mcp 0.22.0 → 0.23.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0e0cdbc945ee9ec5d178aeaedb1c8af84eca0bae8db8e264f523b47b8d67c52
-  data.tar.gz: 6acb2d299d9ae215c26db733091ebbcbb3f6b1477c94d9b4047f9ab37c3a8f0c
+  metadata.gz: b3d294b5e8b52b58ba3d2a2752db94f3a0d836ed6003d10ba0220d9d31b2d267
+  data.tar.gz: 1f0e92d3a77fc36166a1f68c3443aa9d5174ee139491b784dfa3cdcb92caa8e1
 SHA512:
-  metadata.gz: 8299a6cf0101d4b8b980a69ed3128636aae6f0497fb431d14fdc0f6b8b659fb18ab5d886cf1cb567c53f385a4f8c0cdaf5e91aff6d1a4fe4daefca25d17a7dc2
-  data.tar.gz: dff4075f2a0fdf27329af3455b1db6960e38f557ea2436388f1a271d6915172e318b9630ccc8312fab16e3e8ac42e0dc84ef20e974b313056d377f3798d4a83c
+  metadata.gz: 975ebdaeab3e8dd8219c81c812fcbde232047a9baabf6924bea6fba7f4eae05b6eab96aa02efd601e83e443fc0ad62107f9379a1ab07924d1fcccedae48c6232
+  data.tar.gz: 624de6afb8859bce866dabef20c6357913ff8adf2e479f84d2472049f7f7f2853dc65f27ed1925f1c3f76eae880a3886806136dea6d94459988d24e6f973d304

data/README.md

@@ -102,6 +102,8 @@ transport = MCP::Server::Transports::StdioTransport.new(server)
 transport.open
 ```
 
+`StdioTransport.new` accepts an optional `max_line_bytes:` keyword that caps the byte length of a single newline-delimited request frame. A frame that reaches this limit without a newline is rejected and the connection is closed, preventing unbounded memory growth from a peer that never emits a newline. It defaults to `4 * 1024 * 1024` (4 MiB).
+
 You can run this script and then type in requests to the server at the command line.
 
 ```console
@@ -128,6 +130,27 @@ The following examples show two common integration styles in Rails.
 >
 > Stateless mode (`stateless: true`) does not use sessions and works with any server configuration.
 
+> [!IMPORTANT]
+> Per MCP 2025-11-25, `StreamableHTTPTransport` validates the `Host` and `Origin` headers by default to
+> prevent DNS rebinding attacks against locally bound servers, rejecting unauthorized values with HTTP 403.
+> `Host` is allowed for the loopback defaults (`127.0.0.1`, `::1`, `localhost`), and an `Origin` header,
+> when present, must be same-origin or explicitly allow-listed. Non-browser clients that send no `Origin`
+> header are unaffected.
+>
+> Deployments behind a reverse proxy or bound to a non-loopback interface must widen the allow lists:
+>
+> ```ruby
+> transport = MCP::Server::Transports::StreamableHTTPTransport.new(
+>   server,
+>   allowed_hosts: ["mcp.example.com"],
+>   allowed_origins: ["https://app.example.com"],
+> )
+> ```
+>
+> An `allowed_hosts:` entry matches either the bare host name (any port) or the full `host:port` value,
+> so both `"mcp.example.com"` and `"mcp.example.com:8443"` work. Pass `dns_rebinding_protection: false`
+> to disable the check entirely (e.g., when an upstream proxy or middleware already validates `Host`/`Origin`).
+
 ##### Rails (mount)
 
 `StreamableHTTPTransport` is a Rack app that can be mounted directly in Rails routes:
@@ -1758,12 +1781,58 @@ Session-scoped standalone notifications (`resources/updated`, `elicitation/compl
 broadcast notifications (`tools/list_changed`, etc.) still flow to clients connected to the GET SSE stream.
 This mode is suitable for simple tool servers that do not need server-initiated requests.
 
