Sourced from io.modelcontextprotocol:kotlin-sdk-client's releases.

0.13.0

Description

Adds a tasks capability and a typed elicitation capability, hardens transport lifecycle, dispatchers, and back-pressure, and enables DNS rebinding protection by default.

Breaking Changes

Typed elicitation capability and new tasks capability by @​devcrocod in #732

ClientCapabilities.elicitation is now a typed ClientCapabilities.Elicitation (form, url) instead of a raw JsonObject?, and both ClientCapabilities and ServerCapabilities gained a typed tasks capability. The constructors of both types changed and are binary-incompatible; recompilation is required.

Transport handlers now run on Dispatchers.Default by @​devcrocod in #778

Handlers moved from Dispatchers.IO to Dispatchers.Default (override via handlerDispatcher), send() now suspends under back-pressure instead of buffering unbounded, and the two-argument StdioServerTransport(input, output) constructor is deprecated in favor of the builder-lambda form. Also fixes a start()/close() race, consistent CancellationException propagation, and an input-Source leak (closes #573, #574, #708).

DNS rebinding protection enabled by default by @​devcrocod in #659

enableDnsRebindingProtection now defaults to true on mcpStreamableHttp/mcpStatelessStreamableHttp, and the Route.mcp() / Application.mcp() overloads gained enableDnsRebindingProtection, allowedHosts, and allowedOrigins parameters (binary-incompatible on JVM). Only localhost, 127.0.0.1, and [::1] are allowed by default; opt out with enableDnsRebindingProtection = false. The Configuration.enableDnsRebindingProtection, .allowedHosts, and .allowedOrigins properties are deprecated in favor of the new DnsRebindingProtection plugin.

Features

• Add a tasks capability (list, cancel, and per-request augmentation for sampling and elicitation) on ClientCapabilities and ServerCapabilities, with assertions for tasks/* and notifications/tasks/status enforced by Client and ServerSession by @​devcrocod in #732
• Configurable handlerDispatcher and ioDispatcher, plus an optional caller-supplied CoroutineScope, on transports by @​devcrocod in #778

Fixed

• Fire onClose callbacks on SseClientTransport when the SSE session ends — whether closed gracefully or terminated by an error — matching the other client transports by @​jskjw157 in #738

Security

• Enable DNS rebinding protection by default across all HTTP transports, including the SSE endpoints that previously had none (see Breaking Changes for migration) by @​devcrocod in #659
• Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new TooLongFrameException instead of buffering unbounded when a peer never sends a newline terminator by @​devcrocod in 6e6f805

Maintenance

• Remove the test-only dev.mokksy:mokksy dependency in favor of MockEngine and embeddedServer by @​devcrocod in #754

Dependencies

• Ktor to v3.4.3 in #785
• kotlinx.coroutines to v1.11.0 in #760
• kotlin-logging to v8.0.03 in #752, #783
• 24 further Dependabot updates across sample projects, TypeScript conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple, Gradle wrapper, anthropic-java)

Full Changelog: 0.12.0...0.13.0

• b7eeeb1 release: 0.13.0 (#796)
• 6e6f805 Merge commit from fork
• 0eb1822 Update Ktor to version 3.4.3 (#785)
• 0adfb3b fix!: harden lifecycle, dispatchers, back-pressure (#778)
• 37ee423 chore(deps): bump the infrastructure group with 2 updates (#783)
• ff4b623 chore(deps): bump the other-dependencies group across 3 directories with 3 up...
• 78066a9 chore(deps): bump the all-dependencies group across 1 directory with 2 update...
• 1ff5f00 chore(deps): bump qs from 6.14.2 to 6.15.2 in /integration-test/src/jvmTest/t...
• 6d5bac1 chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (#776)
• c854560 chore(deps): bump the all-dependencies group across 1 directory with 2 update...
• Additional commits viewable in compare view

Sourced from io.modelcontextprotocol:kotlin-sdk-server's releases.

