mcp 0.21.0 → 0.23.0

data/lib/mcp/server/transports/streamable_http_transport.rb

@@ -24,17 +24,97 @@ module MCP
           "Connection" => "keep-alive",
         }.freeze
 
-        def initialize(server, stateless: false, enable_json_response: false, session_idle_timeout: nil)
+        # Secure defaults for stateful mode. Without a finite idle timeout, sessions live until an explicit client DELETE,
+        # so an unauthenticated `initialize` flood retains unbounded `ServerSession` objects until memory is exhausted.
+        # These defaults expire idle sessions and cap the concurrent count, like the C# SDK (the only reference SDK that
+        # hardens this by default, with a 2h idle timeout and a 10k idle-session count). One difference: at the cap this transport
+        # rejects a new `initialize` with 503 (after reclaiming any already-expired slots), whereas the C# SDK evicts
+        # the oldest idle session. Rejecting keeps established sessions stable and avoids evicting a legitimate idle session on
+        # an attacker's behalf, at the cost of refusing new sessions while genuinely full. Pass `session_idle_timeout: nil` to
+        # opt out of expiry and `max_sessions: nil` to opt out of the cap.
+        DEFAULT_SESSION_IDLE_TIMEOUT = 1800
+        DEFAULT_MAX_SESSIONS = 10_000
+
+        # Distinguishes "argument omitted, apply the secure default" from an explicit `nil` (opt out of expiry).
+        UNSET_IDLE_TIMEOUT = Object.new.freeze
+        private_constant :UNSET_IDLE_TIMEOUT
+
+        # Default upper bound on the JSON-RPC request body. `handle_post` reads the whole
+        # body into memory and parses it, so without a cap a single unauthenticated POST
+        # can allocate gigabytes and OOM the worker. 4 MiB comfortably
+        # fits a typical JSON-RPC request (a 4 MiB JSON string decodes to ~3 MiB of base64
+        # payload); raise `max_request_bytes:` for unusually large payloads. Matches the
+        # TypeScript SDK's 4 MB default.
+        DEFAULT_MAX_REQUEST_BYTES = 4 * 1024 * 1024
+
+        # Conservative bound on JSON nesting depth, so a deeply nested body cannot exhaust
+        # the stack or amplify parse cost (complements the byte cap).
+        MAX_JSON_NESTING = 64
+
+        # Creates a Streamable HTTP transport that can be mounted as a Rack app.
+        #
+        # @param server [MCP::Server] the server whose requests this transport dispatches.
+        # @param stateless [Boolean] when `true`, no session is issued and each POST is self-contained.
+        # @param enable_json_response [Boolean] when `true`, a request is answered with a single JSON
+        #   object instead of an SSE stream.
+        # @param session_idle_timeout [Numeric, nil] seconds before an idle session is reaped; defaults
+        #   to `DEFAULT_SESSION_IDLE_TIMEOUT` (1800) in stateful mode, and an explicit `nil` disables
+        #   expiry. Not supported in stateless mode.
+        # @param max_sessions [Integer, nil] cap on the concurrent session count in stateful mode; a new
+        #   `initialize` past the cap is rejected with HTTP 503, and `nil` disables the cap.
+        # @param allowed_origins [Array<String>, nil] extra `Origin` values accepted in addition to
+        #   same-origin requests, for DNS rebinding protection.
+        # @param allowed_hosts [Array<String>, nil] extra `Host` values accepted beyond the loopback
+        #   defaults (`127.0.0.1`, `::1`, `localhost`); each entry matches a bare host name (any port)
+        #   or a full `host:port`.
+        # @param dns_rebinding_protection [Boolean] when `true` (default), validates the `Host` and
+        #   `Origin` headers to prevent DNS rebinding; pass `false` when an upstream proxy already
+        #   validates them.
+        # @param session_request_validator [#call, nil] An optional
+        #   `->(request, session_id) { true | false }` invoked on every non-`initialize` POST, GET, and DELETE
+        #   against an existing session (regular requests, notifications, and client responses alike).
+        #   Returning a falsy value rejects the request with HTTP 403. The SDK issues a random `SecureRandom.uuid`
+        #   session ID and otherwise only checks existence/idle-timeout, so binding a session to a user is
+        #   the deploying application's responsibility (the transport never receives the authenticated identity
+        #   on its own); this is the seam to enforce ownership and mitigate session poisoning. Without a validator,
+        #   ownership is not enforced.
+        # @param max_request_bytes [Integer] upper bound in bytes on a POST request body; larger
+        #   requests are rejected with HTTP 413. Defaults to 4 MiB.
+        def initialize(
+          server,
+          stateless: false,
+          enable_json_response: false,
+          session_idle_timeout: UNSET_IDLE_TIMEOUT,
+          max_sessions: DEFAULT_MAX_SESSIONS,
+          allowed_origins: nil,
+          allowed_hosts: nil,
+          dns_rebinding_protection: true,
+          session_request_validator: nil,
+          max_request_bytes: DEFAULT_MAX_REQUEST_BYTES
+        )
           super(server)
-          # Maps `session_id` to `{ get_sse_stream: stream_object, server_session: ServerSession, last_active_at: float_from_monotonic_clock }`.
+          # Maps `session_id` to `{ get_sse_stream: stream_object, server_session: ServerSession, last_active_at: float_from_monotonic_clock, origin: origin_header }`.
           @sessions = {}
           @mutex = Mutex.new
 
