mcp 1.6.1 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '08c2de444c55244db435a10ce7b9f9026d24158d47cadd6f89b917f42e09b534'
-  data.tar.gz: 6126a02c9adf92df07f22b323a0337f2abae9eb23c7bf014f1b7ef1ccbbf3a72
+  metadata.gz: 3585a92ae036b5018c7edf6b4c77a4a5c07903084314459a58180df16d3f0e28
+  data.tar.gz: d543ab701b3589e5728dba998e9b7d66b52baabfa4e9cf272834024bc57340a0
 SHA512:
-  metadata.gz: 7318acb46d46e9c958115f95171f21b20c186ab32608770d443440e0202d29319b9384b11099ed69f136c3ba9146be39998e1a9a47a839fe506e07cddca0ad89
-  data.tar.gz: 3008f7f6061e0a2cd514d377ade38a03be1ed88d863fb268e50c9820ece43f585b7fcc801bc6c0ffcf78fab3a80af3397c20e497722a6821c55d6128d391d4fc
+  metadata.gz: 2d8cdd94c440d86ed5c317cc4bd94b21279ea613be75956bc49de0ddb008a0b574f3ee15751053be78c249d420709a168f0810674dbeeea34d9cd359dd9ac2f0
+  data.tar.gz: 9f131703b9db0f7fdfbc0a57ffe7b4132c522720bf841aaa4d70f20487644fe6ef428f89f4f39d4c1044312045553356fe87c3684f1deadc95dc81b45e441d42

data/README.md

@@ -6,7 +6,7 @@ Detailed guides are available at https://ruby.sdk.modelcontextprotocol.io.
 
 ## Features
 
-- Build [MCP servers](https://ruby.sdk.modelcontextprotocol.io/server/) that expose tools, prompts, and resources to any MCP host
+- Build [MCP servers](https://ruby.sdk.modelcontextprotocol.io/server/) that expose tools, prompts, and resources to any MCP host, with OAuth 2.1 resource-server protection
 - Build [MCP clients](https://ruby.sdk.modelcontextprotocol.io/client/) that connect to any MCP server, with automatic lifecycle negotiation and OAuth 2.1 authorization
 - Speak every standard transport: stdio and Streamable HTTP (including SSE), with a Rails integration
 - Cover the full protocol surface: server-to-client requests, multi round-trip requests, notifications, progress, logging, cancellation, completions, and pagination

data/lib/mcp/client/http.rb

@@ -202,9 +202,10 @@ module MCP
 
             if parsed.key?("result") || parsed.key?("error")
               @response ||= parsed
-            elsif parsed["method"] && parsed.key?("id")
-              # A server-to-client request (e.g. `elicitation/create`) delivered
-              # on the stream while the original request is still pending.
+            elsif parsed["method"] && parsed.key?("id") && JsonRpcHandler.valid_version?(parsed["jsonrpc"])
+              # A server-to-client request (e.g. `elicitation/create`) delivered on the stream while
+              # the original request is still pending. One that is not JSON-RPC 2.0 is dropped unanswered,
+              # as the TypeScript client drops it at schema validation.
               @on_request&.call(parsed)
             end
           end
@@ -399,6 +400,7 @@ module MCP
           )
         end
 
+        request_id = request[:id] || request["id"]
         method = request[:method] || request["method"]
         params = request[:params] || request["params"]
         oauth_retried = false
@@ -417,14 +419,20 @@ module MCP
           yield if block_given?
 
           response = begin
-            client.post("", request, session_headers.merge(request_metadata_headers(method, params))) do |req|
-              req.options.on_data = stream.on_data
+            redacting_authorization_header do
+              client.post("", request, session_headers.merge(request_metadata_headers(method, params))) do |req|
+                req.options.on_data = stream.on_data
+              end
             end
           rescue StreamAbort
             nil
           end
 
-          body = resolve_response_body(stream, response, method, params)
+          body = resolve_response_body(stream, response, request_id, method, params)
+
+          # Every way a response arrives (JSON body, SSE event, resumed stream) ends here. Checked before
+          # anything is learned from the body, and only for a request: a notification awaits no response.
+          reject_invalid_response!(body, method, params) if request_id
 
           capture_session_info(method, response, body) if response
           capture_mcp_param_declarations(method, params, body)
@@ -522,7 +530,7 @@ module MCP
       def send_notification(notification:)
         method = notification[:method] || notification["method"]
 
-        client.post("", notification, session_headers)
+        redacting_authorization_header { client.post("", notification, session_headers) }
         nil
       rescue Faraday::Error => e
         raise RequestHandlerError.new(
@@ -550,7 +558,7 @@ module MCP
         end
 
         begin
-          client.delete("", nil, session_headers)
+          redacting_authorization_header { client.delete("", nil, session_headers) }
         rescue Faraday::ClientError => e
           raise unless [404, 405].include?(e.response&.dig(:status))
         ensure
@@ -902,15 +910,25 @@ module MCP
         MCP::Client::OAuth::Discovery.parse_www_authenticate(header)
       end
 
