Mirror of https://github.com/modelcontextprotocol/ruby-sdk — The official Ruby SDK for the Model Context Protocol servers and clients.
  • Ruby 99.8%
  • Shell 0.2%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Koichi ITO 5081cc5626 Surface unreachable Protected Resource Metadata instead of falling back to legacy discovery
## Motivation and Context

`Flow#locate_authorization_server` treated every failure to fetch Protected Resource Metadata as "the server publishes none"
and took the legacy 2025-03-26 path, where the MCP server's origin becomes the authorization base URL.
A request that never reached the server, or a `5xx` or `429`, says nothing about what the server publishes,
so a transient failure moved the flow to a different authorization server, discarded client information
and tokens bound to the real one on the way, and surfaced as an unrelated error, such as a failed registration at the origin,
rather than as the fetch failure itself. The comment claimed both reference SDKs behave that way, which is not so:
outside browsers the TypeScript SDK propagates network errors from discovery, and the Python SDK propagates them
and refuses the legacy path after a `5xx` or `429` from any candidate.

Discovery now keeps trying candidate URLs until one serves a JSON object and classifies the outcome once they are exhausted.
Like the Python SDK, it remembers a `5xx` or `429` from any candidate before deciding on the legacy path;
moving on to the next candidate after a network error is what the loop already did. `MetadataNotPublishedError`
(a `4xx` other than `429`, or a body that is not a JSON object) is the only failure that selects the legacy path;
`MetadataUnreachableError` (a network error, or a `5xx` or `429`, from any candidate) is raised instead.
Both subclass `AuthorizationError`, so callers rescuing that class keep working, and `MCP::Client::HTTP` still falls back from
a failed refresh to the full flow, which repeats discovery and raises the same way unless the server has recovered.
A body over the response cap is refused outright with a plain `AuthorizationError`, as it already was on the modern path.
The message lists every candidate's failure, with the URL stripped of userinfo, query and fragment and cut to a fixed length,
but otherwise spelled as requested, and with transport and parser messages bounded, as token endpoint diagnostics already are.
The default legacy endpoints for an origin whose own metadata document is absent are unchanged.

## How Has This Been Tested?

New tests in `test/mcp/client/oauth/flow_test.rb` and `test/mcp/client/oauth/discovery_test.rb`. Against the library
before this change, discovery in the scenarios these tests set up took the legacy path instead of raising.

## Breaking Changes

When no Protected Resource Metadata candidate serves a JSON object, a request that failed to reach the server,
or returned a `5xx` or `429`, now raises instead of attempting the legacy 2025-03-26 discovery at the MCP server's origin,
and a Protected Resource Metadata body over the response cap is refused instead of triggering that fallback.
2026-09-19 00:18:09 +09:00
.github Group the conformance Rake tasks under a conformance namespace 2026-08-30 02:24:52 +09:00
bin Add API documentation with GitHub Pages deployment 2025-11-21 12:21:38 -06:00
conformance Group the conformance Rake tasks under a conformance namespace 2026-08-30 02:24:52 +09:00
docs Surface unreachable Protected Resource Metadata instead of falling back to legacy discovery 2026-09-19 00:18:09 +09:00
examples Update examples for the 2026-07-28 era 2026-08-28 12:03:52 +09:00
lib Surface unreachable Protected Resource Metadata instead of falling back to legacy discovery 2026-09-19 00:18:09 +09:00
test Surface unreachable Protected Resource Metadata instead of falling back to legacy discovery 2026-09-19 00:18:09 +09:00
.gitattributes Internal Release v0.1.1 2025-05-08 17:37:27 -04:00
.gitignore Add a rake docs:preview task serving the docs site locally 2026-08-25 12:36:54 +09:00
.rubocop.yml Suppress RuboCop extension suggestions (#484) 2026-08-07 18:46:46 -04:00
AGENTS.md Group the conformance Rake tasks under a conformance namespace 2026-08-30 02:24:52 +09:00
CHANGELOG.md Release 1.5.1 2026-09-09 10:43:15 +09:00
CLAUDE.md Add CLAUDE.md referencing AGENTS.md 2026-04-01 01:03:43 +09:00
CODE_OF_CONDUCT.md Internal Release v0.1.1 2025-05-08 17:37:27 -04:00
dev.yml fix dev style (#208) 2026-01-06 01:00:31 -05:00
Gemfile Drop the json pin for Ruby 2.7.0 through 2.7.2 from the Gemfile 2026-09-10 11:55:31 +09:00
LICENSE chore: update licensing to Apache 2.0 for new contributions 2026-01-12 22:49:19 +00:00
mcp.gemspec Speed Up Tool::Schema Validation by 5x to 100x 2026-06-01 21:47:30 +09:00
Rakefile Group the conformance Rake tasks under a conformance namespace 2026-08-30 02:24:52 +09:00
README.md [Doc] Align the Docs Page Names With the MCP Specification 2026-08-22 18:07:38 +09:00
RELEASE.md [Docs] Extract release documentation to RELEASE.md 2025-11-04 11:13:39 +09:00
ROADMAP.md [Doc] Align the ROADMAP deprecation wording with the shipped behavior 2026-08-23 01:15:20 +09:00
SECURITY.md Add SECURITY.md with GitHub Security Advisories guidance (#232) 2026-02-18 20:49:17 -05:00
VERSIONING.md Add VERSIONING.md documenting the versioning and breaking-change policy 2026-07-21 11:33:20 +09:00