           @stateless = stateless
           @enable_json_response = enable_json_response
-          @session_idle_timeout = session_idle_timeout
+          @session_request_validator = session_request_validator
+          @dns_rebinding_protection = dns_rebinding_protection
+
+          # Host names are case-insensitive, so the allow lists are compared down-cased.
+          @allowed_hosts = (DEFAULT_LOOPBACK_HOSTS + Array(allowed_hosts)).map(&:downcase).freeze
+          @allowed_origins = Array(allowed_origins).map(&:downcase).freeze
           @pending_responses = {}
 
+          # Resolve the idle timeout: an explicit value (including `nil` to opt out) wins; otherwise apply the secure default,
+          # which does not apply to stateless mode since it retains no sessions.
+          @session_idle_timeout = if session_idle_timeout.equal?(UNSET_IDLE_TIMEOUT)
+            stateless ? nil : DEFAULT_SESSION_IDLE_TIMEOUT
+          else
+            session_idle_timeout
+          end
+
           if @session_idle_timeout
             if @stateless
               raise ArgumentError, "session_idle_timeout is not supported in stateless mode."
@@ -43,6 +123,19 @@ module MCP
             end
           end
 
+          unless max_sessions.nil? || (max_sessions.is_a?(Integer) && max_sessions > 0)
+            raise ArgumentError, "max_sessions must be a positive Integer or nil"
+          end
+
+          # The cap guards the stateful session store; stateless mode keeps none.
+          @max_sessions = stateless ? nil : max_sessions
+
+          unless max_request_bytes.is_a?(Integer) && max_request_bytes > 0
+            raise ArgumentError, "max_request_bytes must be a positive Integer"
+          end
+
+          @max_request_bytes = max_request_bytes
+
           start_reaper_thread if @session_idle_timeout
         end
 
@@ -52,12 +145,19 @@ module MCP
         STREAM_WRITE_ERRORS = [IOError, Errno::EPIPE, Errno::ECONNRESET].freeze
         SESSION_REAP_INTERVAL = 60
 
+        # Loopback hosts always accepted by DNS rebinding protection. A locally bound MCP server (the canonical pattern) is
+        # protected out of the box; non-loopback deployments widen the list via `allowed_hosts:`.
+        DEFAULT_LOOPBACK_HOSTS = ["127.0.0.1", "::1", "localhost"].freeze
+
         # Rack app interface. This transport can be mounted as a Rack app.
         def call(env)
           handle_request(Rack::Request.new(env))
         end
 
         def handle_request(request)
+          rebinding_error = validate_dns_rebinding(request)
+          return rebinding_error if rebinding_error
+
           case request.env["REQUEST_METHOD"]
           when "POST"
             handle_post(request)
@@ -340,7 +440,9 @@ module MCP
           content_type_error = validate_content_type(request)
           return content_type_error if content_type_error
 
