.devcontainer/devcontainer.json

@@ -1,41 +1,41 @@
 // For format details, see https://aka.ms/devcontainer.json. For config options, see the
 // README at: https://github.com/devcontainers/templates/tree/main/src/rust
 {
-    "name": "Rust",
-    // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
-    "image": "mcr.microsoft.com/devcontainers/rust:1-1-bullseye",
-    "features": {
-        "ghcr.io/devcontainers/features/node:1": {},
-        "ghcr.io/devcontainers/features/python:1": {
-            "version": "3.10",
-            "toolsToInstall": "uv"
-        }
-    },
-    // Configure tool-specific properties.
-    "customizations": {
-        "vscode": {
-            "settings": {
-                "editor.formatOnSave": true,
-                "[rust]": {
-                    "editor.defaultFormatter": "rust-lang.rust-analyzer"
-                }
-            }
-        }
-    },
-    // Use 'postCreateCommand' to run commands after the container is created.
-    "postCreateCommand": "uv venv && npm install -g @commitlint/config-conventional"
-    // Use 'mounts' to make the cargo cache persistent in a Docker Volume.
-    // "mounts": [
-    // 	{
-    // 		"source": "devcontainer-cargo-cache-${devcontainerId}",
-    // 		"target": "/usr/local/cargo",
-    // 		"type": "volume"
-    // 	}
-    // ]
-    // Features to add to the dev container. More info: https://containers.dev/features.
-    // "features": {},
-    // Use 'forwardPorts' to make a list of ports inside the container available locally.
-    // "forwardPorts": [],
-    // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
-    // "remoteUser": "root"
+	"name": "Rust",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"image": "mcr.microsoft.com/devcontainers/rust:1-1-bullseye",
+	"features": {
+		"ghcr.io/devcontainers/features/node:1": {},
+		"ghcr.io/devcontainers/features/python:1": {
+			"version": "3.10",
+			"toolsToInstall": "uv"
+		}
+	},
+	// Configure tool-specific properties.
+	"customizations": {
+		"vscode": {
+			"settings": {
+				"editor.formatOnSave": true,
+				"[rust]": {
+					"editor.defaultFormatter": "rust-lang.rust-analyzer"
+				}
+			}
+		}
+	},
+	// Use 'postCreateCommand' to run commands after the container is created.
+	"postCreateCommand": "uv venv"
+	// Use 'mounts' to make the cargo cache persistent in a Docker Volume.
+	// "mounts": [
+	// 	{
+	// 		"source": "devcontainer-cargo-cache-${devcontainerId}",
+	// 		"target": "/usr/local/cargo",
+	// 		"type": "volume"
+	// 	}
+	// ]
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	// "features": {},
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [],
+	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+	// "remoteUser": "root"
 }

.githooks/commit-msg

@@ -0,0 +1,50 @@
+#!/bin/sh
+# Verify commit message follows conventional commit format
+# https://www.conventionalcommits.org/
+#
+# Uses npx commitlint if Node.js is available (same as CI),
+# otherwise falls back to basic shell regex validation.
+
+commit_msg_file="$1"
+commit_msg=$(cat "$commit_msg_file")
+
+# Skip merge commits
+if echo "$commit_msg" | grep -qE "^Merge "; then
+    exit 0
+fi
+
+# Try to use commitlint via npx if Node.js is available
+if command -v npx >/dev/null 2>&1; then
+    # Run commitlint with config-conventional rules (same as CI)
+    echo "$commit_msg" | npx --yes @commitlint/cli@latest --extends @commitlint/config-conventional
+    exit $?
+fi
+
+# Fallback: basic shell regex validation if Node.js is not available
+echo "Note: Node.js not found, using basic commit message validation."
+echo "      Install Node.js for full commitlint validation (same as CI)."
+echo ""
+
+# Conventional commit types from @commitlint/config-conventional
+types="build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test"
+
+# Pattern: type(optional-scope): description
+# The description must start with lowercase and not end with period
+pattern="^($types)(\(.+\))?(!)?: .+"
+
+if ! echo "$commit_msg" | head -1 | grep -qE "$pattern"; then
+    echo "ERROR: Commit message does not follow conventional commit format."
+    echo ""
+    echo "Expected format: <type>(<scope>): <description>"
+    echo ""
+    echo "Valid types: build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test"
+    echo ""
+    echo "Examples:"
+    echo "  feat: add new feature"
+    echo "  fix(parser): resolve parsing issue"
+    echo "  docs: update README"
+    echo ""
+    echo "Your commit message:"
+    echo "  $(head -1 "$commit_msg_file")"
+    exit 1
+fi

