## Motivation and Context SEP-2260 (modelcontextprotocol/modelcontextprotocol#2260, merged for the 2026-07-28 spec release) requires servers to send `roots/list`, `sampling/createMessage`, and `elicitation/create` only in association with an originating client request (`ping` is exempt); standalone server-initiated requests on independent streams must not be implemented. On the Streamable HTTP transport, an associated request rides the originating POST's SSE response stream instead of the standalone GET stream. The Ruby SDK's `ServerContext` already satisfies the requirement for handler-scoped calls: `list_roots`, `create_sampling_message`, `create_form_elicitation`, and `create_url_elicitation` stamp the originating request id as `related_request_id`, and because the literal keyword appears after `**kwargs`, a caller-supplied `related_request_id:` is overridden. That behavior was previously untested and undocumented. This change pins it down and adds a migration signal for direct `ServerSession` calls, mirroring the TypeScript SDK's approach (typescript-sdk#2228, non-overridable `relatedRequestId` stamping on ctx-scoped requests): - `ServerContext` documents the non-overridable stamping, and new tests lock it in for all four request helpers. - `ServerSession#list_roots`, `#create_sampling_message`, `#create_form_elicitation`, and `#create_url_elicitation` emit a deprecation warning when called without `related_request_id:` (the call still goes out unchanged, on the GET stream for Streamable HTTP). `ServerSession#ping` is exempt per the SEP. Hard enforcement is deferred to a future protocol-version gate for 2026-07-28. - A new transport test verifies that `send_request` with `related_request_id` delivers on the originating POST stream and never falls back to the GET stream. Resolves #381. ## How Has This Been Tested? - `test/mcp/server_context_test.rb`: `list_roots` stamps the originating request id; `create_sampling_message`, `create_form_elicitation`, and `create_url_elicitation` stamp it non-overridably (a caller-supplied `related_request_id: "attacker"` is replaced). - `test/mcp/server_roots_test.rb`, `test/mcp/server_sampling_test.rb`, `test/mcp/server_elicitation_test.rb`: each `ServerSession` method warns (matching /SEP-2260/) without `related_request_id:` and stays silent with it. The warning assertions temporarily set `$VERBOSE = false` because the rake test task runs with `-W0`, following the existing `assert_implicit_connect_deprecation_warning` precedent. - `test/mcp/server/transports/streamable_http_transport_test.rb`: a `roots/list` request with `related_request_id` is written to the registered POST request stream and not to the GET SSE stream. - Existing direct-call test sites were updated to pass `related_request_id:` (or capture the warning) so the suite output stays clean; their assertions are unchanged. ## Breaking Changes None. Behavior is unchanged; direct `ServerSession` calls without `related_request_id:` now emit a deprecation warning but are still sent exactly as before.
223 lines
7.1 KiB
Ruby
223 lines
7.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require "test_helper"
|
|
|
|
module MCP
|
|
class ServerRootsTest < ActiveSupport::TestCase
|
|
class MockTransport < Transport
|
|
attr_reader :requests
|
|
|
|
def initialize(server)
|
|
super
|
|
@requests = []
|
|
end
|
|
|
|
def send_request(method, params = nil)
|
|
@requests << { method: method, params: params }
|
|
{
|
|
roots: [
|
|
{ uri: "file:///home/user/projects/myproject", name: "My Project" },
|
|
],
|
|
}
|
|
end
|
|
|
|
def send_response(response); end
|
|
def send_notification(method, params = nil); end
|
|
def open; end
|
|
def close; end
|
|
end
|
|
|
|
setup do
|
|
@server = Server.new(
|
|
name: "test_server",
|
|
version: "1.0.0",
|
|
)
|
|
|
|
@mock_transport = MockTransport.new(@server)
|
|
|
|
@server.handle({
|
|
jsonrpc: "2.0",
|
|
method: "initialize",
|
|
id: 1,
|
|
params: {
|
|
protocolVersion: "2025-11-25",
|
|
capabilities: { roots: { listChanged: true } },
|
|
clientInfo: { name: "test-client", version: "1.0" },
|
|
},
|
|
})
|
|
end
|
|
|
|
test "roots_list_changed_handler registers callback invoked when notification received" do
|
|
callback_called = false
|
|
|
|
@server.roots_list_changed_handler do |_params|
|
|
callback_called = true
|
|
end
|
|
|
|
@server.handle({
|
|
jsonrpc: "2.0",
|
|
method: "notifications/roots/list_changed",
|
|
})
|
|
|
|
assert callback_called
|
|
end
|
|
|
|
test "notifications/roots/list_changed is handled as no-op by default" do
|
|
result = @server.handle({
|
|
jsonrpc: "2.0",
|
|
method: "notifications/roots/list_changed",
|
|
})
|
|
|
|
assert_nil result
|
|
end
|
|
|
|
test "init stores client capabilities" do
|
|
server = Server.new(name: "test", version: "1.0")
|
|
server.handle({
|
|
jsonrpc: "2.0",
|
|
method: "initialize",
|
|
id: 1,
|
|
params: {
|
|
protocolVersion: "2025-11-25",
|
|
capabilities: { roots: { listChanged: true } },
|
|