-          body_string = request.body.read
+          body_string = read_bounded_body(request)
+          return payload_too_large_response if body_string.nil?
+
           session_id = extract_session_id(request)
 
           begin
@@ -378,16 +480,25 @@ module MCP
               return session_not_found_response
             end
 
-            handle_initialization(body_string, body)
-          elsif notification?(body)
-            dispatch_notification(body_string, session_id)
-            handle_accepted
-          elsif response?(body)
-            return session_not_found_response if !@stateless && !session_exists?(session_id)
-
-            handle_response(body, session_id: session_id)
+            handle_initialization(request, body_string, body)
           else
-            handle_regular_request(body_string, session_id, related_request_id: body[:id])
+            # Ownership gate for every request against an existing session, applied uniformly to notifications, client responses,
+            # and regular requests. This covers write paths beyond tool calls - notably `notifications/cancelled`, which would
+            # otherwise let a stolen session ID cancel a victim's in-flight request. `initialize` is exempt (it establishes the session).
+            if !@stateless && session_id && !validate_session_request(request, session_id)
+              return forbidden_response
+            end
+
+            if notification?(body)
+              dispatch_notification(body_string, session_id)
+              handle_accepted
+            elsif response?(body)
+              return session_not_found_response if !@stateless && !session_exists?(session_id)
+
+              handle_response(body, session_id: session_id)
+            else
+              handle_regular_request(body_string, session_id, related_request_id: body[:id])
+            end
           end
         rescue StandardError => e
           MCP.configuration.exception_reporter.call(e, { request: body_string })
@@ -412,6 +523,7 @@ module MCP
 
           error_response = validate_and_touch_session(session_id)
           return error_response if error_response
+          return forbidden_response unless validate_session_request(request, session_id)
 
           protocol_version_error = validate_protocol_version_header(request)
           return protocol_version_error if protocol_version_error
@@ -434,6 +546,7 @@ module MCP
 
           return missing_session_id_response unless (session_id = extract_session_id(request))
           return session_not_found_response unless session_exists?(session_id)
+          return forbidden_response unless validate_session_request(request, session_id)
 
           protocol_version_error = validate_protocol_version_header(request)
           return protocol_version_error if protocol_version_error
@@ -495,6 +608,27 @@ module MCP
           request.env["HTTP_MCP_SESSION_ID"]
         end
 
+        # Session-ownership gate for requests against an existing session (the spec's session-binding guidance).
+        # The session ID alone is unguessable but not proof of ownership, so a stolen ID must not silently grant access.
+        # Two layers, both returning `false` to trigger a 403:
+        #
+        # - Built-in Origin consistency (defense in depth, not authentication): if the session recorded an `Origin`
+        #   at `initialize` and this request carries a different one, reject. Both must be present to compare,
+        #   so non-browser clients that send no `Origin` are unaffected.
+        # - The application-supplied `session_request_validator`, which can enforce true ownership when it has
+        #   an authenticated principal.
+        def validate_session_request(request, session_id)
+          session = @mutex.synchronize { @sessions[session_id] }
+          return true unless session
+
+          session_origin = session[:origin]
+          request_origin = request.env["HTTP_ORIGIN"]
+          return false if session_origin && request_origin && session_origin != request_origin
+          return @session_request_validator.call(request, session_id) if @session_request_validator
+
+          true
+        end
+
         def validate_accept_header(request, required_types)
           accept_header = request.env["HTTP_ACCEPT"]
           return not_acceptable_response(required_types) unless accept_header
@@ -534,8 +668,34 @@ module MCP
           )
         end
 