.githooks/pre-commit

@@ -1,5 +0,0 @@
-#!/bin/sh
-cargo +nightly fmt --all
-
-# stage any formatting changes
-git add -u

.github/CODEOWNERS

@@ -1 +0,0 @@
-* @modelcontextprotocol/rust-sdk

.github/codeql/codeql-config.yml

@@ -1,4 +0,0 @@
-name: "CodeQL config"
-
-paths-ignore:
-  - conformance

.github/dependabot.yml

@@ -16,15 +16,11 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "daily"
     labels:
       # Mark PRs as CI related change.
       - T-CI
     open-pull-requests-limit: 3
-    groups:
-      codeql-action:
-        patterns:
-          - "github/codeql-action*"
     commit-message:
       prefix: "chore"
-      include: "scope"
+      include: "scope"

.github/workflows/auto-label-pr.yml

@@ -3,9 +3,6 @@ on:
   # Runs workflow when activity on a PR in the workflow's repository occurs.
   pull_request_target:
 
-permissions:
-  contents: read
-
 jobs:
   auto-label:
     permissions:
@@ -23,7 +20,7 @@ jobs:
       PR_URL: ${{ github.event.pull_request.html_url }}
 
     steps:
-    - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7
+    - uses: actions/labeler@v6
       with:
         # Auto-include paths starting with dot (e.g. .github)
         dot: true

.github/workflows/ci.yml

@@ -12,35 +12,34 @@ env:
   CARGO_TERM_COLOR: always
   ARTIFACT_DIR: release-artifacts
 
-permissions:
-  contents: read
-
 jobs:
   commit-lint:
     name: Lint Commit Messages
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '20'
           
       - name: Install commitlint
-        run: npm install --global @commitlint/cli@20.4.3 @commitlint/config-conventional@20.4.3
-
+        run: |
+          npm install --save-dev @commitlint/cli @commitlint/config-conventional
+          echo "module.exports = {extends: ['@commitlint/config-conventional']}" > commitlint.config.js
+          
       - name: Lint commit messages
-        run: commitlint --extends @commitlint/config-conventional --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
+        run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
 
   fmt:
     name: Code Formatting
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v6
 
       - name: Install Rust fmt
         run: rustup toolchain install nightly --component rustfmt
@@ -52,209 +51,41 @@ jobs:
     name: Lint with Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        uses: dtolnay/rust-toolchain@stable
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@v2
 
