chore(deps): update rstest requirement from 0.26.1 to 0.27.0 (#1276)

Updates the requirements on [rstest](https://github.com/la10736/rstest) to permit the latest version.
- [Release notes](https://github.com/la10736/rstest/releases)
- [Changelog](https://github.com/la10736/rstest/blob/master/CHANGELOG.md)
- [Commits](https://github.com/la10736/rstest/compare/v0.26.1...v0.27.0)

---
updated-dependencies:
- dependency-name: rstest
  dependency-version: 0.27.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.devcontainer/devcontainer.json

@@ -1,41 +1,41 @@
 // For format details, see https://aka.ms/devcontainer.json. For config options, see the
 // README at: https://github.com/devcontainers/templates/tree/main/src/rust
 {
-	"name": "Rust",
-	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
-	"image": "mcr.microsoft.com/devcontainers/rust:1-1-bullseye",
-	"features": {
-		"ghcr.io/devcontainers/features/node:1": {},
-		"ghcr.io/devcontainers/features/python:1": {
-			"version": "3.10",
-			"toolsToInstall": "uv"
-		}
-	},
-	// Configure tool-specific properties.
-	"customizations": {
-		"vscode": {
-			"settings": {
-				"editor.formatOnSave": true,
-				"[rust]": {
-					"editor.defaultFormatter": "rust-lang.rust-analyzer"
-				}
-			}
-		}
-	},
-	// Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "uv venv"
-	// Use 'mounts' to make the cargo cache persistent in a Docker Volume.
-	// "mounts": [
-	// 	{
-	// 		"source": "devcontainer-cargo-cache-${devcontainerId}",
-	// 		"target": "/usr/local/cargo",
-	// 		"type": "volume"
-	// 	}
-	// ]
-	// Features to add to the dev container. More info: https://containers.dev/features.
-	// "features": {},
-	// Use 'forwardPorts' to make a list of ports inside the container available locally.
-	// "forwardPorts": [],
-	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
-	// "remoteUser": "root"
+    "name": "Rust",
+    // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+    "image": "mcr.microsoft.com/devcontainers/rust:1-1-bullseye",
+    "features": {
+        "ghcr.io/devcontainers/features/node:1": {},
+        "ghcr.io/devcontainers/features/python:1": {
+            "version": "3.10",
+            "toolsToInstall": "uv"
+        }
+    },
+    // Configure tool-specific properties.
+    "customizations": {
+        "vscode": {
+            "settings": {
+                "editor.formatOnSave": true,
+                "[rust]": {
+                    "editor.defaultFormatter": "rust-lang.rust-analyzer"
+                }
+            }
+        }
+    },
+    // Use 'postCreateCommand' to run commands after the container is created.
+    "postCreateCommand": "uv venv && npm install -g @commitlint/config-conventional"
+    // Use 'mounts' to make the cargo cache persistent in a Docker Volume.
+    // "mounts": [
+    // 	{
+    // 		"source": "devcontainer-cargo-cache-${devcontainerId}",
+    // 		"target": "/usr/local/cargo",
+    // 		"type": "volume"
+    // 	}
+    // ]
+    // Features to add to the dev container. More info: https://containers.dev/features.
+    // "features": {},
+    // Use 'forwardPorts' to make a list of ports inside the container available locally.
+    // "forwardPorts": [],
+    // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+    // "remoteUser": "root"
 }

.githooks/pre-commit

@@ -0,0 +1,5 @@
+#!/bin/sh
+cargo +nightly fmt --all
+
+# stage any formatting changes
+git add -u

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @modelcontextprotocol/rust-sdk

.github/codeql/codeql-config.yml

@@ -0,0 +1,4 @@
+name: "CodeQL config"
+
+paths-ignore:
+  - conformance

.github/dependabot.yml

@@ -16,11 +16,15 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
     labels:
       # Mark PRs as CI related change.
       - T-CI
     open-pull-requests-limit: 3
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
     commit-message:
       prefix: "chore"
-      include: "scope"
+      include: "scope"

