ruby-sdk/lib/mcp
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Koichi ITO bd702d3e51 Reject modern-removed methods before the connection era locks
## Motivation and Context

SEP-2575 removes `initialize`, `ping`, `logging/setLevel`, `resources/subscribe`,
and `resources/unsubscribe` from the modern lifecycle, and the server answers them with `-32601` there.
The check consulted `ServerSession#era` alone, but `StdioTransport` locks the era in `lock_modern_era_on_success`,
which runs after a response is produced. The first frame of a stdio connection therefore reached
the server with `era == nil`, and a request carrying the modern `_meta` envelope was served instead of refused.
All five methods leaked, one request per connection:

```
initialize             a full InitializeResult
ping                   {resultType: "complete"}
logging/setLevel       {resultType: "complete"}
resources/subscribe    {resultType: "complete"}
resources/unsubscribe  {resultType: "complete"}
```

`initialize` is the worst of the five because it also mutates the session: serving it negotiated
the legacy lifecycle for a request that had declared the modern one, pinning the connection to
`:legacy` and marking it initialized. The Streamable HTTP transport was never affected,
since it routes sessionless modern traffic to `handle_modern` and rejects a modern envelope on every other path.

The era is the wrong thing to consult on its own: a request declares which lifecycle it belongs to
through its own envelope, independently of connection state that settles later. The Python SDK gates
on exactly that, testing each request's `_meta` before dispatch rather than a negotiated connection
mode. `modern_request?` now does the same here, treating a locked `:modern` era as authoritative and
falling back to the request's envelope while the era is still undetermined. A legacy-locked session is left alone:
`lift_request_envelope` already answers a modern envelope there with the lifecycle violation,
which names the cause better than Method not found.

## How Has This Been Tested?

New tests in `test/mcp/server_test.rb` cover all five removed methods being refused with `-32601` when
they carry the envelope on an era-less session, an enveloped `initialize` no longer locking the era
or marking the session initialized, a method the modern lifecycle keeps still being served under the same
conditions, and a legacy `initialize` negotiating 2026-07-28 still succeeding and locking `:legacy` - negotiating
a dual-era version through the handshake is not the same as carrying the envelope. A test in
`test/mcp/server/transports/stdio_transport_test.rb` drives the case end to end,
sending an enveloped `resources/subscribe` as a connection's first frame.

One existing assertion changed. "modern results carry resultType complete" used `ping` as one of its
stamped examples, which only passed because of this defect; `ping` is absent from the 2026-07-28 schema,
so a modern request naming it is refused rather than stamped. It now uses `prompts/list`, with a note
on why `ping` cannot appear there. The existing legacy counterpart, which pings without an envelope,
is unchanged and still expects no stamp.

`bundle exec rake` (tests, RuboCop, and conformance baseline) passes. The conformance suite exercises
the HTTP transport, which this does not change, so its baseline is unaffected.

## Breaking Changes

None for a conforming client. A request that both carries the 2026-07-28 envelope and names a method
that revision removed now receives `-32601` instead of a result, which is the answer the spec already
required once the era was known.
2026-08-13 01:47:59 +09:00
..
client Mirror x-mcp-header tool parameters into Mcp-Param-* headers per SEP-2243 2026-08-08 20:58:35 +09:00
elicitation Add MCP::Elicitation::EnumSchema builders for SEP-1330 2026-08-05 12:26:13 +09:00
prompt Add _meta field to resource, content, and result classes 2026-04-11 15:08:55 +09:00
resource Add _meta field to resource, content, and result classes 2026-04-11 15:08:55 +09:00
server Merge pull request #496 from koic/request_state_security 2026-08-10 12:19:56 +09:00
tool fix: preserve explicit tool response content 2026-07-23 03:11:48 +08:00
annotations.rb Add audience role validation for MCP::Annotations per MCP specification 2026-06-22 01:13:17 +09:00
apps.rb Add Server-Side MCP Apps Helpers per SEP-1865 2026-07-07 01:16:02 +09:00
cancellation.rb Support notifications/cancelled per MCP specification 2026-05-03 04:02:22 +09:00
cancelled_error.rb Support notifications/cancelled per MCP specification 2026-05-03 04:02:22 +09:00
client.rb Mirror x-mcp-header tool parameters into Mcp-Param-* headers per SEP-2243 2026-08-08 20:58:35 +09:00
configuration.rb Expose the user-defined server_context in instrumentation data 2026-08-08 08:33:07 +09:00
content.rb Add _meta field to resource, content, and result classes 2026-04-11 15:08:55 +09:00
elicitation.rb Add MCP::Elicitation::EnumSchema builders for SEP-1330 2026-08-05 12:26:13 +09:00
error_codes.rb Add Stateless Lifecycle Foundations per SEP-2575 2026-07-26 20:03:57 +09:00
icon.rb Fix RuboCop offenses detected with rubocop-shopify 3.0.0 2026-07-15 01:46:51 +09:00
instrumentation.rb Expose the user-defined server_context in instrumentation data 2026-08-08 08:33:07 +09:00
logging_message_notification.rb logging_message_notification: Remove unused require 2026-02-05 16:05:08 -05:00
methods.rb Enforce the modern lifecycle admission rules per SEP-2575 2026-08-08 18:51:53 +09:00
progress.rb Support POST response SSE streams for server-to-client messages 2026-04-04 19:20:31 +09:00
prompt.rb Use autoload to defer loading of unused subsystems 2026-03-12 14:08:27 +09:00
protocol_deprecations.rb feat: deprecate roots sampling and logging 2026-08-02 13:13:10 -04:00
request_envelope.rb Align modern envelope validation with the finalized spec 2026-08-08 16:00:29 +09:00
resource.rb Support class-based Resource and ResourceTemplate definitions 2026-07-10 22:39:42 +09:00
resource_template.rb Fix RuboCop offenses detected with rubocop-shopify 3.0.0 2026-07-15 01:46:51 +09:00
result_type.rb Recognize multi round-trip input_required results per SEP-2322 2026-06-30 11:34:17 +09:00
server.rb Reject modern-removed methods before the connection era locks 2026-08-13 01:47:59 +09:00
server_context.rb Let Handlers Return Multi Round-Trip input_required Results per SEP-2322 2026-08-08 15:07:16 +09:00
server_session.rb Stream modern request notifications and honor the envelope logLevel per SEP-2575 2026-08-08 15:22:58 +09:00
string_utils.rb Fix ReDoS vulnerability in StringUtils#underscore 2026-01-09 01:14:52 +09:00
tool.rb Use autoload to defer loading of unused subsystems 2026-03-12 14:08:27 +09:00
trace_context.rb Support W3C Trace Context Propagation via _meta per SEP-414 2026-06-12 14:36:24 +09:00
transport.rb Auto-set server.transport in Transport#initialize 2026-04-09 12:08:55 +09:00
version.rb Release 1.1.0 2026-08-01 11:29:49 +09:00