-      - name: Run clippy (all features)
+      - name: Run clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
-
-      - name: Run clippy (all features except local)
-        run: |
-          FEATURES=$(cargo metadata --no-deps --format-version 1 \
-            | jq -r '[.packages[] | select(.name == "rmcp") | .features | keys[]
-                      | select(startswith("__") | not)
-                      | select(. != "local")] | join(",")')
-          cargo clippy --package rmcp --all-targets --no-default-features --features "$FEATURES" -- -D warnings
-
-  semver:
-    name: SemVer Check
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
-
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-
-      - name: Install cargo-semver-checks
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
-        with:
-          tool: cargo-semver-checks
-
-      - name: Determine semver release type
-        run: |
-          if git log --format=%B \
-            ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} \
-            | grep -Eq '(^[A-Za-z0-9_-]+(\([^)]*\))?!:|^BREAKING[ -]CHANGE:)'; then
-            echo "SEMVER_RELEASE_TYPE=major" >> "$GITHUB_ENV"
-          else
-            echo "SEMVER_RELEASE_TYPE=minor" >> "$GITHUB_ENV"
-          fi
-
-      - name: Check rmcp (default features)
-        run: |
-          cargo semver-checks \
-            --package rmcp \
-            --baseline-rev ${{ github.event.pull_request.base.sha }} \
-            --release-type "$SEMVER_RELEASE_TYPE" \
-            --only-explicit-features \
-            --features default
-
-      - name: Check rmcp (all features except local)
-        run: |
-          FEATURES=$(cargo metadata --no-deps --format-version 1 \
-            | jq -r '[.packages[] | select(.name == "rmcp") | .features | keys[]
-                      | select(startswith("__") | not)
-                      | select(. != "local")] | join(",")')
-          cargo semver-checks \
-            --package rmcp \
-            --baseline-rev ${{ github.event.pull_request.base.sha }} \
-            --release-type "$SEMVER_RELEASE_TYPE" \
-            --only-explicit-features \
-            --features "$FEATURES"
-
-  public-api:
-    name: Public API Check
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-
-      # cargo-public-api builds rustdoc JSON, which requires a nightly toolchain
-      # to be installed (it does not need to be the default; the tool invokes it
-      # via `cargo +nightly`).
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@7c8d7d138f5c09cef361f8214cf96882cd029cdb # nightly
-
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-
-      - name: Install cargo-public-api
-        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
-        with:
-          tool: cargo-public-api
-
-      # Mirror the SemVer Check job's release-type detection: a breaking-change
-      # commit marker (`!:` or `BREAKING CHANGE:`) means a major release (any API
-      # change is allowed); otherwise a minor release (additions allowed, but
-      # changed/removed public items are denied). This catches breaking changes
-      # that cargo-semver-checks cannot yet detect, such as a change to a
-      # function's return type or a field's type.
-      # See https://github.com/obi1kenobi/cargo-semver-checks/issues/5
-      - name: Determine release type and deny flags
-        run: |
-          if git log --format=%B \
-            ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} \
-            | grep -Eq '(^[A-Za-z0-9_-]+(\([^)]*\))?!:|^BREAKING[ -]CHANGE:)'; then
-            SEMVER_RELEASE_TYPE=major
-          else
-            SEMVER_RELEASE_TYPE=minor
-          fi
-          case "$SEMVER_RELEASE_TYPE" in
-            major) DENY="" ;;
-            patch) DENY="--deny added --deny changed --deny removed" ;;
-            *)     DENY="--deny changed --deny removed" ;;
-          esac
-          echo "SEMVER_RELEASE_TYPE=$SEMVER_RELEASE_TYPE" >> "$GITHUB_ENV"
-          echo "DENY=$DENY" >> "$GITHUB_ENV"
-
-      - name: Check rmcp (default features)
-        run: |
-          cargo public-api \
-            --package rmcp \
-            -ss \
-            diff \
-            $DENY \
-            --force \
-            ${{ github.event.pull_request.base.sha }}..${{ github.sha }}
-
-      - name: Check rmcp (all features except local)
-        run: |
-          BASE_SHA=${{ github.event.pull_request.base.sha }}
-          # `cargo public-api diff` builds both revisions with the same feature
-          # set, so a feature that exists on only one side (e.g. a feature added
-          # or removed by this PR) would fail to build the other revision. Diff
-          # only the features present in BOTH the base and the head; features
-          # unique to one side are necessarily pure additions/removals, which the
-          # release-type deny flags already govern.
-          list_features() {
-            cargo metadata --no-deps --format-version 1 --manifest-path "$1/Cargo.toml" \
-              | jq -r '.packages[] | select(.name == "rmcp") | .features | keys[]
-                       | select(startswith("__") | not)
-                       | select(. != "local")'
-          }
-          list_features "." | sort -u > "$RUNNER_TEMP/head_features"
-          git worktree add --detach "$RUNNER_TEMP/rmcp-base" "$BASE_SHA"
-          list_features "$RUNNER_TEMP/rmcp-base" | sort -u > "$RUNNER_TEMP/base_features"
-          git worktree remove --force "$RUNNER_TEMP/rmcp-base"
-          FEATURES=$(comm -12 "$RUNNER_TEMP/head_features" "$RUNNER_TEMP/base_features" | paste -sd, -)
-          cargo public-api \
-            --package rmcp \
-            --features "$FEATURES" \
-            -ss \
-            diff \
-            $DENY \
-            --force \
-            "$BASE_SHA"..${{ github.sha }}
-
+  
   spelling:
     name: spell check with typos
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v6
     - name: Spell Check Repo
-      uses: crate-ci/typos@d43b6c087ac471e2ea7b8af622ff15f05c0c365b # master
-
-  msrv:
-    name: Check MSRV
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Read MSRV from Cargo.toml
-        run: |
-          MSRV=$(cargo metadata --no-deps --format-version 1 \
-            | jq -r '.packages[] | select(.name == "rmcp") | .rust_version')
-          echo "MSRV=$MSRV" >> "$GITHUB_ENV"
-
-      - name: Install MSRV Rust
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
-        with:
-          toolchain: ${{ env.MSRV }}
-
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-
-      - name: Check default workspace members with MSRV
-        run: cargo +${{ env.MSRV }} check --all-targets --all-features
+      uses: crate-ci/typos@master
 
   test:
     name: Run Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v6
       
       # install nodejs
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '20'
           
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        uses: astral-sh/setup-uv@v7
         
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        uses: dtolnay/rust-toolchain@stable
         
       - name: Set up Python
         run: uv python install
@@ -262,64 +93,30 @@ jobs:
       - name: Create venv for python
         run: uv venv
         
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@v2
 
       - name: Run tests
         run: cargo test --all-features
-
-  test-no-local:
-    name: Run Tests (no local feature)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      # install nodejs
-      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '22'
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
-
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
-
-      - name: Set up Python
-        run: uv python install
-
-      - name: Create venv for python
-        run: uv venv
-
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-
-      - name: Run tests without local feature
-        run: |
-          FEATURES=$(cargo metadata --no-deps --format-version 1 \
-            | jq -r '[.packages[] | select(.name == "rmcp") | .features | keys[]
-                      | select(startswith("__") | not)
-                      | select(. != "local")] | join(",")')
-          cargo test -p rmcp --features "$FEATURES"
-
+  
   coverage:
     name: Code Coverage
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v6
 