.github/instructions/fetch-mcp-doc.instructions.md

@@ -0,0 +1,74 @@
+---
+applyTo: '**'
+---
+
+When you need the information about the Model Context Protocol (MCP) specification, you can fetch the latest document from the official MCP website.
+
+# Overall
+#fetch https://modelcontextprotocol.io/specification/2025-06-18.md
+
+## Key Changes
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/changelog.md
+
+## Architecture
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/architecture.md
+
+# BaseProtocol
+## Overview
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/basic.md
+
+## Lifecycle
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle.md
+
+## Transports
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/basic/transports.md
+
+## Authorization
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization.md
+
+## Security Best Practices
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices.md
+
+## Utilities
+### Cancellation
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/cancellation.md
+
+### Ping
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/ping.md
+
+### Progress
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/progress.md
+
+# Client Features
+## Roots
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/client/roots.md
+
+## Sampling
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/client/sampling.md
+
+## Elicitation
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/client/elicitation.md
+
+# Server Features
+## Overview
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/server.md
+
+## Prompts
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/server/prompts.md
+
+## Resources
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/server/resources.md
+
+## Tools
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/server/tools.md
+
+## Utilities
+### Completion
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/completion.md
+### Logging
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging.md
+### Pagination
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/pagination.md
+
+# Schema Reference
+#fetch https://modelcontextprotocol.io/specification/2025-06-18/schema.md

.github/workflows/auto-label-pr.yml

@@ -3,6 +3,9 @@ on:
   # Runs workflow when activity on a PR in the workflow's repository occurs.
   pull_request_target:
 
+permissions:
+  contents: read
+
 jobs:
   auto-label:
     permissions:
@@ -20,7 +23,7 @@ jobs:
       PR_URL: ${{ github.event.pull_request.html_url }}
 
     steps:
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7
       with:
         # Auto-include paths starting with dot (e.g. .github)
         dot: true

.github/workflows/ci.yml

@@ -12,34 +12,35 @@ env:
   CARGO_TERM_COLOR: always
   ARTIFACT_DIR: release-artifacts
 
+permissions:
+  contents: read
+
 jobs:
   commit-lint:
     name: Lint Commit Messages
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: '20'
+          node-version: '22'
           
       - name: Install commitlint
-        run: |
-          npm install --save-dev @commitlint/cli @commitlint/config-conventional
-          echo "module.exports = {extends: ['@commitlint/config-conventional']}" > commitlint.config.js
-          
+        run: npm install --global @commitlint/cli@20.4.3 @commitlint/config-conventional@20.4.3
+
       - name: Lint commit messages
-        run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
+        run: commitlint --extends @commitlint/config-conventional --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
 
