* feat(auth): add cimd support for SEP-991
add cimd support for url-based client ids
Signed-off-by: tanish111 <tanishdesai37@gmail.com>
* test(auth): add unit tests for is_https_url helper
Add test coverage for is_https_url helper to validate HTTPS scheme, non-root paths,
and reject http, javascript, data schemes, and invalid inputs per SEP-991 requirements.
Signed-off-by: tanish111 <tanishdesai37@gmail.com>
* feat(example): add CIMD OAuth server for SEP-991 testing
Implements a new server example (servers_cimd_auth_streamhttp) that
demonstrates CIMD (Client ID Metadata Document) support for URL-based
client IDs. The server validates client_id URLs, fetches and validates
client metadata documents, and provides OAuth 2.0 authorization endpoints
with MCP integration for end-to-end testing.
Signed-off-by: tanish111 <tanishdesai37@gmail.com>
* fix(oauth): add CORS headers to token endpoint
Add CORS headers to token endpoint to allow cross-origin requests from browsers
during OAuth authorization code exchange flow.
Signed-off-by: tanish111 <tanishdesai37@gmail.com>
* refactor: improve is_https_url function and consolidate tests
- Improve is_https_url function formatting and readability
- Merge all test cases into single test_is_https_url_scenarios function
- Add missing test case for "https://" URL
Signed-off-by: tanish111 <tanishdesai37@gmail.com>
* refactor: use map_err instead of match for error handling in auth.rs
Replace the verbose match statement with
map_err for more idiomatic
Signed-off-by: tanish111 <tanishdesai37@gmail.com>
* feat: add client-metadata.json
Add client metadata file for SEP-991 CIMD
authentication support
Signed-off-by: tanish111 <tanishdesai37@gmail.com>
---------
Signed-off-by: tanish111 <tanishdesai37@gmail.com>
SSE transport has been removed from the MCP specification in favor of
streamable HTTP. This removes all SSE-specific transport code:
- Remove `transport-sse-client` and `transport-sse-server` features
- Remove `SseClientTransport` and `SseServer` types
- Remove SSE-specific examples (`counter_sse`, `counter_sse_directly`)
- Migrate auth examples from SSE to streamable HTTP
- Update tests to remove SSE transport usage
- Update documentation
BREAKING CHANGE: The following have been removed:
- `transport-sse-client` feature
- `transport-sse-client-reqwest` feature
- `transport-sse-server` feature
- `SseClientTransport` type
- `SseServer` type
- `sse_client` and `sse_server` modules
Users should migrate to streamable HTTP transport which provides
equivalent functionality. See `StreamableHttpClientTransport` and
`StreamableHttpService` for the replacement APIs.
Ref: https://github.com/modelcontextprotocol/rust-sdk/pull/561#issuecomment-3576551699
What this enables:
- Clients can accept either Server-Sent Events (SSE) or JSON responses
- Flexible content negotiation based on server preferences
- Improved interoperability with different MCP server implementations
auth.rs was using an in-memory expires-at which is only set on initial token exchange.
Instead, this PR switches it to use the expires-at set in the credentials that are passed in.
* fix(oauth): attach bearer token to all streaming http requests
* fix(typo): fix an unrelated typo
There was an errant typo in the CHANGELOG that is breaking CI
Many MCP Servers use client_name for a variety of things including:
* Whitelisting
* Logos
* Copy shown directly on the page
* etc
As a result, it's important for MCP Clients to be able to override the client name.
- Gracefully ignore non-MCP notifications (like window/logMessage) for compatibility
- Add proper MCP method validation based on 2025-06-18 specification
- Fix connection failures with servers like 21Magic that send IDE integration messages
Resolves connection closed errors during initialization with mixed-protocol servers.
* fix(worker): correct typo in error message for transport cancellation
Signed-off-by: Jose Bovet Derpich <jose.bovet@gmail.com>
* doc(typo): correct typo in field header for tool and tool_router usage sections
Signed-off-by: Jose Bovet Derpich <jose.bovet@gmail.com>
---------
Signed-off-by: Jose Bovet Derpich <jose.bovet@gmail.com>
- Add TransportWriter type alias for cleaner type definitions
- Wrap transport writer in Option to enable proper closure
- Implement close() method to drop writer and signal end of communication
- Update graceful_shutdown to close transport before waiting for process exit
- Improve error handling for closed transport state
Addresses the graceful shutdown improvements discussed in #347 and #364
* fix: add reqwest dependency to transport-streamable-http-client feature
- Fix compilation error when using transport-streamable-http-client feature due to missing dependency
- Move From<reqwest::Error> implementation to reqwest module
* feat(rmcp): enhance transport features by decoupling reqwest
- Added reqwest features for reqwest-based implementations.
- Updated documentation
- Modified error handling in SSE transport to use `String` for content type.
- Updated examples to include new features
* feat(rmcp): enhance transport features by decoupling reqwest
- Added reqwest features for reqwest-based implementations
- Updated documentation
- Modified error handling in SSE transport to use `String`
- Updated examples to include new features
* feat: allow failable service creation in streamable HTTP tower service
In our setup we need to lookup some info that may fail before we serve
the request.
* Fix examples build
* allow using a TokioCommandWrap for TokioChildProcess::new closes#243
TokioCommandWrap implements From<tokio::process::Command> so this is not a breaking change, but also downstream users have more control over flags such as KillOnDrop and CreationFlags
see https://docs.rs/process-wrap/latest/process_wrap/#killondrop-and-creationflags
- Introduced `is_standard_notification` function to check for standard MCP notifications.
- Added `try_parse_with_compatibility` function to handle parsing messages with compatibility for non-standard notifications.
- Updated the decoder implementation to utilize the new compatibility handling.
- Added unit tests for standard notification checks and compatibility function to ensure correct behavior.