clientInfo: { name: "test-client", version: "1.0" },
|
|
},
|
|
})
|
|
|
|
assert_equal({ roots: { listChanged: true } }, server.client_capabilities)
|
|
end
|
|
|
|
test "init rejects params without capabilities and stores nothing" do
|
|
server = Server.new(name: "test", version: "1.0")
|
|
response = server.handle({
|
|
jsonrpc: "2.0",
|
|
method: "initialize",
|
|
id: 1,
|
|
params: {
|
|
protocolVersion: "2025-11-25",
|
|
clientInfo: { name: "test-client", version: "1.0" },
|
|
},
|
|
})
|
|
|
|
assert_equal(-32602, response[:error][:code])
|
|
assert_nil server.client_capabilities
|
|
end
|
|
|
|
test "list_roots uses per-session capabilities via ServerSession" do
|
|
transport = MCP::Server::Transports::StreamableHTTPTransport.new(@server)
|
|
|
|
session_with_roots = ServerSession.new(server: @server, transport: transport, session_id: "s1")
|
|
session_with_roots.store_client_info(client: { name: "capable" }, capabilities: { roots: {} })
|
|
transport.instance_variable_get(:@sessions)["s1"] = { stream: nil, server_session: session_with_roots }
|
|
|
|
error_with_roots = assert_raises(RuntimeError) do
|
|
capture_io { session_with_roots.list_roots }
|
|
end
|
|
assert_equal("No active stream for roots/list request.", error_with_roots.message)
|
|
|
|
session_without_roots = ServerSession.new(server: @server, transport: transport, session_id: "s2")
|
|
session_without_roots.store_client_info(client: { name: "incapable" }, capabilities: {})
|
|
|
|
error = assert_raises(RuntimeError) do
|
|
capture_io { session_without_roots.list_roots }
|
|
end
|
|
assert_equal("Client does not support roots.", error.message)
|
|
end
|
|
|
|
test "ServerSession#list_roots warns when called without related_request_id" do
|
|
# Per SEP-2260, server-to-client requests must be associated with an originating client request.
|
|
# `$VERBOSE = false` because the rake test task runs with `-W0`, under which `Kernel#warn` emits nothing.
|
|
session = ServerSession.new(server: @server, transport: @mock_transport)
|
|
session.store_client_info(client: { name: "capable" }, capabilities: { roots: {} })
|
|
|
|
original_verbose = $VERBOSE
|
|
$VERBOSE = false
|
|
assert_output(nil, /SEP-2260/) { session.list_roots }
|
|
ensure
|
|
$VERBOSE = original_verbose
|
|
end
|
|
|
|
test "ServerSession#list_roots does not warn when related_request_id is given" do
|
|
session = ServerSession.new(server: @server, transport: @mock_transport)
|
|
session.store_client_info(client: { name: "capable" }, capabilities: { roots: {} })
|
|
|
|
assert_silent { session.list_roots(related_request_id: "req-1") }
|
|
end
|
|
|
|
test "ServerSession#client_capabilities falls back to server global capabilities" do
|
|
transport = MCP::Server::Transports::StreamableHTTPTransport.new(@server)
|
|
|
|
session = ServerSession.new(server: @server, transport: transport, session_id: "s3")
|
|
transport.instance_variable_get(:@sessions)["s3"] = { stream: nil, server_session: session }
|
|
|
|
error = assert_raises(RuntimeError) do
|
|
capture_io { session.list_roots }
|
|
end
|
|
assert_equal("No active stream for roots/list request.", error.message)
|
|
end
|
|
|
|
test "session init does not overwrite server global client_capabilities" do
|
|
server = Server.new(name: "test", version: "1.0")
|
|
MockTransport.new(server)
|
|
|
|
server.handle({
|
|
jsonrpc: "2.0",
|
|
method: "initialize",
|
|
id: 1,
|
|
params: {
|
|
protocolVersion: "2025-11-25",
|
|
capabilities: { roots: {} },
|
|
clientInfo: { name: "first-client", version: "1.0" },
|
|
},
|
|
})
|
|
|
|
assert_equal({ roots: {} }, server.client_capabilities)
|
|
|
|
transport = MCP::Server::Transports::StreamableHTTPTransport.new(server)
|
|
session = ServerSession.new(server: server, transport: transport, session_id: "s1")
|
|
|
|
server.handle(
|
|
{
|
|
jsonrpc: "2.0",
|
|
method: "initialize",
|
|
id: 2,
|
|
params: {
|
|
protocolVersion: "2025-11-25",
|
|
capabilities: {},
|
|
clientInfo: { name: "second-client", version: "1.0" },
|
|
},
|
|
},
|
|
session: session,
|
|
)
|
|
|
|
assert_equal({ roots: {} }, server.client_capabilities)
|
|
assert_equal({}, session.client_capabilities)
|
|
end
|
|
|
|
test "ServerSession#list_roots uses session-scoped capabilities from HTTP init" do
|
|
server = Server.new(name: "test", version: "1.0")
|
|
transport = MCP::Server::Transports::StreamableHTTPTransport.new(server)
|
|
|
|
session = ServerSession.new(server: server, transport: transport, session_id: "s1")
|
|
server.handle(
|
|
{
|
|
jsonrpc: "2.0",
|
|
method: "initialize",
|
|
id: 1,
|
|
params: {
|
|
protocolVersion: "2025-11-25",
|
|
capabilities: { roots: {} },
|
|
clientInfo: { name: "http-client", version: "1.0" },
|
|
},
|
|
},
|
|
session: session,
|
|
)
|
|
|
|
transport.instance_variable_get(:@sessions)["s1"] = { stream: nil, server_session: session }
|
|
error = assert_raises(RuntimeError) do
|
|
capture_io { session.list_roots }
|
|
end
|
|
assert_equal("No active stream for roots/list request.", error.message)
|
|
end
|
|
end
|
|
end
|