   fmt:
     name: Code Formatting
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust fmt
         run: rustup toolchain install nightly --component rustfmt
@@ -51,41 +52,209 @@ jobs:
     name: Lint with Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
-      - name: Run clippy
+      - name: Run clippy (all features)
         run: cargo clippy --all-targets --all-features -- -D warnings
-  
+
+      - name: Run clippy (all features except local)
+        run: |
+          FEATURES=$(cargo metadata --no-deps --format-version 1 \
+            | jq -r '[.packages[] | select(.name == "rmcp") | .features | keys[]
+                      | select(startswith("__") | not)
+                      | select(. != "local")] | join(",")')
+          cargo clippy --package rmcp --all-targets --no-default-features --features "$FEATURES" -- -D warnings
+
+  semver:
+    name: SemVer Check
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+
+      - name: Install cargo-semver-checks
+        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
+        with:
+          tool: cargo-semver-checks
+
+      - name: Determine semver release type
+        run: |
+          if git log --format=%B \
+            ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} \
+            | grep -Eq '(^[A-Za-z0-9_-]+(\([^)]*\))?!:|^BREAKING[ -]CHANGE:)'; then
+            echo "SEMVER_RELEASE_TYPE=major" >> "$GITHUB_ENV"
+          else
+            echo "SEMVER_RELEASE_TYPE=minor" >> "$GITHUB_ENV"
+          fi
+
+      - name: Check rmcp (default features)
+        run: |
+          cargo semver-checks \
+            --package rmcp \
+            --baseline-rev ${{ github.event.pull_request.base.sha }} \
+            --release-type "$SEMVER_RELEASE_TYPE" \
+            --only-explicit-features \
+            --features default
+
+      - name: Check rmcp (all features except local)
+        run: |
+          FEATURES=$(cargo metadata --no-deps --format-version 1 \
+            | jq -r '[.packages[] | select(.name == "rmcp") | .features | keys[]
+                      | select(startswith("__") | not)
+                      | select(. != "local")] | join(",")')
+          cargo semver-checks \
+            --package rmcp \
+            --baseline-rev ${{ github.event.pull_request.base.sha }} \
+            --release-type "$SEMVER_RELEASE_TYPE" \
+            --only-explicit-features \
+            --features "$FEATURES"
+
+  public-api:
+    name: Public API Check
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      # cargo-public-api builds rustdoc JSON, which requires a nightly toolchain
+      # to be installed (it does not need to be the default; the tool invokes it
+      # via `cargo +nightly`).
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@7c8d7d138f5c09cef361f8214cf96882cd029cdb # nightly
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+
+      - name: Install cargo-public-api
+        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
+        with:
+          tool: cargo-public-api
+
+      # Mirror the SemVer Check job's release-type detection: a breaking-change
+      # commit marker (`!:` or `BREAKING CHANGE:`) means a major release (any API
+      # change is allowed); otherwise a minor release (additions allowed, but
+      # changed/removed public items are denied). This catches breaking changes
+      # that cargo-semver-checks cannot yet detect, such as a change to a
+      # function's return type or a field's type.
+      # See https://github.com/obi1kenobi/cargo-semver-checks/issues/5
+      - name: Determine release type and deny flags
+        run: |
+          if git log --format=%B \
+            ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} \
+            | grep -Eq '(^[A-Za-z0-9_-]+(\([^)]*\))?!:|^BREAKING[ -]CHANGE:)'; then
+            SEMVER_RELEASE_TYPE=major
+          else
+            SEMVER_RELEASE_TYPE=minor
+          fi
+          case "$SEMVER_RELEASE_TYPE" in
+            major) DENY="" ;;
+            patch) DENY="--deny added --deny changed --deny removed" ;;
+            *)     DENY="--deny changed --deny removed" ;;
+          esac
+          echo "SEMVER_RELEASE_TYPE=$SEMVER_RELEASE_TYPE" >> "$GITHUB_ENV"
+          echo "DENY=$DENY" >> "$GITHUB_ENV"
+
+      - name: Check rmcp (default features)
+        run: |
+          cargo public-api \
+            --package rmcp \
+            -ss \
+            diff \
+            $DENY \
+            --force \
+            ${{ github.event.pull_request.base.sha }}..${{ github.sha }}
+
+      - name: Check rmcp (all features except local)
+        run: |
+          BASE_SHA=${{ github.event.pull_request.base.sha }}
+          # `cargo public-api diff` builds both revisions with the same feature
+          # set, so a feature that exists on only one side (e.g. a feature added
+          # or removed by this PR) would fail to build the other revision. Diff
+          # only the features present in BOTH the base and the head; features
+          # unique to one side are necessarily pure additions/removals, which the
+          # release-type deny flags already govern.
+          list_features() {
+            cargo metadata --no-deps --format-version 1 --manifest-path "$1/Cargo.toml" \
+              | jq -r '.packages[] | select(.name == "rmcp") | .features | keys[]
+                       | select(startswith("__") | not)
+                       | select(. != "local")'
+          }
+          list_features "." | sort -u > "$RUNNER_TEMP/head_features"
+          git worktree add --detach "$RUNNER_TEMP/rmcp-base" "$BASE_SHA"
+          list_features "$RUNNER_TEMP/rmcp-base" | sort -u > "$RUNNER_TEMP/base_features"
+          git worktree remove --force "$RUNNER_TEMP/rmcp-base"
+          FEATURES=$(comm -12 "$RUNNER_TEMP/head_features" "$RUNNER_TEMP/base_features" | paste -sd, -)
+          cargo public-api \
+            --package rmcp \
+            --features "$FEATURES" \
+            -ss \
+            diff \
+            $DENY \
+            --force \
+            "$BASE_SHA"..${{ github.sha }}
+
   spelling:
     name: spell check with typos
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Spell Check Repo
-      uses: crate-ci/typos@master
+      uses: crate-ci/typos@d43b6c087ac471e2ea7b8af622ff15f05c0c365b # master
+
+  msrv:
+    name: Check MSRV
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Read MSRV from Cargo.toml
+        run: |
+          MSRV=$(cargo metadata --no-deps --format-version 1 \
+            | jq -r '.packages[] | select(.name == "rmcp") | .rust_version')
+          echo "MSRV=$MSRV" >> "$GITHUB_ENV"
+
+      - name: Install MSRV Rust
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          toolchain: ${{ env.MSRV }}
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+
+      - name: Check default workspace members with MSRV
+        run: cargo +${{ env.MSRV }} check --all-targets --all-features
 
   test:
     name: Run Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       
       # install nodejs
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: '20'
+          node-version: '22'
           
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         
       - name: Set up Python
         run: uv python install
@@ -93,30 +262,64 @@ jobs:
       - name: Create venv for python
         run: uv venv
         
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
       - name: Run tests
         run: cargo test --all-features
-  
+
+  test-no-local:
+    name: Run Tests (no local feature)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # install nodejs
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '22'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+
+      - name: Set up Python
+        run: uv python install
+
+      - name: Create venv for python
+        run: uv venv
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+
+      - name: Run tests without local feature
+        run: |
+          FEATURES=$(cargo metadata --no-deps --format-version 1 \
+            | jq -r '[.packages[] | select(.name == "rmcp") | .features | keys[]
+                      | select(startswith("__") | not)
+                      | select(. != "local")] | join(",")')
+          cargo test -p rmcp --features "$FEATURES"
+
   coverage:
     name: Code Coverage
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # install nodejs
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: '20'
+          node-version: '22'
           