-By default, sessions do not expire. To mitigate session hijacking risks, you can set a `session_idle_timeout` (in seconds).
-When configured, sessions that receive no HTTP requests for this duration are automatically expired and cleaned up:
+By default, stateful sessions are bounded so an `initialize` flood cannot retain sessions until memory is exhausted:
+they expire after `session_idle_timeout` seconds of inactivity (default 1800, i.e. 30 minutes) and the concurrent
+session count is capped at `max_sessions` (default 10000). A session's idle timer is reset by activity that touches it
+(a GET, or a regular-request POST), and expired sessions are collected by a background reaper roughly once a minute,
+so cleanup lags inactivity by up to that interval. At the cap, the transport first reclaims any already-expired slots
+and then, if still full, rejects a new `initialize` with HTTP 503 (it does not evict an existing session).
+
+```ruby
+# Tune the limits
+transport = MCP::Server::Transports::StreamableHTTPTransport.new(server, session_idle_timeout: 900, max_sessions: 5000)
+
+# Opt out of expiry and/or the cap (not recommended on internet-facing deployments)
+transport = MCP::Server::Transports::StreamableHTTPTransport.new(server, session_idle_timeout: nil, max_sessions: nil)
+```
+
+Stateless mode (`stateless: true`) retains no sessions, so neither limit applies to it.
+
+#### Session Ownership
+
+`StreamableHTTPTransport` issues a random `SecureRandom.uuid` session ID and validates incoming requests by session
+existence and idle timeout only. It does not bind a session to a user, because the transport never receives
+an authenticated identity on its own. A caller that obtains a valid session ID could therefore act on that session,
+so binding a session to a user is the deploying application's responsibility (the MCP spec frames this as a SHOULD).
+
+The primary control is the `session_request_validator`. It is called as `->(request, session_id) { true | false }`
+on every non-`initialize` POST, GET, and DELETE against an existing session (including notification and response POSTs,
+so a stolen session ID cannot, for example, POST `notifications/cancelled` against a victim's request). A falsy return
+rejects the request with HTTP 403. Use it to compare the request's authenticated principal against the one recorded
+when the session was created:
+
+```ruby
+transport = MCP::Server::Transports::StreamableHTTPTransport.new(
+  server,
+  session_request_validator: ->(request, session_id) { owns_session?(request, session_id) },
+)
+```
+
+Without a validator the transport does not enforce ownership. As a limited defense in depth (not authentication),
+it also records the `Origin` header at `initialize` and rejects a later request whose `Origin` differs, but only
+when both are present - a non-browser client that omits `Origin` (e.g. `curl` or a script) is not stopped by this check.
+Enforcing ownership against a determined attacker requires supplying the validator with an authenticated principal.
+
+#### Request Size Limits
+
+`StreamableHTTPTransport` bounds how many bytes a single POST body may allocate, so a peer cannot exhaust memory
+with one oversized message. A body larger than `max_request_bytes` (default 4 MiB) is rejected with HTTP 413,
+and JSON nesting depth is capped. The 4 MiB default comfortably fits a typical JSON-RPC message (a 4 MiB JSON
+string decodes to roughly 3 MiB of base64 payload) and matches the TypeScript SDK's 4 MB default; raise it only
+if you exchange unusually large payloads:
 
 ```ruby
-# Session timeout of 30 minutes
-transport = MCP::Server::Transports::StreamableHTTPTransport.new(server, session_idle_timeout: 1800)
+transport = MCP::Server::Transports::StreamableHTTPTransport.new(server, max_request_bytes: 8 * 1024 * 1024)
 ```
 
 ### Pagination
@@ -1958,6 +2027,7 @@ Use the `MCP::Client::Stdio` transport to interact with MCP servers running as s
 | `args:` | No | An array of arguments passed to the command. Defaults to `[]`. |
 | `env:` | No | A hash of environment variables to set for the server process. Defaults to `nil`. |
 | `read_timeout:` | No | Timeout in seconds for waiting for a server response. Defaults to `nil` (no timeout). |
+| `max_line_bytes:` | No | Maximum byte length of a single newline-delimited response frame. A frame that reaches this limit without a newline is rejected as a transport error, preventing unbounded memory growth from a server that never emits a newline. Defaults to `4 * 1024 * 1024` (4 MiB). |
 
 Example usage:
 

data/lib/mcp/client/stdio.rb

@@ -19,13 +19,28 @@ module MCP
       CLOSE_TIMEOUT = 2
       STDERR_READ_SIZE = 4096
 
+      # Default upper bound on a single newline-delimited frame read from the
+      # server's stdout. CRuby's `IO#gets` without a limit accumulates bytes until a
+      # newline arrives, so a spawned server that never emits one can grow a single
+      # String until the host process is OOM-killed. 4 MiB is large enough for any
+      # realistic JSON-RPC frame, including base64-embedded images.
+      MAX_LINE_BYTES = 4 * 1024 * 1024
+
       attr_reader :command, :args, :env, :server_info
 
-      def initialize(command:, args: [], env: nil, read_timeout: nil)
+      def initialize(command:, args: [], env: nil, read_timeout: nil, max_line_bytes: MAX_LINE_BYTES)
+        # Reject `nil` or non-positive values: `IO#gets("\n", nil)` and a negative
+        # limit read without an upper bound, which would silently disable the
+        # protection this option exists to provide.
+        unless max_line_bytes.is_a?(Integer) && max_line_bytes > 0
+          raise ArgumentError, "max_line_bytes must be a positive Integer"
+        end
+
         @command = command
         @args = args
         @env = env
         @read_timeout = read_timeout
+        @max_line_bytes = max_line_bytes
         @stdin = nil
         @stdout = nil
         @stderr = nil
@@ -128,9 +143,7 @@ module MCP
         @server_info
       end
 