       # install nodejs
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '20'
           
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        uses: astral-sh/setup-uv@v7
         
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        uses: dtolnay/rust-toolchain@stable
         
       - name: Set up Python
         run: uv python install
@@ -327,7 +124,7 @@ jobs:
       - name: Create venv for python
         run: uv venv
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-llvm-cov
         run: cargo install cargo-llvm-cov
@@ -342,19 +139,19 @@ jobs:
     name: Example test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v6
 
       # install nodejs
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@v6
         with:
-          node-version: '22'
+          node-version: '20'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        uses: astral-sh/setup-uv@v7
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        uses: dtolnay/rust-toolchain@stable
 
       - name: Set up Python
         run: uv python install
@@ -362,7 +159,7 @@ jobs:
       - name: Create venv for python
         run: uv venv
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@v2
 
       - name: Add target WASI preview 2
         run: |
@@ -389,7 +186,7 @@ jobs:
             if [ -f "$dir/Cargo.toml" ]; then
               if [[ "$dir" != *"wasi"* ]]; then
                 echo "Testing $dir"
-                cargo test --manifest-path "$dir/Cargo.toml" --all-features --all-targets
+                cargo test --manifest-path "$dir/Cargo.toml" --all-features
               fi
             fi
           done
@@ -398,12 +195,12 @@ jobs:
     name: Security Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        uses: dtolnay/rust-toolchain@stable
       
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-audit
         run: cargo install cargo-audit
@@ -415,12 +212,12 @@ jobs:
     name: Generate Documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@7c8d7d138f5c09cef361f8214cf96882cd029cdb # nightly
+        uses: dtolnay/rust-toolchain@nightly
         
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@v2
 
       - name: Generate documentation
         run: |
@@ -441,7 +238,7 @@ jobs:
       # This happened recently in the attack on `tj-actions/changed-files`, but
       # has happened many times before as well.
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v6
 
       - name: Update Rust
         run: | 

.github/workflows/codeql.yml

@@ -1,39 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    - cron: '0 0 * * 1' # Weekly on Monday
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [rust, javascript-typescript, python, actions]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
-        with:
-          languages: ${{ matrix.language }}
-          config-file: ./.github/codeql/codeql-config.yml
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0

.github/workflows/conformance.yml

@@ -1,149 +0,0 @@
-name: Conformance
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-concurrency:
-  group: conformance-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  CONFORMANCE_VERSION: "0.2.0-alpha.10"
-
-permissions:
-  contents: read
-
-jobs:
-  server:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
-
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-
-      - name: Build conformance binaries
-        run: cargo build -p mcp-conformance
-
-      - name: Test conformance server
-        run: cargo test -p mcp-conformance --bin conformance-server
-
-      - name: Start conformance server
-        run: |
-          PORT=8001 ./target/debug/conformance-server &
-          echo $! > server.pid
-          for _ in $(seq 1 30); do
-            if curl -s -o /dev/null http://127.0.0.1:8001/mcp; then
-              exit 0
-            fi
-            sleep 1
-          done
-          echo "conformance server did not become ready" >&2
-          exit 1
-
-      - name: Run 2025-11-25 server suite
-        run: |
-          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" server \
-            --url http://127.0.0.1:8001/mcp \
-            --suite all \
-            --spec-version 2025-11-25 \
-            -o conformance-results/2025-11-25
-
-      - name: Run 2026-07-28 server suite
-        run: |
-          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" server \
-            --url http://127.0.0.1:8001/mcp \
-            --suite all \
-            --spec-version 2026-07-28 \
-            -o conformance-results/2026-07-28
-
-      - name: Run extension server scenarios (informational)
-        run: |
-          scenarios=(
-            tasks-lifecycle
-            tasks-capability-negotiation
-            tasks-wire-fields
-            tasks-request-state-removal
-            tasks-mrtr-input
-            tasks-request-headers
-            tasks-dispatch-and-envelope
-            tasks-status-notifications
-            tasks-required-task-error
-            tasks-mrtr-composition
-          )
-          for scenario in "${scenarios[@]}"; do
-            npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" server \
-              --url http://127.0.0.1:8001/mcp \
-              --scenario "$scenario" \
-              --expected-failures conformance/expected-failures-extensions.yaml \
-              -o conformance-extension-results
-          done
-
-      - name: Stop conformance server
-        if: always()
-        run: kill "$(cat server.pid)" 2>/dev/null || true
-
-      - name: Upload results
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: conformance-server-results
-          path: |
-            conformance-results
-            conformance-extension-results
-
-  client:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
-
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-
-      - name: Build conformance binaries
-        run: cargo build -p mcp-conformance
-
-      - name: Run 2025-11-25 client suite
-        run: |
-          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" client \
-            --command "$(pwd)/target/debug/conformance-client" \
-            --suite all \
-            --spec-version 2025-11-25 \
-            -o conformance-client-results/2025-11-25
-
-      - name: Run 2026-07-28 client suite
-        run: |
-          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" client \
-            --command "$(pwd)/target/debug/conformance-client" \
-            --suite all \
-            --spec-version 2026-07-28 \
-            -o conformance-client-results/2026-07-28
-
-      - name: Run extension client suite (informational)
-        run: |
-          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" client \
-            --command "$(pwd)/target/debug/conformance-client" \
-            --suite extensions \
-            --expected-failures conformance/expected-failures-extensions.yaml \
-            -o conformance-client-results/extensions
-
-      - name: Upload results
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: conformance-client-results
-          path: conformance-client-results