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         
       - name: Set up Python
         run: uv python install
@@ -124,7 +327,7 @@ jobs:
       - name: Create venv for python
         run: uv venv
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
       - name: Install cargo-llvm-cov
         run: cargo install cargo-llvm-cov
@@ -139,19 +342,19 @@ jobs:
     name: Example test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # install nodejs
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
 
       - name: Set up Python
         run: uv python install
@@ -159,7 +362,7 @@ jobs:
       - name: Create venv for python
         run: uv venv
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
       - name: Add target WASI preview 2
         run: |
@@ -186,7 +389,7 @@ jobs:
             if [ -f "$dir/Cargo.toml" ]; then
               if [[ "$dir" != *"wasi"* ]]; then
                 echo "Testing $dir"
-                cargo test --manifest-path "$dir/Cargo.toml" --all-features
+                cargo test --manifest-path "$dir/Cargo.toml" --all-features --all-targets
               fi
             fi
           done
@@ -195,12 +398,12 @@ jobs:
     name: Security Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
       - name: Install cargo-audit
         run: cargo install cargo-audit
@@ -212,19 +415,18 @@ jobs:
     name: Generate Documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@nightly
-
-      - uses: Swatinem/rust-cache@v2
+        uses: dtolnay/rust-toolchain@7c8d7d138f5c09cef361f8214cf96882cd029cdb # nightly
+        
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
       - name: Generate documentation
         run: |
           cargo +nightly doc --no-deps -p rmcp -p rmcp-macros --all-features
         env:
-          RUSTDOCFLAGS: --cfg docsrs -Dwarnings
-          RUSTFLAGS: --cfg docsrs 
+          RUSTDOCFLAGS: --cfg docsrs -Dwarnings 
 
   release:
     name: Release crates
@@ -239,7 +441,7 @@ jobs:
       # This happened recently in the attack on `tj-actions/changed-files`, but
       # has happened many times before as well.
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Update Rust
         run: | 

.github/workflows/codeql.yml

@@ -0,0 +1,39 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * 1' # Weekly on Monday
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [rust, javascript-typescript, python, actions]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        with:
+          languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0

.github/workflows/conformance.yml

@@ -0,0 +1,149 @@
+name: Conformance
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: conformance-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CONFORMANCE_VERSION: "0.2.0-alpha.10"
+
+permissions:
+  contents: read
+
+jobs:
+  server:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+
+      - name: Build conformance binaries
+        run: cargo build -p mcp-conformance
+
+      - name: Test conformance server
+        run: cargo test -p mcp-conformance --bin conformance-server
+
+      - name: Start conformance server
+        run: |
+          PORT=8001 ./target/debug/conformance-server &
+          echo $! > server.pid
+          for _ in $(seq 1 30); do
+            if curl -s -o /dev/null http://127.0.0.1:8001/mcp; then
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "conformance server did not become ready" >&2
+          exit 1
+
+      - name: Run 2025-11-25 server suite
+        run: |
+          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" server \
+            --url http://127.0.0.1:8001/mcp \
+            --suite all \
+            --spec-version 2025-11-25 \
+            -o conformance-results/2025-11-25
+
+      - name: Run 2026-07-28 server suite
+        run: |
+          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" server \
+            --url http://127.0.0.1:8001/mcp \
+            --suite all \
+            --spec-version 2026-07-28 \
+            -o conformance-results/2026-07-28
+
+      - name: Run extension server scenarios (informational)
+        run: |
+          scenarios=(
+            tasks-lifecycle
+            tasks-capability-negotiation
+            tasks-wire-fields
+            tasks-request-state-removal
+            tasks-mrtr-input
+            tasks-request-headers
+            tasks-dispatch-and-envelope
+            tasks-status-notifications
+            tasks-required-task-error
+            tasks-mrtr-composition
+          )
+          for scenario in "${scenarios[@]}"; do
+            npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" server \
+              --url http://127.0.0.1:8001/mcp \
+              --scenario "$scenario" \
+              --expected-failures conformance/expected-failures-extensions.yaml \
+              -o conformance-extension-results
+          done
+
+      - name: Stop conformance server
+        if: always()
+        run: kill "$(cat server.pid)" 2>/dev/null || true
+
+      - name: Upload results
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: conformance-server-results
+          path: |
+            conformance-results
+            conformance-extension-results
+
+  client:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+
+      - name: Build conformance binaries
+        run: cargo build -p mcp-conformance
+
+      - name: Run 2025-11-25 client suite
+        run: |
+          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" client \
+            --command "$(pwd)/target/debug/conformance-client" \
+            --suite all \
+            --spec-version 2025-11-25 \
+            -o conformance-client-results/2025-11-25
+
+      - name: Run 2026-07-28 client suite
+        run: |
+          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" client \
+            --command "$(pwd)/target/debug/conformance-client" \
+            --suite all \
+            --spec-version 2026-07-28 \
+            -o conformance-client-results/2026-07-28
+
+      - name: Run extension client suite (informational)
+        run: |
+          npx -y "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" client \
+            --command "$(pwd)/target/debug/conformance-client" \
+            --suite extensions \
+            --expected-failures conformance/expected-failures-extensions.yaml \
+            -o conformance-client-results/extensions
+
+      - name: Upload results
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: conformance-client-results
+          path: conformance-client-results