+        # Reads the request body with a hard byte cap so an unbounded POST cannot exhaust
+        # memory. A declared `Content-Length` over the cap is rejected
+        # without reading; the actual read is also bounded to one byte past the cap, so
+        # a missing or spoofed `Content-Length` (e.g. chunked transfer) is still caught.
+        # Returns `nil` when the body exceeds the cap.
+        def read_bounded_body(request)
+          content_length = request.content_length
+          return if content_length && content_length.to_i > @max_request_bytes
+
+          body = request.body.read(@max_request_bytes + 1)
+          return "" if body.nil?
+          return if body.bytesize > @max_request_bytes
+
+          body
+        end
+
+        def payload_too_large_response
+          json_rpc_error_response(
+            status: 413,
+            code: JsonRpcHandler::ErrorCode::INVALID_REQUEST,
+            message: "Payload too large: request body exceeds #{@max_request_bytes} bytes",
+          )
+        end
+
         def parse_request_body(body_string)
-          JSON.parse(body_string, symbolize_names: true)
+          # `max_nesting` bounds parse depth; a too-deep body raises `JSON::NestingError`,
+          # a subclass of `JSON::ParserError`, so it is caught below as a parse error.
+          JSON.parse(body_string, symbolize_names: true, max_nesting: MAX_JSON_NESTING)
         rescue JSON::ParserError, TypeError
           raise InvalidJsonError
         end
@@ -613,7 +773,7 @@ module MCP
           handle_accepted
         end
 
-        def handle_initialization(body_string, body)
+        def handle_initialization(request, body_string, body)
           session_id = nil
 
           if @stateless
@@ -622,13 +782,33 @@ module MCP
             session_id = SecureRandom.uuid
             server_session = ServerSession.new(server: @server, transport: self, session_id: session_id)
 
-            @mutex.synchronize do
+            # Cap the concurrent session count so an `initialize` flood cannot retain unbounded sessions until memory is exhausted.
+            # The check and insert share the mutex so concurrent initializes cannot race past the limit.
+            reclaimed = []
+            inserted = @mutex.synchronize do
+              # When at the cap, first reclaim slots held by already-expired sessions the 60s reaper has not yet collected,
+              # so the cap rejects only when genuinely full rather than up to a reaper interval after sessions expired.
+              if @max_sessions && @sessions.size >= @max_sessions
+                @sessions.each_key.select { |id| session_expired?(@sessions[id]) }.each do |id|
+                  cleanup_and_collect_stream(id, reclaimed)
+                end
+              end
+
+              next false if @max_sessions && @sessions.size >= @max_sessions
+
               @sessions[session_id] = {
                 get_sse_stream: nil,
                 server_session: server_session,
                 last_active_at: Process.clock_gettime(Process::CLOCK_MONOTONIC),
+                # Captured for the built-in Origin-consistency defense in `validate_session_request`.
+                # Not authentication.
+                origin: request.env["HTTP_ORIGIN"],
               }
+              true
             end
+
+            reclaimed.each { |stream| close_stream_safely(stream) }
+            return too_many_sessions_response unless inserted
           end
 
           response = server_session.handle_json(body_string)
@@ -655,6 +835,14 @@ module MCP
           [202, {}, []]
         end
 
+        def too_many_sessions_response
+          json_rpc_error_response(
+            status: 503,
+            code: JsonRpcHandler::ErrorCode::INTERNAL_ERROR,
+            message: "Service unavailable: maximum concurrent sessions (#{@max_sessions}) reached",
+          )
+        end
+
         def handle_regular_request(body_string, session_id, related_request_id: nil)
           server_session = nil
 