.github/workflows/release-plz.yml

@@ -1,6 +1,8 @@
 name: Release-plz
 
-permissions: {}
+permissions:
+  pull-requests: write
+  contents: write
 
 on:
   push:
@@ -16,24 +18,18 @@ jobs:
     if: ${{ github.repository_owner == 'modelcontextprotocol' }}
     permissions:
       contents: write
-      pull-requests: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        uses: dtolnay/rust-toolchain@stable
+      - name: Run release-plz
+        uses: release-plz/action@v0.5
         with:
-          toolchain: "1.92"
-      # Using fork until semver_check_features support is released upstream.
-      # See: https://github.com/release-plz/release-plz/pull/2757
-      - name: Install release-plz from fork
-        run: cargo install --locked --git https://github.com/DaleSeo/release-plz --rev c2ea743bacf9bbd56e344df68219e60b0ad35d04 release-plz
-      - name: Run release-plz release
-        run: release-plz release
+          command: release
         env:
-          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
@@ -50,20 +46,15 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        uses: dtolnay/rust-toolchain@stable
+      - name: Run release-plz
+        uses: release-plz/action@v0.5
         with:
-          toolchain: "1.92"
-      # Using fork until semver_check_features support is released upstream.
-      # See: https://github.com/release-plz/release-plz/pull/2757
-      - name: Install release-plz from fork
-        run: cargo install --locked --git https://github.com/DaleSeo/release-plz --rev c2ea743bacf9bbd56e344df68219e60b0ad35d04 release-plz
-      - name: Run release-plz release-pr
-        run: release-plz release-pr
+          command: release-pr
         env:
-          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/scorecard.yml

@@ -1,48 +0,0 @@
-# OpenSSF Scorecard supply-chain security analysis.
-name: Scorecard supply-chain security
-
-on:
-  branch_protection_rule:
-  schedule:
-    - cron: '5 23 * * 5'
-  push:
-    branches: [main]
-  pull_request:
-  workflow_dispatch:
-
-permissions: read-all
-
-jobs:
-  analysis:
-    name: Scorecard analysis
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      id-token: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          # Publishing only succeeds on the default branch. PR and manual runs
-          # still validate the analysis and produce SARIF without publishing.
-          publish_results: ${{ github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
-
-      - name: Upload SARIF artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: scorecard-results
-          path: results.sarif
-          retention-days: 5
-
-      - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
-        with:
-          sarif_file: results.sarif

.github/workflows/stale.yml

@@ -1,38 +0,0 @@
-name: Clean Up Stale PRs and Issues
-on:
-  schedule:
-    - cron: "0 0 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  stale:
-    name: Clean Up
-    runs-on: ubuntu-24.04
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11
-        with:
-          days-before-stale: 60
-          days-before-close: 14
-          exempt-issue-labels: keep,security,pinned
-          exempt-pr-labels: keep,security,pinned
-          exempt-draft-pr: true
-          stale-issue-message: >
-            This issue has had no activity for 60 days and is now marked as stale.
-            It will be closed in 14 days if there is no further activity. Add the
-            `keep` label to keep it open.
-          close-issue-message: >
-            Closing this issue after 14 days of inactivity since it was marked stale.
-            Feel free to reopen if it is still relevant.
-          stale-pr-message: >
-            This pull request has had no activity for 60 days and is now marked as stale.
-            It will be closed in 14 days if there is no further activity. Add the
-            `keep` label to keep it open.
-          close-pr-message: >
-            Closing this pull request after 14 days of inactivity since it was marked stale.
-            Feel free to reopen if you plan to continue the work.