.github/workflows/release-plz.yml

@@ -1,8 +1,6 @@
 name: Release-plz
 
-permissions:
-  pull-requests: write
-  contents: write
+permissions: {}
 
 on:
   push:
@@ -18,18 +16,24 @@ jobs:
     if: ${{ github.repository_owner == 'modelcontextprotocol' }}
     permissions:
       contents: write
+      pull-requests: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-      - name: Run release-plz
-        uses: release-plz/action@v0.5
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
-          command: release
+          toolchain: "1.92"
+      # Using fork until semver_check_features support is released upstream.
+      # See: https://github.com/release-plz/release-plz/pull/2757
+      - name: Install release-plz from fork
+        run: cargo install --locked --git https://github.com/DaleSeo/release-plz --rev c2ea743bacf9bbd56e344df68219e60b0ad35d04 release-plz
+      - name: Run release-plz release
+        run: release-plz release
         env:
+          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
@@ -46,15 +50,20 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-      - name: Run release-plz
-        uses: release-plz/action@v0.5
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
-          command: release-pr
+          toolchain: "1.92"
+      # Using fork until semver_check_features support is released upstream.
+      # See: https://github.com/release-plz/release-plz/pull/2757
+      - name: Install release-plz from fork
+        run: cargo install --locked --git https://github.com/DaleSeo/release-plz --rev c2ea743bacf9bbd56e344df68219e60b0ad35d04 release-plz
+      - name: Run release-plz release-pr
+        run: release-plz release-pr
         env:
+          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/scorecard.yml

@@ -0,0 +1,48 @@
+# OpenSSF Scorecard supply-chain security analysis.
+name: Scorecard supply-chain security
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '5 23 * * 5'
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # Publishing only succeeds on the default branch. PR and manual runs
+          # still validate the analysis and produce SARIF without publishing.
+          publish_results: ${{ github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+
+      - name: Upload SARIF artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code scanning
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        with:
+          sarif_file: results.sarif

.github/workflows/stale.yml

@@ -0,0 +1,38 @@
+name: Clean Up Stale PRs and Issues
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    name: Clean Up
+    runs-on: ubuntu-24.04
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11
+        with:
+          days-before-stale: 60
+          days-before-close: 14
+          exempt-issue-labels: keep,security,pinned
+          exempt-pr-labels: keep,security,pinned
+          exempt-draft-pr: true
+          stale-issue-message: >
+            This issue has had no activity for 60 days and is now marked as stale.
+            It will be closed in 14 days if there is no further activity. Add the
+            `keep` label to keep it open.
+          close-issue-message: >
+            Closing this issue after 14 days of inactivity since it was marked stale.
+            Feel free to reopen if it is still relevant.
+          stale-pr-message: >
+            This pull request has had no activity for 60 days and is now marked as stale.
+            It will be closed in 14 days if there is no further activity. Add the
+            `keep` label to keep it open.
+          close-pr-message: >
+            Closing this pull request after 14 days of inactivity since it was marked stale.
+            Feel free to reopen if you plan to continue the work.