-      # Returns true once `connect` (or the implicit handshake on the first
-      # `send_request`) has completed. Returns false before the handshake
-      # and after `close`.
+      # Returns true once `connect` has completed the handshake. Returns false before the handshake and after `close`.
       def connected?
         @initialized
       end
@@ -140,11 +153,7 @@ module MCP
       # write does not race ahead of the request write on the wire. The yield happens inside `@write_mutex`,
       # so any subsequent `send_notification` write waits for the mutex and is guaranteed to land after the request.
       def send_request(request:)
-        start unless @started
-        unless @initialized
-          warn("Calling `MCP::Client::Stdio#send_request` without calling `MCP::Client#connect` is deprecated. Use `MCP::Client#connect` before sending requests instead.", uplevel: 1)
-          connect
-        end
+        raise "MCP::Client#connect must be called before sending requests." unless @initialized
 
         @write_mutex.synchronize do
           write_message(request)
@@ -245,7 +254,7 @@ module MCP
         loop do
           ensure_running!
           wait_for_readable!(method, params) if @read_timeout
-          line = @stdout.gets
+          line = read_line(method, params)
           raise_connection_error!(method, params) if line.nil?
 
           parsed = JSON.parse(line.strip)
@@ -284,6 +293,31 @@ module MCP
         )
       end
 
+      # Reads one newline-delimited frame from the server's stdout, bounded by `@max_line_bytes`.
+      # Returns the line (including its trailing newline) or `nil` at EOF. Raises when the limit
+      # is reached before a newline arrives, which signals a server streaming an unbounded frame.
+      # A short final frame without a trailing newline (EOF) is still returned, since its length
+      # stays under the limit.
+      def read_line(method, params)
+        line = @stdout.gets("\n", @max_line_bytes)
+        return line unless line && !line.end_with?("\n") && line.bytesize >= @max_line_bytes
+
+        # The over-limit frame leaves leftover bytes in the pipe, so the stream is desynced and
+        # cannot be resumed. Close before raising so a later `send_request` fails cleanly instead
+        # of parsing a truncated frame.
+        begin
+          close
+        rescue StandardError
+          nil
+        end
+
+        raise RequestHandlerError.new(
+          "Server response frame exceeds #{@max_line_bytes} bytes without a newline",
+          { method: method, params: params },
+          error_type: :internal_error,
+        )
+      end
+
       def raise_connection_error!(method, params)
         raise RequestHandlerError.new(
           "Server process closed stdout unexpectedly",

data/lib/mcp/methods.rb

@@ -47,6 +47,10 @@ module MCP
     end
 
     class << self
+      def notification?(method)
+        method.is_a?(String) && method.start_with?("notifications/")
+      end
+
       def ensure_capability!(method, capabilities)
         case method
         when PROMPTS_GET, PROMPTS_LIST

data/lib/mcp/server/transports/stdio_transport.rb

@@ -9,10 +9,25 @@ module MCP
       class StdioTransport < Transport
         STATUS_INTERRUPTED = Signal.list["INT"] + 128
 
-        def initialize(server)
+        # Default upper bound on a single newline-delimited frame. CRuby's `IO#gets`
+        # without a limit accumulates bytes until a newline arrives, so a peer that
+        # never emits one can grow a single String until the process is OOM-killed.
+        # 4 MiB is large enough for any realistic JSON-RPC frame, including
+        # base64-embedded images.
+        MAX_LINE_BYTES = 4 * 1024 * 1024
+
+        def initialize(server, max_line_bytes: MAX_LINE_BYTES)
           super(server)
           @open = false
           @session = nil
+          # Reject `nil` or non-positive values: `IO#gets("\n", nil)` and a negative
+          # limit read without an upper bound, which would silently disable the
+          # protection this option exists to provide.
+          unless max_line_bytes.is_a?(Integer) && max_line_bytes > 0
+            raise ArgumentError, "max_line_bytes must be a positive Integer"
+          end
+
+          @max_line_bytes = max_line_bytes
           $stdin.set_encoding("UTF-8")
           $stdout.set_encoding("UTF-8")
         end
@@ -20,7 +35,20 @@ module MCP
         def open
           @open = true
           @session = ServerSession.new(server: @server, transport: self)
-          while @open && (line = $stdin.gets)
+          while @open
+            begin
+              line = read_line($stdin)
+            rescue RequestHandlerError => e
+              # Stop accumulating and end the connection gracefully rather than
+              # letting an unbounded read exhaust memory or escape as an uncaught
+              # backtrace. Scoped to the read so genuine request errors raised while
+              # handling a frame are not swallowed here.
+              @open = false
+              MCP.configuration.exception_reporter.call(e, { error: "stdio frame exceeds limit" })
+              break
+            end
+            break if line.nil?
+
             response = @session.handle_json(line.strip)
             send_response(response) if response
           end
@@ -73,7 +101,7 @@ module MCP
             raise
           end
 