.github/workflows/triage.yml

@@ -1,75 +0,0 @@
-name: Auto Triage Issues
-
-on:
-  # Triage newly opened or reopened issues immediately
-  issues:
-    types: [opened, reopened]
-
-  # Daily sweep to catch anything missed (e.g., label removals, edits)
-  schedule:
-    - cron: "0 9 * * *" # 9:00 UTC daily
-
-  # Allow manual runs from the Actions tab
-  workflow_dispatch:
-    inputs:
-      issue_number:
-        description: "Triage a specific issue number (leave empty for all untriaged)"
-        required: false
-        type: string
-      dry_run:
-        description: "Dry-run mode (preview only, don't apply labels)"
-        required: false
-        type: boolean
-        default: false
-
-permissions:
-  issues: write
-
-jobs:
-  triage:
-    name: Triage Issues
-    # TODO: Re-enable once OPENAI_API_KEY secret is available
-    if: false
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-      TRIAGE_MODEL: ${{ vars.TRIAGE_MODEL || 'gpt-4o-mini' }}
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Install jq
-        run: sudo apt-get install -y jq
-
-      - name: Triage single issue (on issue event)
-        if: github.event_name == 'issues'
-        run: |
-          ./scripts/triage-new-issues.sh \
-            --issue ${{ github.event.issue.number }} \
-            --apply
-
-      - name: Triage specific issue (manual dispatch)
-        if: >-
-          github.event_name == 'workflow_dispatch'
-          && github.event.inputs.issue_number != ''
-        run: |
-          ARGS=(--issue ${{ github.event.inputs.issue_number }})
-          if [[ "${{ github.event.inputs.dry_run }}" != "true" ]]; then
-            ARGS+=(--apply)
-          fi
-          ./scripts/triage-new-issues.sh "${ARGS[@]}"
-
-      - name: Triage all untriaged issues (schedule or manual sweep)
-        if: >-
-          github.event_name == 'schedule'
-          || (github.event_name == 'workflow_dispatch'
-              && github.event.inputs.issue_number == '')
-        run: |
-          ARGS=()
-          if [[ "${{ github.event.inputs.dry_run }}" != "true" ]]; then
-            ARGS+=(--apply)
-          fi
-          ./scripts/triage-new-issues.sh "${ARGS[@]}"

.gitignore

@@ -27,5 +27,3 @@ __pycache__/
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
-node_modules/
-.DS_Store

Cargo.toml

@@ -1,16 +1,15 @@
 [workspace]
-members = ["crates/rmcp", "crates/rmcp-macros", "examples/*", "conformance"]
+members = ["crates/rmcp", "crates/rmcp-macros", "examples/*"]
 default-members = ["crates/rmcp", "crates/rmcp-macros"]
 resolver = "2"
 
 [workspace.dependencies]
-rmcp = { version = "3.4.0", path = "./crates/rmcp" }
-rmcp-macros = { version = "3.4.0", path = "./crates/rmcp-macros" }
+rmcp = { version = "0.13.0", path = "./crates/rmcp" }
+rmcp-macros = { version = "0.13.0", path = "./crates/rmcp-macros" }
 
 [workspace.package]
 edition = "2024"
-rust-version = "1.88"
-version = "3.4.0"
+version = "0.13.0"
 authors = ["4t145 <u4t145@163.com>"]
 license = "Apache-2.0"
 repository = "https://github.com/modelcontextprotocol/rust-sdk/"