.github/workflows/triage.yml

@@ -0,0 +1,75 @@
+name: Auto Triage Issues
+
+on:
+  # Triage newly opened or reopened issues immediately
+  issues:
+    types: [opened, reopened]
+
+  # Daily sweep to catch anything missed (e.g., label removals, edits)
+  schedule:
+    - cron: "0 9 * * *" # 9:00 UTC daily
+
+  # Allow manual runs from the Actions tab
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: "Triage a specific issue number (leave empty for all untriaged)"
+        required: false
+        type: string
+      dry_run:
+        description: "Dry-run mode (preview only, don't apply labels)"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  issues: write
+
+jobs:
+  triage:
+    name: Triage Issues
+    # TODO: Re-enable once OPENAI_API_KEY secret is available
+    if: false
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      TRIAGE_MODEL: ${{ vars.TRIAGE_MODEL || 'gpt-4o-mini' }}
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install jq
+        run: sudo apt-get install -y jq
+
+      - name: Triage single issue (on issue event)
+        if: github.event_name == 'issues'
+        run: |
+          ./scripts/triage-new-issues.sh \
+            --issue ${{ github.event.issue.number }} \
+            --apply
+
+      - name: Triage specific issue (manual dispatch)
+        if: >-
+          github.event_name == 'workflow_dispatch'
+          && github.event.inputs.issue_number != ''
+        run: |
+          ARGS=(--issue ${{ github.event.inputs.issue_number }})
+          if [[ "${{ github.event.inputs.dry_run }}" != "true" ]]; then
+            ARGS+=(--apply)
+          fi
+          ./scripts/triage-new-issues.sh "${ARGS[@]}"
+
+      - name: Triage all untriaged issues (schedule or manual sweep)
+        if: >-
+          github.event_name == 'schedule'
+          || (github.event_name == 'workflow_dispatch'
+              && github.event.inputs.issue_number == '')
+        run: |
+          ARGS=()
+          if [[ "${{ github.event.inputs.dry_run }}" != "true" ]]; then
+            ARGS+=(--apply)
+          fi
+          ./scripts/triage-new-issues.sh "${ARGS[@]}"

.gitignore

@@ -13,9 +13,19 @@ Cargo.lock
 # MSVC Windows builds of rustc generate these, which store debugging information
 *.pdb
 .vscode/
+.idea
+
+# Python artifacts (for test directories)
+*.egg-info/
+__pycache__/
+*.pyc
+*.pyo
+
 # RustRover
 #  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
 #  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
-#.idea/
+#.idea/
+node_modules/
+.DS_Store

Cargo.toml

@@ -1,18 +1,18 @@
-
-
 [workspace]
-members = ["crates/rmcp", "crates/rmcp-macros", "examples/*"]
+members = ["crates/rmcp", "crates/rmcp-macros", "examples/*", "conformance"]
+default-members = ["crates/rmcp", "crates/rmcp-macros"]
 resolver = "2"
 
 [workspace.dependencies]
-rmcp = { version = "0.2.0", path = "./crates/rmcp" }
-rmcp-macros = { version = "0.2.0", path = "./crates/rmcp-macros" }
+rmcp = { version = "3.4.0", path = "./crates/rmcp" }
+rmcp-macros = { version = "3.4.0", path = "./crates/rmcp-macros" }
 
 [workspace.package]
 edition = "2024"
-version = "0.2.0"
+rust-version = "1.88"
+version = "3.4.0"
 authors = ["4t145 <u4t145@163.com>"]
-license = "MIT/Apache-2.0"
+license = "Apache-2.0"
 repository = "https://github.com/modelcontextprotocol/rust-sdk/"
 description = "Rust SDK for Model Context Protocol"
 keywords = ["mcp", "sdk", "tokio", "modelcontextprotocol"]

