an authorization request 2026-08-31 02:33:10 +09:00
examples Lowercase response header names in StreamableHTTPTransport 2026-07-16 11:45:48 +09:00
lib Let the embedding application refuse an authorization request 2026-08-31 02:33:10 +09:00
test Let the embedding application refuse an authorization request 2026-08-31 02:33:10 +09:00
.gitattributes Internal Release v0.1.1 2025-05-08 17:37:27 -04:00
.gitignore Add a rake docs:preview task serving the docs site locally 2026-08-25 12:36:54 +09:00
.rubocop.yml Suppress RuboCop extension suggestions (#484) 2026-08-07 18:46:46 -04:00
AGENTS.md Add a rake docs:preview task serving the docs site locally 2026-08-25 12:36:54 +09:00
CHANGELOG.md Release 1.4.0 2026-08-28 03:54:46 +09:00
CLAUDE.md Add CLAUDE.md referencing AGENTS.md 2026-04-01 01:03:43 +09:00
CODE_OF_CONDUCT.md Internal Release v0.1.1 2025-05-08 17:37:27 -04:00
dev.yml fix dev style (#208) 2026-01-06 01:00:31 -05:00
Gemfile Fix a build error in the Ruby 3.1 CI matrix 2026-06-18 09:20:59 +09:00
LICENSE chore: update licensing to Apache 2.0 for new contributions 2026-01-12 22:49:19 +00:00
mcp.gemspec Speed Up Tool::Schema Validation by 5x to 100x 2026-06-01 21:47:30 +09:00
Rakefile Add a rake docs:preview task serving the docs site locally 2026-08-25 12:36:54 +09:00
README.md [Doc] Align the Docs Page Names With the MCP Specification 2026-08-22 18:07:38 +09:00
RELEASE.md [Docs] Extract release documentation to RELEASE.md 2025-11-04 11:13:39 +09:00
ROADMAP.md [Doc] Align the ROADMAP deprecation wording with the shipped behavior 2026-08-23 01:15:20 +09:00
SECURITY.md Add SECURITY.md with GitHub Security Advisories guidance (#232) 2026-02-18 20:49:17 -05:00
VERSIONING.md Add VERSIONING.md documenting the versioning and breaking-change policy 2026-07-21 11:33:20 +09:00

MCP Ruby SDK Gem Version Apache 2.0 licensed CI

The official Ruby SDK for Model Context Protocol servers and clients.

Detailed guides are available at https://ruby.sdk.modelcontextprotocol.io.

Features

  • Build MCP servers that expose tools, prompts, and resources to any MCP host
  • Build MCP clients that connect to any MCP server, with automatic lifecycle negotiation and OAuth 2.1 authorization
  • Speak every standard transport: stdio and Streamable HTTP (including SSE), with a Rails integration
  • Cover the full protocol surface: server-to-client requests, multi round-trip requests, notifications, progress, logging, cancellation, completions, and pagination

Installation

Add this line to your application's Gemfile:

gem "mcp"

And then execute:

$ bundle install

Or install it yourself as:

$ gem install mcp

You may need to add additional dependencies depending on which features you wish to access.

Quick Start

The following minimal programs show both sides of the protocol: a server that exposes a single tool, and a client that spawns such a server and drives it over stdio.

MCP Server

A minimal server defines a tool and serves it over the stdio transport:

require "mcp"

# Create a simple tool
class ExampleTool < MCP::Tool
  description "A simple example tool that echoes back its arguments"
  input_schema(
    properties: {
      message: { type: "string" },
    },
    required: ["message"]
  )

  class << self
    def call(message:, server_context:)
      MCP::Tool::Response.new([{
        type: "text",
        text: "Hello from example tool! Message: #{message}",
      }])
    end
  end
end

# Set up the server
server = MCP::Server.new(
  name: "example_server",
  tools: [ExampleTool],
)

# Create and start the transport
transport = MCP::Server::Transports::StdioTransport.new(server)
transport.open

Save the script as server.rb, run it, and send JSON-RPC requests via stdin:

$ ruby server.rb
{"jsonrpc":"2.0","id":"1","method":"ping"}
{"jsonrpc":"2.0","id":"2","method":"tools/list"}
{"jsonrpc":"2.0","id":"3","method":"tools/call","params":{"name":"example_tool","arguments":{"message":"Hello"}}}

The same server can also run over Streamable HTTP, including mounted inside a Rails application; see Server Transports.

MCP Client

A minimal client spawns a stdio server as a subprocess, connects, and lists and calls its tools:

stdio_transport = MCP::Client::Stdio.new(
  command: "bundle",
  args: ["exec", "ruby", "path/to/server.rb"],
  env: { "API_KEY" => "my_secret_key" },
  read_timeout: 30
)
client = MCP::Client.new(transport: stdio_transport)

# Perform the MCP initialization handshake before sending any requests.
client.connect

# List available tools.
tools = client.tools
tools.each do |tool|
  puts "Tool: #{tool.name} - #{tool.description}"
end

# Call a specific tool.
response = client.call_tool(
  tool: tools.first,
  arguments: { message: "Hello, world!" }
)

# Close the transport when done.
stdio_transport.close

The same client can connect to Streamable HTTP servers with MCP::Client::HTTP; see Client Transports.

Examples

Runnable examples are available in examples/, including a complete Rails application in examples/rails.

Documentation

License

This project is licensed under the Apache License 2.0 for new contributions, with existing code under MIT. See the LICENSE file for details.