@@ -808,6 +996,74 @@ module MCP
           active
         end
 
+        # Per MCP 2025-11-25, servers MUST validate the `Origin` header and SHOULD bind only to localhost
+        # to prevent DNS rebinding attacks against locally bound MCP servers. Protection is on by default;
+        # pass `dns_rebinding_protection: false` to disable it (e.g. when an upstream proxy or middleware already
+        # performs the check). The `Host` header is validated against the loopback defaults plus `allowed_hosts:`,
+        # and the `Origin` header, when present, must be same-origin or in `allowed_origins:`.
+        def validate_dns_rebinding(request)
+          return unless @dns_rebinding_protection
+
+          validate_host(request) || validate_origin(request)
+        end
+
+        # Rejects a rebound `Host` (e.g. `evil.example.com` re-pointed at 127.0.0.1).
+        # A request without a `Host` header (e.g. HTTP/1.0) is allowed; the rebinding vector this guards against always carries one.
+        def validate_host(request)
+          host = request.env["HTTP_HOST"]
+          return if host.nil?
+
+          # An `allowed_hosts:` entry matches either the bare host name (any port)
+          # or the full `host:port` value, so both `"app.example.com"` and
+          # `"app.example.com:8443"` can be configured.
+          normalized = host.downcase
+          return if @allowed_hosts.include?(request_hostname(normalized)) || @allowed_hosts.include?(normalized)
+
+          forbidden_response("Forbidden: Invalid Host header")
+        end
+
+        # A request without an `Origin` header (typical for non-browser MCP clients) is allowed. A browser cross-origin request is
+        # rejected unless the origin is same-origin or explicitly allow-listed via `allowed_origins:`.
+        def validate_origin(request)
+          origin = request.env["HTTP_ORIGIN"]
+          return if origin.nil?
+          return if same_origin?(origin, request)
+          return if @allowed_origins.include?(origin.downcase)
+
+          forbidden_response("Forbidden: Invalid Origin header")
+        end
+
+        # Extracts the host name from a `Host` header value, stripping any port and IPv6 brackets
+        # (`[::1]:8080` becomes `::1`, `127.0.0.1:8080` becomes `127.0.0.1`).
+        def request_hostname(host)
+          return host[/\A\[([^\]]+)\]/, 1] if host.start_with?("[")
+
+          host.split(":").first
+        end
+
+        # Compares the `Origin` authority (host:port) against the request's own `Host`.
+        # Scheme is not compared (the `Host` header carries none, and `request.scheme` is unreliable behind proxies),
+        # but the `Origin`'s scheme is used to drop a redundant default port (`:80` for http, `:443` for https) from
+        # both sides so `http://example.com` matches `Host: example.com:80`. Comparison is case-insensitive.
+        def same_origin?(origin, request)
+          host = request.env["HTTP_HOST"]
+          return false if host.nil?
+
+          normalized = origin.downcase
+          default_port = normalized.start_with?("https://") ? ":443" : ":80"
+          authority = normalized.sub(%r{\Ahttps?://}, "")
+
+          authority.delete_suffix(default_port) == host.downcase.delete_suffix(default_port)
+        end
+
+        def forbidden_response(message = "Forbidden: session request validation failed")
+          json_rpc_error_response(
+            status: 403,
+            code: JsonRpcHandler::ErrorCode::INVALID_REQUEST,
+            message: message,
+          )
+        end
+
         def method_not_allowed_response
           json_rpc_error_response(
             status: 405,

data/lib/mcp/server.rb

@@ -256,6 +256,9 @@ module MCP
       report_exception(e, { notification: "resources_list_changed" })
     end
 
+    # @deprecated MCP Logging (`logging/setLevel` and `notifications/message`)
+    #   is deprecated as of MCP protocol version 2026-07-28 (SEP-2577).
+    #   Use stderr or OpenTelemetry instead.
     def notify_log_message(data:, level:, logger: nil)
       return unless @transport
       return unless logging_message_notification&.should_notify?(level)
@@ -272,6 +275,10 @@ module MCP
     # Called when a client notifies the server that its filesystem roots have changed.
     #
     # @yield [params] The notification params (typically `nil`).
+    # @deprecated MCP Roots (`roots/list` and
+    #   `notifications/roots/list_changed`) is deprecated as of MCP protocol
+    #   version 2026-07-28 (SEP-2577). Use tool parameters, resource URIs,
+    #   server configuration, or environment variables instead.
     def roots_list_changed_handler(&block)
       @handlers[Methods::NOTIFICATIONS_ROOTS_LIST_CHANGED] = block
     end
@@ -423,6 +430,13 @@ module MCP
     end
 
