feat: add strict stateless protocol metadata validation (#1091)

* feat: add strict stateless protocol metadata validation

* fix: clarify strict metadata compatibility boundaries

---------

Co-authored-by: mrcs64 <9069178+mrcs64@users.noreply.github.com>
This commit is contained in:
mrcs64 2026-07-30 22:00:02 +02:00 • committed by GitHub
commit 983a1374ff
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -1462,6 +1462,13 @@ let router = axum::Router::new().nest_service("/mcp", service);
> Because there is no per-session state, the `service_factory` runs per request.
> Keep shared state (DB pools, caches) in a `Clone` handle captured by the
> closure; don't rely on in-memory state surviving between requests.
>
> Modern-only servers can additionally call
> `with_stateless_protocol_metadata_required(true)` to reject the compatibility
> fallback for requests missing their per-request protocol signals. rmcp clients
> negotiated below `2026-07-28` do not attach that body metadata and will be
> rejected, so pair this option with a `supported_protocol_versions`
> implementation that advertises only `2026-07-28` and later.
### Client-side