DEPENDENCY_POLICY.md

@@ -1,65 +0,0 @@
-# Dependency Policy
-
-This document describes how the Rust MCP SDK (`rmcp`, `rmcp-macros`) selects,
-updates, and maintains its dependencies. It applies to all crates in the workspace.
-
-## Goals
-
-- Keep dependencies current and secure without churn that destabilizes the public API.
-- Minimize the dependency footprint we impose on downstream users.
-- Make dependency updates reviewable and traceable.
-
-## Choosing dependencies
-
-Before adding a new dependency we consider:
-
-- **Necessity** — whether the functionality is worth an added dependency, or is small
-  enough to implement directly.
-- **Maintenance & trust** — active maintenance, a healthy release history, and a
-  permissive, compatible license (the workspace is `Apache-2.0`).
-- **Footprint** — transitive dependency count and compile-time cost.
-- **Optionality** — anything not needed by every user should sit behind a Cargo
-  feature so downstream builds stay lean. The SDK is heavily feature-gated for this
-  reason (transports, `auth`, `schemars`, `reqwest`, etc.).
-
-Version requirements are specified with caret (`^`, the Cargo default) constraints so
-compatible upgrades are picked up automatically.
-
-## Automated updates
-
-Dependency updates are automated with [Dependabot](https://docs.github.com/en/code-security/dependabot),
-configured in [`.github/dependabot.yml`](.github/dependabot.yml):
-
-| Ecosystem      | Cadence | PR label          |
-| -------------- | ------- | ----------------- |
-| Cargo crates   | Weekly  | `T-dependencies`  |
-| GitHub Actions | Daily   | `T-CI`            |
-
-Dependabot opens a limited number of PRs at a time (currently 3 per ecosystem) to
-keep the review queue manageable. Update PRs run the full CI suite (build, format,
-clippy, tests, and conformance) and must be green before merge.
-
-## Review and merge
-
-- Patch and minor updates that pass CI are reviewed and merged promptly by maintainers.
-- Major (breaking) updates are evaluated individually; they may require code changes
-  and are scheduled deliberately rather than merged automatically.
-- Any dependency change that affects the **public API** (for example a type re-exported
-  from a dependency) is treated as a potential breaking change and follows
-  [`VERSIONING.md`](VERSIONING.md).
-
-## Security updates
-
-- Security fixes take priority over routine updates and are expedited.
-- Vulnerabilities in the SDK itself are handled per [`SECURITY.md`](SECURITY.md) via
-  GitHub's private Security Advisory process.
-- Advisories affecting our dependencies (e.g. via the [RustSec Advisory Database](https://rustsec.org/))
-  are addressed as soon as a fixed version is available; if a released version of the
-  SDK is impacted, a patched release is published and, where warranted, the affected
-  versions are yanked from crates.io.
-
-## Minimum Supported Rust Version
-
-Dependency upgrades must not raise the SDK's declared MSRV (`rust-version` in
-`Cargo.toml`) without an explicit, documented MSRV bump — which is itself treated as a
-breaking change per [`VERSIONING.md`](VERSIONING.md).