DEPENDENCY_POLICY.md

@@ -0,0 +1,65 @@
+# Dependency Policy
+
+This document describes how the Rust MCP SDK (`rmcp`, `rmcp-macros`) selects,
+updates, and maintains its dependencies. It applies to all crates in the workspace.
+
+## Goals
+
+- Keep dependencies current and secure without churn that destabilizes the public API.
+- Minimize the dependency footprint we impose on downstream users.
+- Make dependency updates reviewable and traceable.
+
+## Choosing dependencies
+
+Before adding a new dependency we consider:
+
+- **Necessity** — whether the functionality is worth an added dependency, or is small
+  enough to implement directly.
+- **Maintenance & trust** — active maintenance, a healthy release history, and a
+  permissive, compatible license (the workspace is `Apache-2.0`).
+- **Footprint** — transitive dependency count and compile-time cost.
+- **Optionality** — anything not needed by every user should sit behind a Cargo
+  feature so downstream builds stay lean. The SDK is heavily feature-gated for this
+  reason (transports, `auth`, `schemars`, `reqwest`, etc.).
+
+Version requirements are specified with caret (`^`, the Cargo default) constraints so
+compatible upgrades are picked up automatically.
+
+## Automated updates
+
+Dependency updates are automated with [Dependabot](https://docs.github.com/en/code-security/dependabot),
+configured in [`.github/dependabot.yml`](.github/dependabot.yml):
+
+| Ecosystem      | Cadence | PR label          |
+| -------------- | ------- | ----------------- |
+| Cargo crates   | Weekly  | `T-dependencies`  |
+| GitHub Actions | Daily   | `T-CI`            |
+
+Dependabot opens a limited number of PRs at a time (currently 3 per ecosystem) to
+keep the review queue manageable. Update PRs run the full CI suite (build, format,
+clippy, tests, and conformance) and must be green before merge.
+
+## Review and merge
+
+- Patch and minor updates that pass CI are reviewed and merged promptly by maintainers.
+- Major (breaking) updates are evaluated individually; they may require code changes
+  and are scheduled deliberately rather than merged automatically.
+- Any dependency change that affects the **public API** (for example a type re-exported
+  from a dependency) is treated as a potential breaking change and follows
+  [`VERSIONING.md`](VERSIONING.md).
+
+## Security updates
+
+- Security fixes take priority over routine updates and are expedited.
+- Vulnerabilities in the SDK itself are handled per [`SECURITY.md`](SECURITY.md) via
+  GitHub's private Security Advisory process.
+- Advisories affecting our dependencies (e.g. via the [RustSec Advisory Database](https://rustsec.org/))
+  are addressed as soon as a fixed version is available; if a released version of the
+  SDK is impacted, a patched release is published and, where warranted, the affected
+  versions are yanked from crates.io.
+
+## Minimum Supported Rust Version
+
+Dependency upgrades must not raise the SDK's declared MSRV (`rust-version` in
+`Cargo.toml`) without an explicit, documented MSRV bump — which is itself treated as a
+breaking change per [`VERSIONING.md`](VERSIONING.md).

LICENSE

@@ -1,6 +1,193 @@
+The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
+
+Contributions for which relicensing consent has been obtained are licensed under Apache-2.0. Contributions made by authors who originally licensed their work under the MIT License and who have not yet granted explicit permission to relicense remain licensed under the MIT License.
+
+No rights beyond those granted by the applicable original license are conveyed for such contributions.
+
+---
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright
+      owner or by an individual or Legal Entity authorized to submit on behalf
+      of the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+---
+
 MIT License
 
-Copyright (c) 2025 Model Context Protocol
+Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -19,3 +206,11 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+---
+
+Creative Commons Attribution 4.0 International (CC-BY-4.0)
+
+Documentation in this project (excluding specifications) is licensed under
+CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
+the full license text.