-          while @open && (line = $stdin.gets)
+          while @open && (line = read_line($stdin))
             begin
               parsed = JSON.parse(line.strip, symbolize_names: true)
             rescue JSON::ParserError => e
@@ -95,6 +123,26 @@ module MCP
 
           raise "Transport closed while waiting for response to #{method} request."
         end
+
+        private
+
+        # Reads one newline-delimited frame, bounded by `@max_line_bytes`. Returns
+        # the line (including its trailing newline) or `nil` at EOF. Raises when the
+        # limit is reached before a newline arrives, which signals a peer streaming
+        # an unbounded frame. A short final frame without a trailing newline (EOF) is
+        # still returned, since its length stays under the limit.
+        def read_line(io)
+          line = io.gets("\n", @max_line_bytes)
+          if line && !line.end_with?("\n") && line.bytesize >= @max_line_bytes
+            raise RequestHandlerError.new(
+              "stdio frame exceeds #{@max_line_bytes} bytes without a newline",
+              nil,
+              error_type: :internal_error,
+            )
+          end
+
+          line
+        end
       end
     end
   end

data/lib/mcp/server/transports/streamable_http_transport.rb

@@ -24,17 +24,97 @@ module MCP
           "Connection" => "keep-alive",
         }.freeze
 
-        def initialize(server, stateless: false, enable_json_response: false, session_idle_timeout: nil)
+        # Secure defaults for stateful mode. Without a finite idle timeout, sessions live until an explicit client DELETE,
+        # so an unauthenticated `initialize` flood retains unbounded `ServerSession` objects until memory is exhausted.
+        # These defaults expire idle sessions and cap the concurrent count, like the C# SDK (the only reference SDK that
+        # hardens this by default, with a 2h idle timeout and a 10k idle-session count). One difference: at the cap this transport
+        # rejects a new `initialize` with 503 (after reclaiming any already-expired slots), whereas the C# SDK evicts
+        # the oldest idle session. Rejecting keeps established sessions stable and avoids evicting a legitimate idle session on
+        # an attacker's behalf, at the cost of refusing new sessions while genuinely full. Pass `session_idle_timeout: nil` to
+        # opt out of expiry and `max_sessions: nil` to opt out of the cap.
+        DEFAULT_SESSION_IDLE_TIMEOUT = 1800
+        DEFAULT_MAX_SESSIONS = 10_000
+
+        # Distinguishes "argument omitted, apply the secure default" from an explicit `nil` (opt out of expiry).
+        UNSET_IDLE_TIMEOUT = Object.new.freeze
+        private_constant :UNSET_IDLE_TIMEOUT
+
+        # Default upper bound on the JSON-RPC request body. `handle_post` reads the whole
+        # body into memory and parses it, so without a cap a single unauthenticated POST
+        # can allocate gigabytes and OOM the worker. 4 MiB comfortably
+        # fits a typical JSON-RPC request (a 4 MiB JSON string decodes to ~3 MiB of base64
+        # payload); raise `max_request_bytes:` for unusually large payloads. Matches the
+        # TypeScript SDK's 4 MB default.
+        DEFAULT_MAX_REQUEST_BYTES = 4 * 1024 * 1024
+
+        # Conservative bound on JSON nesting depth, so a deeply nested body cannot exhaust
+        # the stack or amplify parse cost (complements the byte cap).
+        MAX_JSON_NESTING = 64
+
+        # Creates a Streamable HTTP transport that can be mounted as a Rack app.
+        #
+        # @param server [MCP::Server] the server whose requests this transport dispatches.
+        # @param stateless [Boolean] when `true`, no session is issued and each POST is self-contained.
+        # @param enable_json_response [Boolean] when `true`, a request is answered with a single JSON
+        #   object instead of an SSE stream.
+        # @param session_idle_timeout [Numeric, nil] seconds before an idle session is reaped; defaults
+        #   to `DEFAULT_SESSION_IDLE_TIMEOUT` (1800) in stateful mode, and an explicit `nil` disables
+        #   expiry. Not supported in stateless mode.
+        # @param max_sessions [Integer, nil] cap on the concurrent session count in stateful mode; a new
+        #   `initialize` past the cap is rejected with HTTP 503, and `nil` disables the cap.
+        # @param allowed_origins [Array<String>, nil] extra `Origin` values accepted in addition to
+        #   same-origin requests, for DNS rebinding protection.
+        # @param allowed_hosts [Array<String>, nil] extra `Host` values accepted beyond the loopback
+        #   defaults (`127.0.0.1`, `::1`, `localhost`); each entry matches a bare host name (any port)
+        #   or a full `host:port`.
+        # @param dns_rebinding_protection [Boolean] when `true` (default), validates the `Host` and
+        #   `Origin` headers to prevent DNS rebinding; pass `false` when an upstream proxy already
+        #   validates them.
+        # @param session_request_validator [#call, nil] An optional
+        #   `->(request, session_id) { true | false }` invoked on every non-`initialize` POST, GET, and DELETE
+        #   against an existing session (regular requests, notifications, and client responses alike).
+        #   Returning a falsy value rejects the request with HTTP 403. The SDK issues a random `SecureRandom.uuid`
+        #   session ID and otherwise only checks existence/idle-timeout, so binding a session to a user is
+        #   the deploying application's responsibility (the transport never receives the authenticated identity
+        #   on its own); this is the seam to enforce ownership and mitigate session poisoning. Without a validator,
+        #   ownership is not enforced.
+        # @param max_request_bytes [Integer] upper bound in bytes on a POST request body; larger
+        #   requests are rejected with HTTP 413. Defaults to 4 MiB.
+        def initialize(
+          server,
+          stateless: false,
+          enable_json_response: false,
+          session_idle_timeout: UNSET_IDLE_TIMEOUT,
+          max_sessions: DEFAULT_MAX_SESSIONS,
+          allowed_origins: nil,
+          allowed_hosts: nil,
+          dns_rebinding_protection: true,
+          session_request_validator: nil,
+          max_request_bytes: DEFAULT_MAX_REQUEST_BYTES
+        )
           super(server)
-          # Maps `session_id` to `{ get_sse_stream: stream_object, server_session: ServerSession, last_active_at: float_from_monotonic_clock }`.
+          # Maps `session_id` to `{ get_sse_stream: stream_object, server_session: ServerSession, last_active_at: float_from_monotonic_clock, origin: origin_header }`.
           @sessions = {}
           @mutex = Mutex.new
 