     def handle_request(request, method, session: nil, related_request_id: nil)
+      # A well-formed notification carries no JSON-RPC id and receives no response.
+      # If a client erroneously sends a notification-only method with an id, the message
+      # is framed as a request; since notification methods have no request handler,
+      # returning `nil` here makes `JsonRpcHandler` report "Method not found", matching
+      # the TypeScript and Python SDKs rather than emitting a spurious `result: null`.
+      return if Methods.notification?(method) && !related_request_id.nil?
+
       # `notifications/cancelled` is dispatched directly: it is a notification (no JSON-RPC id)
       # and intentionally bypasses the `@handlers` lookup, capability check, in-flight registry,
       # and rescue blocks below.
@@ -636,7 +650,7 @@ module MCP
         tool, arguments, server_context_with_meta(request), progress_token: progress_token, session: session, related_request_id: related_request_id, cancellation: cancellation
       )
       validate_tool_call_result!(tool, result)
-      result
+      serialize_structured_content_fallback(result)
     rescue RequestHandlerError, CancelledError
       # CancelledError is intentionally not wrapped so `handle_request` can turn it into
       # `JsonRpcHandler::NO_RESPONSE` per the MCP cancellation spec.
@@ -801,6 +815,18 @@ module MCP
       tool.output_schema.validate_result(result[:structuredContent])
     end
 
+    # Per SEP-2106, `structuredContent` may be any JSON value, not only an object.
+    # Clients on older protocol versions may only read `content`,
+    # so when a tool returns non-object structured content without providing
+    # any content blocks, mirror the value into `content` as serialized JSON text.
+    def serialize_structured_content_fallback(result)
+      structured = result[:structuredContent]
+      return result if structured.nil? || structured.is_a?(Hash)
+      return result unless result[:content].nil? || result[:content].empty?
+
+      result.merge(content: [{ type: "text", text: JSON.generate(structured) }])
+    end
+
     # Whether a tool/prompt handler opts in to receiving an `MCP::ServerContext`.
     # Recognizes `:keyrest` (`**kwargs`) because tools are invoked without a positional argument
     # (`tool.call(**args, server_context:)`), soa `**kwargs`-only signature safely captures `server_context:`.

data/lib/mcp/server_context.rb

@@ -35,6 +35,9 @@ module MCP
     # @param data [Object] The log data to send.
     # @param level [String] Log level (e.g., `"debug"`, `"info"`, `"error"`).
     # @param logger [String, nil] Logger name.
+    # @deprecated MCP Logging (`logging/setLevel` and `notifications/message`)
+    #   is deprecated as of MCP protocol version 2026-07-28 (SEP-2577).
+    #   Use stderr or OpenTelemetry instead.
     def notify_log_message(data:, level:, logger: nil)
       return unless @notification_target
 
@@ -51,6 +54,10 @@ module MCP
     end
 
     # Delegates to the session so the request is scoped to the originating client.
+    # @deprecated MCP Roots (`roots/list` and
+    #   `notifications/roots/list_changed`) is deprecated as of MCP protocol
+    #   version 2026-07-28 (SEP-2577). Use tool parameters, resource URIs,
+    #   server configuration, or environment variables instead.
     def list_roots
       if @notification_target.respond_to?(:list_roots)
         @notification_target.list_roots(related_request_id: @related_request_id)
@@ -84,6 +91,9 @@ module MCP
     # Delegates to the session so the request is scoped to the originating client.
     # Falls back to `@context` (via `method_missing`) when `@notification_target`
     # does not support sampling.
+    # @deprecated MCP Sampling (`sampling/createMessage`) is deprecated as of
+    #   MCP protocol version 2026-07-28 (SEP-2577). Use direct LLM provider
+    #   APIs instead.
     def create_sampling_message(**kwargs)
       if @notification_target.respond_to?(:create_sampling_message)
         @notification_target.create_sampling_message(**kwargs, related_request_id: @related_request_id)
@@ -130,9 +140,14 @@ module MCP
       end
     end
 