MCP Ruby SDK Gem Version Apache 2.0 licensed CI

The official Ruby SDK for Model Context Protocol servers and clients.

Detailed guides are available at https://ruby.sdk.modelcontextprotocol.io.

Features

  • Build MCP servers that expose tools, prompts, and resources to any MCP host
  • Build MCP clients that connect to any MCP server, with automatic lifecycle negotiation and OAuth 2.1 authorization
  • Speak every standard transport: stdio and Streamable HTTP (including SSE), with a Rails integration
  • Cover the full protocol surface: server-to-client requests, multi round-trip requests, notifications, progress, logging, cancellation, completions, and pagination

Installation

Add this line to your application's Gemfile:

gem "mcp"

And then execute:

$ bundle install

Or install it yourself as:

$ gem install mcp

You may need to add additional dependencies depending on which features you wish to access.

Quick Start

The following minimal programs show both sides of the protocol: a server that exposes a single tool, and a client that spawns such a server and drives it over stdio.

MCP Server

A minimal server defines a tool and serves it over the stdio transport:

require "mcp"

# Create a simple tool
class ExampleTool < MCP::Tool
  description "A simple example tool that echoes back its arguments"
  input_schema(
    properties: {
      message: { type: "string" },
    },
    required: ["message"]
  )

  class << self
    def call(message:, server_context:)
      MCP::Tool::Response.new([{
        type: "text",
        text: "Hello from example tool! Message: #{message}",
      }])
    end
  end
end

# Set up the server
server = MCP::Server.new(
  name: "example_server",
  tools: [ExampleTool],
)

# Create and start the transport
transport = MCP::Server::Transports::StdioTransport.new(server)
transport.open

Save the script as server.rb, run it, and send JSON-RPC requests via stdin:

$ ruby server.rb
{"jsonrpc":"2.0","id":"1","method":"ping"}
{"jsonrpc":"2.0","id":"2","method":"tools/list"}
{"jsonrpc":"2.0","id":"3","method":"tools/call","params":{"name":"example_tool","arguments":{"message":"Hello"}}}

The same server can also run over Streamable HTTP, including mounted inside a Rails application; see Server Transports.

MCP Client

A minimal client spawns a stdio server as a subprocess, connects, and lists and calls its tools:

stdio_transport = MCP::Client::Stdio.new(
  command: "bundle",
  args: ["exec", "ruby", "path/to/server.rb"],
  env: { "API_KEY" => "my_secret_key" },
  read_timeout: 30
)
client = MCP::Client.new(transport: stdio_transport)

# Perform the MCP initialization handshake before sending any requests.
client.connect

# List available tools.
tools = client.tools
tools.each do |tool|
  puts "Tool: #{tool.name} - #{tool.description}"
end

# Call a specific tool.
response = client.call_tool(
  tool: tools.first,
  arguments: { message: "Hello, world!" }
)

# Close the transport when done.
stdio_transport.close

The same client can connect to Streamable HTTP servers with MCP::Client::HTTP; see Client Transports.

Examples

Runnable examples are available in examples/, including a complete Rails application in examples/rails.

Documentation

License

This project is licensed under the Apache License 2.0 for new contributions, with existing code under MIT. See the LICENSE file for details.