ROADMAP.md

@@ -1,112 +0,0 @@
-# RMCP Roadmap
-
-This roadmap tracks the path to [SEP-1730](https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1730) Tier 1 for the Rust MCP SDK.
-
-**Status: all SEP-1730 Tier 1 requirements are met.** Conformance is
-100% across every date-versioned suite, a stable ≥1.0.0 release has shipped
-([Releases](https://github.com/modelcontextprotocol/rust-sdk/releases)),
-issue triage and critical-bug (P0) resolution are within the Tier 1 SLAs, the
-governance documents (`VERSIONING.md`, `DEPENDENCY_POLICY.md`, this `ROADMAP.md`) are
-published, and all 48 non-experimental features are documented with examples. This
-document now serves as the ongoing tracker for spec conformance and SDK health.
-
-| SEP-1730 Tier 1 requirement                         | Status | Evidence |
-| --------------------------------------------------- | ------ | -------- |
-| Server conformance 100% (date-versioned)            | ✅     | 30/30 — see below |
-| Client conformance 100% (date-versioned)            | ✅     | 39/39 scored — see below |
-| Issue triage ≥90% within 2 business days            | ✅     | 95.2% (20/21) |
-| All P0 bugs resolved within 7 days                  | ✅     | 0 open; last P0 (#741) resolved in 3 days |
-| Stable release ≥1.0.0 (no pre-release suffix)       | ✅     | [latest release](https://github.com/modelcontextprotocol/rust-sdk/releases/latest) (see tooling note below) |
-| Clear versioning + breaking-change policy           | ✅     | [`VERSIONING.md`](VERSIONING.md) |
-| All non-experimental features documented w/ examples| ✅     | 48/48 in [`README.md`](README.md) |
-| Published dependency update policy                  | ✅     | [`DEPENDENCY_POLICY.md`](DEPENDENCY_POLICY.md) + [`.github/dependabot.yml`](.github/dependabot.yml) |
-| Published roadmap tracking spec components          | ✅     | this document |
-
-| Suite (date-versioned) | Server        | Client        |
-| ---------------------- | ------------- | ------------- |
-| 2025-11-25             | 100% (30/30)  | 100%          |
-| 2026-07-28             | 100% (30/30)  | 100%          |
-
-Only date-versioned scenarios count toward SDK tiering. `draft` (2026-07-28 draft)
-and `extension` scenarios are informational and reported separately below.
-
-> **Tooling note — `stable_release`:** the SEP-1730 `tier-check` CLI may report
-> `stable_release` as failing because it does not parse the workspace tag prefix
-> `rmcp-v` (as in `rmcp-vX.Y.Z`). The published releases are genuine stable,
-> non-pre-release versions ≥1.0.0
-> ([Releases](https://github.com/modelcontextprotocol/rust-sdk/releases)); the
-> flag is a tooling artifact, not an unmet requirement.
-
----
-
-## Conformance
-
-Per-scenario status for the current spec is tracked in the epic issue
-[#977 — Tracking: 2026-07-28 spec conformance](https://github.com/modelcontextprotocol/rust-sdk/issues/977),
-under the [`2026-07-28 spec` milestone](https://github.com/modelcontextprotocol/rust-sdk/milestone/3).
-
-CI (`.github/workflows/conformance.yml`) runs the full `2025-11-25` and `2026-07-28`
-server and client suites on every push and PR. Both suites are fully green.
-
-### Informational (not scored for tiering)
-
-Extension-tagged scenarios are excluded by `--spec-version` filters, so CI runs them
-in separate steps against `conformance/expected-failures-extensions.yaml`:
-
-| Scenario                                | Tag        | Status |
-| --------------------------------------- | ---------- | ------ |
-| `auth/client-credentials-basic`         | extension  | ✅ Pass |
-| `auth/client-credentials-jwt`           | extension  | ✅ Pass |
-| `auth/enterprise-managed-authorization` | extension  | ❌ Expected failure (not implemented by the conformance client) |
-| `auth/wif-jwt-bearer`                   | 2026-07-28 draft | ❌ Expected failure (WIF / SEP-1933, draft) |
-| `tasks-*` (SEP-2663)                    | extension  | ❌ 9 expected failures · ⏭️ 1 upstream-skipped |
-
-### Spec features without conformance scenarios
-
-Conformance does not cover the entire spec surface. Remaining feature work tracked via
-the milestone:
-
-- SEP-2567 sessionless MCP via explicit state handles (#870)
-- SEP-2260 server requests must associate with a client request (#873)
-- SEP-2549 follow-up: client-side TTL-honoring cache (#974)
-
----
-
-## Completed
-
-### Tier 1 requirements
-
-- [x] **v3.0.0 stable released** (2026-07-28) — MRTR, SEP-2549 cache hints, SEP-2243
-      standard headers, SEP-2575 stateless MCP, and SEP-2106 relaxations
-- [x] 2025-11-25 server conformance 100% (30/30)
-- [x] 2025-11-25 client conformance 100%
-- [x] 2026-07-28 server conformance 100% (30/30 dated)
-- [x] 2026-07-28 client conformance 100% (dated)
-- [x] Issue triage ≥90% within 2 business days (95.2%, 20/21) with the full SEP-1730
-      label taxonomy (bug, enhancement, question, needs confirmation, needs repro,
-      ready for work, good first issue, help wanted, P0–P3)
-- [x] All P0 bugs resolved within 7 days (0 open; #741 resolved in 3 days). #815 was
-      reclassified from `P0` to `T-security` — it was a CVE/advisory-coordination task
-      for an already-shipped fix (PR #764, released in v1.4.0), not a critical-bug fix
-- [x] `VERSIONING.md` — semver scheme, breaking-change definition, and communication policy
-- [x] `DEPENDENCY_POLICY.md` — published dependency update policy (with `.github/dependabot.yml`)
-- [x] `SECURITY.md` and Dependabot configuration
-- [x] All 48 non-experimental features documented with examples in the README
-      (closed the last 6 gaps on 2026-07-30: audio results, resource-template reading,
-      resource-argument completion, ping, and the legacy HTTP+SSE non-goal writeup)
-
-### Spec implementation
-
-- [x] SEP-2322 MRTR (server scenarios + `sep-2322-client-request-state`)
-- [x] SEP-2575 Make MCP Stateless (`server-stateless`)
-- [x] SEP-2164 resource not found
-- [x] SEP-2549 cache hints (`caching`)
-- [x] SEP-2243 HTTP standardization (`http-header-validation`, standard headers)
-- [x] DNS rebinding protection
-
----
-
-## Nice-to-have (scorecard hygiene, not required for Tier 1)
-
-- [ ] Add a top-level `CHANGELOG.md` (release notes are currently managed by release-plz).
-- [ ] Add a top-level `CONTRIBUTING.md` (contributor docs currently live at `docs/CONTRIBUTE.MD`).

SECURITY.md

@@ -1,21 +0,0 @@
-# Security Policy
-
-Thank you for helping keep the Model Context Protocol and its ecosystem secure.
-
-## Reporting Security Issues
-
-If you discover a security vulnerability in this repository, please report it through
-the [GitHub Security Advisory process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
-for this repository.
-
-Please **do not** report security vulnerabilities through public GitHub issues, discussions,
-or pull requests.
-
-## What to Include
-
-To help us triage and respond quickly, please include:
-
-- A description of the vulnerability
-- Steps to reproduce the issue
-- The potential impact
-- Any suggested fixes (optional)