-    def method_missing(name, ...)
+    # Forward arguments explicitly with `*args, **kwargs, &block` rather than the `...` forwarding syntax.
+    # The gem supports Ruby 2.7.0 (see `required_ruby_version`), but RuboCop's Parser backend only runs on Ruby 2.7.8,
+    # so leading-argument forwarding like `def method_missing(name, ...)` is allowed by the linter even though it
+    # raises a `SyntaxError` on Ruby 2.7.0 through 2.7.2 (it was added in Ruby 2.7.3). Explicit forwarding keeps
+    # this method loadable on Ruby 2.7.0.
+    def method_missing(name, *args, **kwargs, &block)
       if @context.respond_to?(name)
-        @context.public_send(name, ...)
+        @context.public_send(name, *args, **kwargs, &block)
       else
         super
       end

data/lib/mcp/server_session.rb

@@ -98,6 +98,10 @@ module MCP
     end
 
     # Sends a `roots/list` request scoped to this session.
+    # @deprecated MCP Roots (`roots/list` and
+    #   `notifications/roots/list_changed`) is deprecated as of MCP protocol
+    #   version 2026-07-28 (SEP-2577). Use tool parameters, resource URIs,
+    #   server configuration, or environment variables instead.
     def list_roots(related_request_id: nil)
       unless client_capabilities&.dig(:roots)
         raise "Client does not support roots."
@@ -115,6 +119,9 @@ module MCP
     end
 
     # Sends a `sampling/createMessage` request scoped to this session.
+    # @deprecated MCP Sampling (`sampling/createMessage`) is deprecated as of
+    #   MCP protocol version 2026-07-28 (SEP-2577). Use direct LLM provider
+    #   APIs instead.
     def create_sampling_message(related_request_id: nil, **kwargs)
       params = @server.build_sampling_params(client_capabilities, **kwargs)
       send_to_transport_request(Methods::SAMPLING_CREATE_MESSAGE, params, related_request_id: related_request_id)
@@ -188,6 +195,9 @@ module MCP
     end
 
     # Sends a log message notification to this session only.
+    # @deprecated MCP Logging (`logging/setLevel` and `notifications/message`)
+    #   is deprecated as of MCP protocol version 2026-07-28 (SEP-2577).
+    #   Use stderr or OpenTelemetry instead.
     def notify_log_message(data:, level:, logger: nil, related_request_id: nil)
       effective_logging = @logging_message_notification || @server.logging_message_notification
       return unless effective_logging&.should_notify?(level)

data/lib/mcp/tool/output_schema.rb

@@ -7,12 +7,29 @@ module MCP
     class OutputSchema < Schema
       class ValidationError < StandardError; end
 
+      # Root-level keywords whose presence means the user already chose a root schema shape,
+      # so no `type: "object"` default should be merged in.
+      ROOT_SCHEMA_KEYWORDS = [:type, :"$ref", :oneOf, :anyOf, :allOf, :not, :if, :const, :enum].freeze
+
       def validate_result(result)
         errors = fully_validate(result)
         if errors.any?
           raise ValidationError, "Invalid result: #{errors.join(", ")}"
         end
       end
+
+      private
+
+      # Per SEP-2106, an output schema may be ANY valid JSON Schema 2020-12 document: object, array, primitive,
+      # or a root-level composition.
+      # Default the root to an object only when no root schema keyword is present, which preserves the wire output
+      # of the common `properties`-only shape while leaving e.g. `{ type: "array" }` or `{ oneOf: [...] }` untouched
+      # (the old unconditional default merged `type: "object"` into root combinators, producing a wrong schema).
+      def apply_default_root_type!
+        return if ROOT_SCHEMA_KEYWORDS.any? { |keyword| @schema.key?(keyword) }
+
+        super
+      end
     end
   end
 end