Releases: modelcontextprotocol/rust-sdk
Releases · modelcontextprotocol/rust-sdk
Release list
rmcp-v3.0.0-beta.1
Added
- route SEP-2260 associated server requests to the originating SSE stream (#1029)
- [breaking] add distributed SSE event store (#1024)
- add client-side TTL-honoring response cache (SEP-2549) (#1025)
- [breaking] Implement SEP-2663 Tasks Extension (#1020)
- add subscription listen streams (SEP-2575) (#1000)
- (auth) bind DCR client credentials to issuing authorization server (SEP-2352) (#998)
- add modern client lifecycle modes (SEP-2575) (#995)
- (auth) accumulate client-side scopes during step-up authorization (#888)
- [breaking] add server discovery and negotiation (SEP-2575) (#973)
- (conformance) add SEP-2243 header validation tool (#997)
- [breaking] align metadata models with draft schema (#993)
- [breaking] implement SEP-2549 cache hints (#889)
- [breaking] add MRTR behavior support (SEP-2322) (#929)
- [breaking] type Annotations.lastModified as a string (#956)
- [breaking] add SEP-2243 HTTP standard headers (#907)
- relax outputSchema to accept non-object JSON Schema types (SEP-2106) (#895)
- [breaking] relax tool result structuredContent type (SEP-2106) (#933)
- [breaking] add MRTR model types (SEP-2322) (#915)
Fixed
- reap completed response send tasks (#1026)
- accept stringified numeric response IDs (#1021)
- re-register after auth server change (#1011)
- .with_stateful_mode -> .with_legacy_session_mode (#1015)
- preserve negotiated progress responses (#1005)
- (server) serve draft-version requests statelessly per SEP-2567 (#999)
- pass client header conformance (#1012)
- (auth) add an SDK path for pre-registered OAuth clients (#994)
- (transport) cancel in-flight request on stateless streamable-HTTP client disconnect (#857) (#967)
- (auth) distinguish rejected refresh tokens from transient failures (#963)
- (auth) validate discovered metadata issuer (#996)
- bound streamable HTTP memory usage (#970)
- (streamable-http) preserve progress in JSON mode (#990)
- specify compatible sse-stream version (#968)
- flag schema derive on schemars feature (#966)
Other
- refactor OAuth client authorization api (#1009)
- update for 2026-07-28 version (#1032)
- (deps) update hmac requirement from 0.12 to 0.13 (#988)
- serialize JavaScript dependency install (#972)
Changed
- BREAKING: rename
StreamableHttpServerConfig::stateful_modetolegacy_session_mode(and the builderwith_stateful_modetowith_legacy_session_mode) to clarify that the option only affects legacy protocol versions (< 2026-07-28); per SEP-2567 the2026-07-28draft version is always served statelessly (#999)
Fixed
- use the authorization server issuer as the default
private_key_jwtaudience
rmcp-macros-v3.0.0-beta.1
Added
- add client-side TTL-honoring response cache (SEP-2549) (#1025)
- [breaking] Implement SEP-2663 Tasks Extension (#1020)
- add subscription listen streams (SEP-2575) (#1000)
- add modern client lifecycle modes (SEP-2575) (#995)
- [breaking] implement SEP-2549 cache hints (#889)
- [breaking] add MRTR behavior support (SEP-2322) (#929)
- relax outputSchema to accept non-object JSON Schema types (SEP-2106) (#895)
- [breaking] add MRTR model types (SEP-2322) (#915)
Other
- update for 2026-07-28 version (#1032)
rmcp-v2.2.0
rmcp-macros-v2.2.0
rmcp-v2.1.0
Added
Fixed
rmcp-macros-v2.1.0
rmcp-v2.0.0
Migration guide: https://github.com/modelcontextprotocol/rust-sdk/discussions/926
Added
- [breaking] (rmcp) add Audio variant to PromptMessageContent (#865)
- [breaking] align model types with MCP 2025-11-25 spec (#927)
- deprecate roots/sampling/logging types (#923)
Fixed
- prevent OAuth resource spoofing (#937)
- block oauth metadata ssrf (#935)
- prevent streamable HTTP session leak (#934)
- fill missing fully qualified syntax in prompt_handler macros (#866)
Other
rmcp-macros-v2.0.0
rmcp-v1.8.0
Warning
⚠️ Breaking Changes
Despite being a minor version bump, this release contains a source-breaking API change (it should have been 2.0.0). If you depend on rmcp = "1.7", Cargo will resolve to 1.8.0 automatically and your build may fail. Pin to =1.7.x if you are not ready to migrate.
Peer::peer_info() return type changed (#862):
- pub fn peer_info(&self) -> Option<&R::PeerInfo>
+ pub fn peer_info(&self) -> Option<Arc<R::PeerInfo>>This was needed so peer info can be re-set on a duplicate initialize (it now lives behind an RwLock), which is why a borrow can no longer be returned.
Migration: field access still works through Arc's Deref. If you need the old &InitializeResult (e.g. you bound the type explicitly), use .as_deref():
// Before (1.7.x): info is &InitializeResult
let info: Option<&InitializeResult> = client.peer_info();
// After (1.8.0): info is Arc<InitializeResult>
let info: Option<Arc<InitializeResult>> = client.peer_info();
// To recover the old reference type:
let info: Option<&InitializeResult> = client.peer_info().as_deref();Added
- standardize resource-not-found error code (SEP-2164) (#899)
- validate OAuth authorization response issuer (#896)
- specify OIDC application_type during dynamic client registration (SEP-837) (#883)
- deprecate roots, sampling, and logging (SEP-2577) (#884)
Fixed
- (auth) preserve configured reqwest client (#917)
- (auth) align OAuth metadata discovery ordering (#887)
- align progress timeout token (#909)
- (elicitation) preserve enumNames through ElicitationSchema serde round-trip (#905)
- return tool errors for invalid arguments (#894)
- (auth) apply offline_access to reauth paths (#897)
- update peer info on duplicate initialize (#862) —
⚠️ breaking: changes thePeer::peer_info()signature, see Breaking Changes above - strip and validate tool outputSchema and inputSchema (#860)
- remove unnecessary fields from tools' inputSchema (#856)
- reject init header/body version mismatch (#853)
- align protocol version negotiation (#855)
- accept 200 with empty body in response to notifications in addition to 202 (#849)