           @stateless = stateless
           @enable_json_response = enable_json_response
-          @session_idle_timeout = session_idle_timeout
+          @session_request_validator = session_request_validator
+          @dns_rebinding_protection = dns_rebinding_protection
+
+          # Host names are case-insensitive, so the allow lists are compared down-cased.
+          @allowed_hosts = (DEFAULT_LOOPBACK_HOSTS + Array(allowed_hosts)).map(&:downcase).freeze
+          @allowed_origins = Array(allowed_origins).map(&:downcase).freeze
           @pending_responses = {}
 
+          # Resolve the idle timeout: an explicit value (including `nil` to opt out) wins; otherwise apply the secure default,
+          # which does not apply to stateless mode since it retains no sessions.
+          @session_idle_timeout = if session_idle_timeout.equal?(UNSET_IDLE_TIMEOUT)
+            stateless ? nil : DEFAULT_SESSION_IDLE_TIMEOUT
+          else
+            session_idle_timeout
+          end
+
           if @session_idle_timeout
             if @stateless
               raise ArgumentError, "session_idle_timeout is not supported in stateless mode."
@@ -43,6 +123,19 @@ module MCP
             end
           end
 
+          unless max_sessions.nil? || (max_sessions.is_a?(Integer) && max_sessions > 0)
+            raise ArgumentError, "max_sessions must be a positive Integer or nil"
+          end
+
+          # The cap guards the stateful session store; stateless mode keeps none.
+          @max_sessions = stateless ? nil : max_sessions
+
+          unless max_request_bytes.is_a?(Integer) && max_request_bytes > 0
+            raise ArgumentError, "max_request_bytes must be a positive Integer"
+          end
+
+          @max_request_bytes = max_request_bytes
+
           start_reaper_thread if @session_idle_timeout
         end
 
@@ -52,12 +145,19 @@ module MCP
         STREAM_WRITE_ERRORS = [IOError, Errno::EPIPE, Errno::ECONNRESET].freeze
         SESSION_REAP_INTERVAL = 60
 
+        # Loopback hosts always accepted by DNS rebinding protection. A locally bound MCP server (the canonical pattern) is
+        # protected out of the box; non-loopback deployments widen the list via `allowed_hosts:`.
+        DEFAULT_LOOPBACK_HOSTS = ["127.0.0.1", "::1", "localhost"].freeze
+
         # Rack app interface. This transport can be mounted as a Rack app.
         def call(env)
           handle_request(Rack::Request.new(env))
         end
 
         def handle_request(request)
+          rebinding_error = validate_dns_rebinding(request)
+          return rebinding_error if rebinding_error
+
           case request.env["REQUEST_METHOD"]
           when "POST"
             handle_post(request)
@@ -340,7 +440,9 @@ module MCP
           content_type_error = validate_content_type(request)
           return content_type_error if content_type_error
 
-          body_string = request.body.read
+          body_string = read_bounded_body(request)
+          return payload_too_large_response if body_string.nil?
+
           session_id = extract_session_id(request)
 
           begin
@@ -378,16 +480,25 @@ module MCP
               return session_not_found_response
             end
 
-            handle_initialization(body_string, body)
-          elsif notification?(body)
-            dispatch_notification(body_string, session_id)
-            handle_accepted
-          elsif response?(body)
-            return session_not_found_response if !@stateless && !session_exists?(session_id)
-
-            handle_response(body, session_id: session_id)
+            handle_initialization(request, body_string, body)
           else
-            handle_regular_request(body_string, session_id, related_request_id: body[:id])
+            # Ownership gate for every request against an existing session, applied uniformly to notifications, client responses,
+            # and regular requests. This covers write paths beyond tool calls - notably `notifications/cancelled`, which would
+            # otherwise let a stolen session ID cancel a victim's in-flight request. `initialize` is exempt (it establishes the session).
+            if !@stateless && session_id && !validate_session_request(request, session_id)
+              return forbidden_response
+            end
+
+            if notification?(body)
+              dispatch_notification(body_string, session_id)
+              handle_accepted
+            elsif response?(body)
+              return session_not_found_response if !@stateless && !session_exists?(session_id)
+
+              handle_response(body, session_id: session_id)
+            else
+              handle_regular_request(body_string, session_id, related_request_id: body[:id])
+            end
           end
         rescue StandardError => e
           MCP.configuration.exception_reporter.call(e, { request: body_string })
@@ -412,6 +523,7 @@ module MCP
 