ROADMAP.md

@@ -0,0 +1,112 @@
+# RMCP Roadmap
+
+This roadmap tracks the path to [SEP-1730](https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1730) Tier 1 for the Rust MCP SDK.
+
+**Status: all SEP-1730 Tier 1 requirements are met.** Conformance is
+100% across every date-versioned suite, a stable ≥1.0.0 release has shipped
+([Releases](https://github.com/modelcontextprotocol/rust-sdk/releases)),
+issue triage and critical-bug (P0) resolution are within the Tier 1 SLAs, the
+governance documents (`VERSIONING.md`, `DEPENDENCY_POLICY.md`, this `ROADMAP.md`) are
+published, and all 48 non-experimental features are documented with examples. This
+document now serves as the ongoing tracker for spec conformance and SDK health.
+
+| SEP-1730 Tier 1 requirement                         | Status | Evidence |
+| --------------------------------------------------- | ------ | -------- |
+| Server conformance 100% (date-versioned)            | ✅     | 30/30 — see below |
+| Client conformance 100% (date-versioned)            | ✅     | 39/39 scored — see below |
+| Issue triage ≥90% within 2 business days            | ✅     | 95.2% (20/21) |
+| All P0 bugs resolved within 7 days                  | ✅     | 0 open; last P0 (#741) resolved in 3 days |
+| Stable release ≥1.0.0 (no pre-release suffix)       | ✅     | [latest release](https://github.com/modelcontextprotocol/rust-sdk/releases/latest) (see tooling note below) |
+| Clear versioning + breaking-change policy           | ✅     | [`VERSIONING.md`](VERSIONING.md) |
+| All non-experimental features documented w/ examples| ✅     | 48/48 in [`README.md`](README.md) |
+| Published dependency update policy                  | ✅     | [`DEPENDENCY_POLICY.md`](DEPENDENCY_POLICY.md) + [`.github/dependabot.yml`](.github/dependabot.yml) |
+| Published roadmap tracking spec components          | ✅     | this document |
+
+| Suite (date-versioned) | Server        | Client        |
+| ---------------------- | ------------- | ------------- |
+| 2025-11-25             | 100% (30/30)  | 100%          |
+| 2026-07-28             | 100% (30/30)  | 100%          |
+
+Only date-versioned scenarios count toward SDK tiering. `draft` (2026-07-28 draft)
+and `extension` scenarios are informational and reported separately below.
+
+> **Tooling note — `stable_release`:** the SEP-1730 `tier-check` CLI may report
+> `stable_release` as failing because it does not parse the workspace tag prefix
+> `rmcp-v` (as in `rmcp-vX.Y.Z`). The published releases are genuine stable,
+> non-pre-release versions ≥1.0.0
+> ([Releases](https://github.com/modelcontextprotocol/rust-sdk/releases)); the
+> flag is a tooling artifact, not an unmet requirement.
+
+---
+
+## Conformance
+
+Per-scenario status for the current spec is tracked in the epic issue
+[#977 — Tracking: 2026-07-28 spec conformance](https://github.com/modelcontextprotocol/rust-sdk/issues/977),
+under the [`2026-07-28 spec` milestone](https://github.com/modelcontextprotocol/rust-sdk/milestone/3).
+
+CI (`.github/workflows/conformance.yml`) runs the full `2025-11-25` and `2026-07-28`
+server and client suites on every push and PR. Both suites are fully green.
+
+### Informational (not scored for tiering)
+
+Extension-tagged scenarios are excluded by `--spec-version` filters, so CI runs them
+in separate steps against `conformance/expected-failures-extensions.yaml`:
+
+| Scenario                                | Tag        | Status |
+| --------------------------------------- | ---------- | ------ |
+| `auth/client-credentials-basic`         | extension  | ✅ Pass |
+| `auth/client-credentials-jwt`           | extension  | ✅ Pass |
+| `auth/enterprise-managed-authorization` | extension  | ❌ Expected failure (not implemented by the conformance client) |
+| `auth/wif-jwt-bearer`                   | 2026-07-28 draft | ❌ Expected failure (WIF / SEP-1933, draft) |
+| `tasks-*` (SEP-2663)                    | extension  | ❌ 9 expected failures · ⏭️ 1 upstream-skipped |
+
+### Spec features without conformance scenarios
+
+Conformance does not cover the entire spec surface. Remaining feature work tracked via
+the milestone:
+
+- SEP-2567 sessionless MCP via explicit state handles (#870)
+- SEP-2260 server requests must associate with a client request (#873)
+- SEP-2549 follow-up: client-side TTL-honoring cache (#974)
+
+---
+
+## Completed
+
+### Tier 1 requirements
+
+- [x] **v3.0.0 stable released** (2026-07-28) — MRTR, SEP-2549 cache hints, SEP-2243
+      standard headers, SEP-2575 stateless MCP, and SEP-2106 relaxations
+- [x] 2025-11-25 server conformance 100% (30/30)
+- [x] 2025-11-25 client conformance 100%
+- [x] 2026-07-28 server conformance 100% (30/30 dated)
+- [x] 2026-07-28 client conformance 100% (dated)
+- [x] Issue triage ≥90% within 2 business days (95.2%, 20/21) with the full SEP-1730
+      label taxonomy (bug, enhancement, question, needs confirmation, needs repro,
+      ready for work, good first issue, help wanted, P0–P3)
+- [x] All P0 bugs resolved within 7 days (0 open; #741 resolved in 3 days). #815 was
+      reclassified from `P0` to `T-security` — it was a CVE/advisory-coordination task
+      for an already-shipped fix (PR #764, released in v1.4.0), not a critical-bug fix
+- [x] `VERSIONING.md` — semver scheme, breaking-change definition, and communication policy
+- [x] `DEPENDENCY_POLICY.md` — published dependency update policy (with `.github/dependabot.yml`)
+- [x] `SECURITY.md` and Dependabot configuration
+- [x] All 48 non-experimental features documented with examples in the README
+      (closed the last 6 gaps on 2026-07-30: audio results, resource-template reading,
+      resource-argument completion, ping, and the legacy HTTP+SSE non-goal writeup)
+
+### Spec implementation
+
+- [x] SEP-2322 MRTR (server scenarios + `sep-2322-client-request-state`)
+- [x] SEP-2575 Make MCP Stateless (`server-stateless`)
+- [x] SEP-2164 resource not found
+- [x] SEP-2549 cache hints (`caching`)
+- [x] SEP-2243 HTTP standardization (`http-header-validation`, standard headers)
+- [x] DNS rebinding protection
+
+---
+
+## Nice-to-have (scorecard hygiene, not required for Tier 1)
+
+- [ ] Add a top-level `CHANGELOG.md` (release notes are currently managed by release-plz).
+- [ ] Add a top-level `CONTRIBUTING.md` (contributor docs currently live at `docs/CONTRIBUTE.MD`).