0.13.0

Description

Adds a tasks capability and a typed elicitation capability, hardens transport lifecycle, dispatchers, and back-pressure, and enables DNS rebinding protection by default.

Breaking Changes

Typed elicitation capability and new tasks capability by @​devcrocod in #732

ClientCapabilities.elicitation is now a typed ClientCapabilities.Elicitation (form, url) instead of a raw JsonObject?, and both ClientCapabilities and ServerCapabilities gained a typed tasks capability. The constructors of both types changed and are binary-incompatible; recompilation is required.

Transport handlers now run on Dispatchers.Default by @​devcrocod in #778

Handlers moved from Dispatchers.IO to Dispatchers.Default (override via handlerDispatcher), send() now suspends under back-pressure instead of buffering unbounded, and the two-argument StdioServerTransport(input, output) constructor is deprecated in favor of the builder-lambda form. Also fixes a start()/close() race, consistent CancellationException propagation, and an input-Source leak (closes #573, #574, #708).

DNS rebinding protection enabled by default by @​devcrocod in #659

enableDnsRebindingProtection now defaults to true on mcpStreamableHttp/mcpStatelessStreamableHttp, and the Route.mcp() / Application.mcp() overloads gained enableDnsRebindingProtection, allowedHosts, and allowedOrigins parameters (binary-incompatible on JVM). Only localhost, 127.0.0.1, and [::1] are allowed by default; opt out with enableDnsRebindingProtection = false. The Configuration.enableDnsRebindingProtection, .allowedHosts, and .allowedOrigins properties are deprecated in favor of the new DnsRebindingProtection plugin.

Features

• Add a tasks capability (list, cancel, and per-request augmentation for sampling and elicitation) on ClientCapabilities and ServerCapabilities, with assertions for tasks/* and notifications/tasks/status enforced by Client and ServerSession by @​devcrocod in #732
• Configurable handlerDispatcher and ioDispatcher, plus an optional caller-supplied CoroutineScope, on transports by @​devcrocod in #778

Fixed

• Fire onClose callbacks on SseClientTransport when the SSE session ends — whether closed gracefully or terminated by an error — matching the other client transports by @​jskjw157 in #738

Security

• Enable DNS rebinding protection by default across all HTTP transports, including the SSE endpoints that previously had none (see Breaking Changes for migration) by @​devcrocod in #659
• Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new TooLongFrameException instead of buffering unbounded when a peer never sends a newline terminator by @​devcrocod in 6e6f805

Maintenance

• Remove the test-only dev.mokksy:mokksy dependency in favor of MockEngine and embeddedServer by @​devcrocod in #754

Dependencies

• Ktor to v3.4.3 in #785
• kotlinx.coroutines to v1.11.0 in #760
• kotlin-logging to v8.0.03 in #752, #783
• 24 further Dependabot updates across sample projects, TypeScript conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple, Gradle wrapper, anthropic-java)

Full Changelog: 0.12.0...0.13.0

• b7eeeb1 release: 0.13.0 (#796)
• 6e6f805 Merge commit from fork
• 0eb1822 Update Ktor to version 3.4.3 (#785)
• 0adfb3b fix!: harden lifecycle, dispatchers, back-pressure (#778)
• 37ee423 chore(deps): bump the infrastructure group with 2 updates (#783)
• ff4b623 chore(deps): bump the other-dependencies group across 3 directories with 3 up...
• 78066a9 chore(deps): bump the all-dependencies group across 1 directory with 2 update...
• 1ff5f00 chore(deps): bump qs from 6.14.2 to 6.15.2 in /integration-test/src/jvmTest/t...
• 6d5bac1 chore(deps): bump gradle-wrapper from 9.5.0 to 9.5.1 (#776)
• c854560 chore(deps): bump the all-dependencies group across 1 directory with 2 update...
• Additional commits viewable in compare view