           error_response = validate_and_touch_session(session_id)
           return error_response if error_response
+          return forbidden_response unless validate_session_request(request, session_id)
 
           protocol_version_error = validate_protocol_version_header(request)
           return protocol_version_error if protocol_version_error
@@ -434,6 +546,7 @@ module MCP
 
           return missing_session_id_response unless (session_id = extract_session_id(request))
           return session_not_found_response unless session_exists?(session_id)
+          return forbidden_response unless validate_session_request(request, session_id)
 
           protocol_version_error = validate_protocol_version_header(request)
           return protocol_version_error if protocol_version_error
@@ -495,6 +608,27 @@ module MCP
           request.env["HTTP_MCP_SESSION_ID"]
         end
 
+        # Session-ownership gate for requests against an existing session (the spec's session-binding guidance).
+        # The session ID alone is unguessable but not proof of ownership, so a stolen ID must not silently grant access.
+        # Two layers, both returning `false` to trigger a 403:
+        #
+        # - Built-in Origin consistency (defense in depth, not authentication): if the session recorded an `Origin`
+        #   at `initialize` and this request carries a different one, reject. Both must be present to compare,
+        #   so non-browser clients that send no `Origin` are unaffected.
+        # - The application-supplied `session_request_validator`, which can enforce true ownership when it has
+        #   an authenticated principal.
+        def validate_session_request(request, session_id)
+          session = @mutex.synchronize { @sessions[session_id] }
+          return true unless session
+
+          session_origin = session[:origin]
+          request_origin = request.env["HTTP_ORIGIN"]
+          return false if session_origin && request_origin && session_origin != request_origin
+          return @session_request_validator.call(request, session_id) if @session_request_validator
+
+          true
+        end
+
         def validate_accept_header(request, required_types)
           accept_header = request.env["HTTP_ACCEPT"]
           return not_acceptable_response(required_types) unless accept_header
@@ -534,8 +668,34 @@ module MCP
           )
         end
 
+        # Reads the request body with a hard byte cap so an unbounded POST cannot exhaust
+        # memory. A declared `Content-Length` over the cap is rejected
+        # without reading; the actual read is also bounded to one byte past the cap, so
+        # a missing or spoofed `Content-Length` (e.g. chunked transfer) is still caught.
+        # Returns `nil` when the body exceeds the cap.
+        def read_bounded_body(request)
+          content_length = request.content_length
+          return if content_length && content_length.to_i > @max_request_bytes
+
+          body = request.body.read(@max_request_bytes + 1)
+          return "" if body.nil?
+          return if body.bytesize > @max_request_bytes
+
+          body
+        end
+
+        def payload_too_large_response
+          json_rpc_error_response(
+            status: 413,
+            code: JsonRpcHandler::ErrorCode::INVALID_REQUEST,
+            message: "Payload too large: request body exceeds #{@max_request_bytes} bytes",
+          )
+        end
+
         def parse_request_body(body_string)
-          JSON.parse(body_string, symbolize_names: true)
+          # `max_nesting` bounds parse depth; a too-deep body raises `JSON::NestingError`,
+          # a subclass of `JSON::ParserError`, so it is caught below as a parse error.
+          JSON.parse(body_string, symbolize_names: true, max_nesting: MAX_JSON_NESTING)
         rescue JSON::ParserError, TypeError
           raise InvalidJsonError
         end
@@ -613,7 +773,7 @@ module MCP
           handle_accepted
         end
 
-        def handle_initialization(body_string, body)
+        def handle_initialization(request, body_string, body)
           session_id = nil
 
           if @stateless
@@ -622,13 +782,33 @@ module MCP
             session_id = SecureRandom.uuid
             server_session = ServerSession.new(server: @server, transport: self, session_id: session_id)
 
-            @mutex.synchronize do
+            # Cap the concurrent session count so an `initialize` flood cannot retain unbounded sessions until memory is exhausted.
+            # The check and insert share the mutex so concurrent initializes cannot race past the limit.
+            reclaimed = []
+            inserted = @mutex.synchronize do
+              # When at the cap, first reclaim slots held by already-expired sessions the 60s reaper has not yet collected,
+              # so the cap rejects only when genuinely full rather than up to a reaper interval after sessions expired.
+              if @max_sessions && @sessions.size >= @max_sessions
+                @sessions.each_key.select { |id| session_expired?(@sessions[id]) }.each do |id|
+                  cleanup_and_collect_stream(id, reclaimed)
+                end
+              end
+
+              next false if @max_sessions && @sessions.size >= @max_sessions
+
               @sessions[session_id] = {
                 get_sse_stream: nil,
                 server_session: server_session,
                 last_active_at: Process.clock_gettime(Process::CLOCK_MONOTONIC),
+                # Captured for the built-in Origin-consistency defense in `validate_session_request`.
+                # Not authentication.
+                origin: request.env["HTTP_ORIGIN"],
               }
+              true
             end
+
+            reclaimed.each { |stream| close_stream_safely(stream) }
+            return too_many_sessions_response unless inserted
           end
 
           response = server_session.handle_json(body_string)
@@ -655,6 +835,14 @@ module MCP
           [202, {}, []]
         end
 
+        def too_many_sessions_response
+          json_rpc_error_response(
+            status: 503,
+            code: JsonRpcHandler::ErrorCode::INTERNAL_ERROR,
+            message: "Service unavailable: maximum concurrent sessions (#{@max_sessions}) reached",
+          )
+        end
+
         def handle_regular_request(body_string, session_id, related_request_id: nil)
           server_session = nil
 
@@ -808,6 +996,74 @@ module MCP
           active
         end
 
+        # Per MCP 2025-11-25, servers MUST validate the `Origin` header and SHOULD bind only to localhost
+        # to prevent DNS rebinding attacks against locally bound MCP servers. Protection is on by default;
+        # pass `dns_rebinding_protection: false` to disable it (e.g. when an upstream proxy or middleware already
+        # performs the check). The `Host` header is validated against the loopback defaults plus `allowed_hosts:`,
+        # and the `Origin` header, when present, must be same-origin or in `allowed_origins:`.
+        def validate_dns_rebinding(request)
+          return unless @dns_rebinding_protection
+
+          validate_host(request) || validate_origin(request)
+        end
+
+        # Rejects a rebound `Host` (e.g. `evil.example.com` re-pointed at 127.0.0.1).
+        # A request without a `Host` header (e.g. HTTP/1.0) is allowed; the rebinding vector this guards against always carries one.
+        def validate_host(request)
+          host = request.env["HTTP_HOST"]
+          return if host.nil?
+
+          # An `allowed_hosts:` entry matches either the bare host name (any port)
+          # or the full `host:port` value, so both `"app.example.com"` and
+          # `"app.example.com:8443"` can be configured.
+          normalized = host.downcase
+          return if @allowed_hosts.include?(request_hostname(normalized)) || @allowed_hosts.include?(normalized)
+
+          forbidden_response("Forbidden: Invalid Host header")
+        end
+
+        # A request without an `Origin` header (typical for non-browser MCP clients) is allowed. A browser cross-origin request is
+        # rejected unless the origin is same-origin or explicitly allow-listed via `allowed_origins:`.
+        def validate_origin(request)
+          origin = request.env["HTTP_ORIGIN"]
+          return if origin.nil?
+          return if same_origin?(origin, request)
+          return if @allowed_origins.include?(origin.downcase)
+
+          forbidden_response("Forbidden: Invalid Origin header")
+        end
+
+        # Extracts the host name from a `Host` header value, stripping any port and IPv6 brackets
+        # (`[::1]:8080` becomes `::1`, `127.0.0.1:8080` becomes `127.0.0.1`).
+        def request_hostname(host)
+          return host[/\A\[([^\]]+)\]/, 1] if host.start_with?("[")
+
+          host.split(":").first
+        end
+
+        # Compares the `Origin` authority (host:port) against the request's own `Host`.
+        # Scheme is not compared (the `Host` header carries none, and `request.scheme` is unreliable behind proxies),
+        # but the `Origin`'s scheme is used to drop a redundant default port (`:80` for http, `:443` for https) from
+        # both sides so `http://example.com` matches `Host: example.com:80`. Comparison is case-insensitive.
+        def same_origin?(origin, request)
+          host = request.env["HTTP_HOST"]
+          return false if host.nil?
+
+          normalized = origin.downcase
+          default_port = normalized.start_with?("https://") ? ":443" : ":80"
+          authority = normalized.sub(%r{\Ahttps?://}, "")
+
+          authority.delete_suffix(default_port) == host.downcase.delete_suffix(default_port)
+        end
+
+        def forbidden_response(message = "Forbidden: session request validation failed")
+          json_rpc_error_response(
+            status: 403,
+            code: JsonRpcHandler::ErrorCode::INVALID_REQUEST,
+            message: message,
+          )
+        end
+
         def method_not_allowed_response
           json_rpc_error_response(
             status: 405,

data/lib/mcp/server.rb

@@ -256,6 +256,9 @@ module MCP
       report_exception(e, { notification: "resources_list_changed" })
     end
 
+    # @deprecated MCP Logging (`logging/setLevel` and `notifications/message`)
+    #   is deprecated as of MCP protocol version 2026-07-28 (SEP-2577).
+    #   Use stderr or OpenTelemetry instead.
     def notify_log_message(data:, level:, logger: nil)
       return unless @transport
       return unless logging_message_notification&.should_notify?(level)
@@ -272,6 +275,10 @@ module MCP
     # Called when a client notifies the server that its filesystem roots have changed.
     #
     # @yield [params] The notification params (typically `nil`).
+    # @deprecated MCP Roots (`roots/list` and
+    #   `notifications/roots/list_changed`) is deprecated as of MCP protocol
+    #   version 2026-07-28 (SEP-2577). Use tool parameters, resource URIs,
+    #   server configuration, or environment variables instead.
     def roots_list_changed_handler(&block)
       @handlers[Methods::NOTIFICATIONS_ROOTS_LIST_CHANGED] = block
     end
@@ -423,6 +430,13 @@ module MCP
     end
 
     def handle_request(request, method, session: nil, related_request_id: nil)
+      # A well-formed notification carries no JSON-RPC id and receives no response.
+      # If a client erroneously sends a notification-only method with an id, the message
+      # is framed as a request; since notification methods have no request handler,
+      # returning `nil` here makes `JsonRpcHandler` report "Method not found", matching
+      # the TypeScript and Python SDKs rather than emitting a spurious `result: null`.
+      return if Methods.notification?(method) && !related_request_id.nil?
+
       # `notifications/cancelled` is dispatched directly: it is a notification (no JSON-RPC id)
       # and intentionally bypasses the `@handlers` lookup, capability check, in-flight registry,
       # and rescue blocks below.

data/lib/mcp/server_context.rb

@@ -35,6 +35,9 @@ module MCP
     # @param data [Object] The log data to send.
     # @param level [String] Log level (e.g., `"debug"`, `"info"`, `"error"`).
     # @param logger [String, nil] Logger name.
+    # @deprecated MCP Logging (`logging/setLevel` and `notifications/message`)
+    #   is deprecated as of MCP protocol version 2026-07-28 (SEP-2577).
+    #   Use stderr or OpenTelemetry instead.
     def notify_log_message(data:, level:, logger: nil)
       return unless @notification_target
 
@@ -51,6 +54,10 @@ module MCP
     end
 
     # Delegates to the session so the request is scoped to the originating client.
+    # @deprecated MCP Roots (`roots/list` and
+    #   `notifications/roots/list_changed`) is deprecated as of MCP protocol
+    #   version 2026-07-28 (SEP-2577). Use tool parameters, resource URIs,
+    #   server configuration, or environment variables instead.
     def list_roots
       if @notification_target.respond_to?(:list_roots)
         @notification_target.list_roots(related_request_id: @related_request_id)
@@ -84,6 +91,9 @@ module MCP
     # Delegates to the session so the request is scoped to the originating client.
     # Falls back to `@context` (via `method_missing`) when `@notification_target`
     # does not support sampling.
+    # @deprecated MCP Sampling (`sampling/createMessage`) is deprecated as of
+    #   MCP protocol version 2026-07-28 (SEP-2577). Use direct LLM provider
+    #   APIs instead.
     def create_sampling_message(**kwargs)
       if @notification_target.respond_to?(:create_sampling_message)
         @notification_target.create_sampling_message(**kwargs, related_request_id: @related_request_id)

data/lib/mcp/server_session.rb

@@ -98,6 +98,10 @@ module MCP
     end
 
     # Sends a `roots/list` request scoped to this session.
+    # @deprecated MCP Roots (`roots/list` and
+    #   `notifications/roots/list_changed`) is deprecated as of MCP protocol
+    #   version 2026-07-28 (SEP-2577). Use tool parameters, resource URIs,
+    #   server configuration, or environment variables instead.
     def list_roots(related_request_id: nil)
       unless client_capabilities&.dig(:roots)
         raise "Client does not support roots."
@@ -115,6 +119,9 @@ module MCP
     end
 
     # Sends a `sampling/createMessage` request scoped to this session.
+    # @deprecated MCP Sampling (`sampling/createMessage`) is deprecated as of
+    #   MCP protocol version 2026-07-28 (SEP-2577). Use direct LLM provider
+    #   APIs instead.
     def create_sampling_message(related_request_id: nil, **kwargs)
       params = @server.build_sampling_params(client_capabilities, **kwargs)
       send_to_transport_request(Methods::SAMPLING_CREATE_MESSAGE, params, related_request_id: related_request_id)
@@ -188,6 +195,9 @@ module MCP
     end
 
     # Sends a log message notification to this session only.
+    # @deprecated MCP Logging (`logging/setLevel` and `notifications/message`)
+    #   is deprecated as of MCP protocol version 2026-07-28 (SEP-2577).
+    #   Use stderr or OpenTelemetry instead.
     def notify_log_message(data:, level:, logger: nil, related_request_id: nil)
       effective_logging = @logging_message_notification || @server.logging_message_notification
       return unless effective_logging&.should_notify?(level)

data/lib/mcp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MCP
-  VERSION = "0.22.0"
+  VERSION = "0.23.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mcp
 version: !ruby/object:Gem::Version
-  version: 0.22.0
+  version: 0.23.0
 platform: ruby
 authors:
 - Model Context Protocol
@@ -90,7 +90,7 @@ licenses:
 - Apache-2.0
 metadata:
   allowed_push_host: https://rubygems.org
-  changelog_uri: https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.22.0
+  changelog_uri: https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
   homepage_uri: https://ruby.sdk.modelcontextprotocol.io
   source_code_uri: https://github.com/modelcontextprotocol/ruby-sdk
   bug_tracker_uri: https://github.com/modelcontextprotocol/ruby-sdk/issues