+      # A provider without a `callback_handler` finishes the authorization in the request that receives the redirect,
+      # not here, so there is nothing to retry with yet: the pending authorization surfaces as
+      # `Flow::AuthorizationPendingError`, and requests made after `Flow#finish!` pick up the stored tokens.
       def run_full_authorization_flow!(flow:, params:)
         # Use the URL snapshotted at `initialize` time so a post-construction
         # mutation of `@url` cannot redirect PRM/AS discovery and the authorize
         # URL to an attacker-controlled host.
-        flow.run!(
+        result = flow.run!(
           server_url: @oauth_server_url,
           resource_metadata_url: params["resource_metadata"],
           scope: params["scope"],
         )
+        return unless result == :redirect
+
+        raise MCP::Client::OAuth::Flow::AuthorizationPendingError.new(
+          "Authorization is pending: the user was sent to the authorization server, and the request can be retried " \
+            "once `MCP::Client::OAuth::Flow#finish!` completes the authorization with the redirect's query.",
+          authorization_url: flow.authorization_url,
+        )
       end
 
       # Tries to swap a saved `refresh_token` for a fresh access token. Returns truthy
@@ -1035,6 +1053,51 @@ module MCP
         [deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC), 0.001].max
       end
 
+      # Runs a request on the transport's connection and, when Faraday raises, replaces the value of the `Authorization` header
+      # in the request headers the exception retains before it leaves the transport.
+      # Faraday's `raise_error` middleware keeps a reference to `env.request_headers` in `Faraday::Error#response`
+      # under `:request`, so the exception that becomes `RequestHandlerError#original_error` (and its `cause`) would otherwise print
+      # the bearer token through `inspect`, which is what error reporters and log lines do with it. The request is complete by
+      # the time the exception surfaces, and every request builds its own headers from the connection's defaults,
+      # so the rewrite reaches neither those defaults nor a later request.
+      def redacting_authorization_header
+        yield
+      rescue Faraday::Error => e
+        redact_authorization_header!(e)
+        raise
+      end
+
+      # `raise_error` retains the request as a Hash under `:request`; a JSON middleware the customizer added raises
+      # `Faraday::ParsingError` with the `Faraday::Response` itself, whose `env` holds the request headers.
+      def redact_authorization_header!(error)
+        response = error.response
+
+        if response.is_a?(Hash)
+          request = response[:request]
+          redact_authorization_header_in!(request, :headers) if request.is_a?(Hash)
+        elsif response.respond_to?(:env) && response.env.respond_to?(:request_headers)
+          redact_authorization_header_in!(response.env, :request_headers)
+        end
+      end
+
+      # The headers are a `Faraday::Utils::Headers`, which spells the name `Authorization` whatever the caller wrote,
+      # unless a customizer middleware replaced them with a plain Hash or froze them: the name is matched regardless
+      # of case so such a Hash is covered too, and a frozen object is swapped for a copy, so the redaction never
+      # raises in place of the error it is redacting.
+      def redact_authorization_header_in!(holder, key)
+        headers = holder[key]
+        return unless headers.is_a?(Hash)
+
+        names = headers.each_key.select { |name| name.to_s.casecmp?("authorization") }
+        return if names.empty?
+
+        headers = holder[key] = headers.dup if headers.frozen?
+
+        names.each do |name|
+          headers[name] = "[redacted]"
+        end
+      end
+
       def require_faraday!
         require "faraday"
       rescue LoadError
@@ -1044,8 +1107,11 @@ module MCP
       end
 
       # Determines the logical JSON-RPC body of the exchange after the POST stream finished
-      # (or was aborted because the response already arrived).
-      def resolve_response_body(stream, response, method, params)
+      # (or was aborted because the response already arrived). A notification (no `request_id`) awaits
+      # no response, so any success status acknowledges it, as it does for the TypeScript and Python clients,
+      # which check the content type of a response only for a request; the spec has the server answer
+      # a notification with 202, but a server answering with another 2xx is accepted as well.
+      def resolve_response_body(stream, response, request_id, method, params)
         return stream.response if stream.response
 
         # 202 Accepted is the server's ACK for a JSON-RPC notification or response; no body is expected.
@@ -1063,6 +1129,9 @@ module MCP
             return stream.response if stream.response
           end
 
+          # A stream that ends without a response has acknowledged a notification; there is nothing to resume for.
+          return if request_id.nil? && response.success?
+
           # SEP-1699: a graceful close after a priming event (an event with an id) but before
           # the response means "reconnect via GET to resume".
           return await_response_after_disconnect(stream, method, params) if stream.primed?
@@ -1079,6 +1148,8 @@ module MCP
           # added by the Faraday customizer may have parsed it already.
           response.body.is_a?(String) ? parse_json_buffer(response.body, method, params) : response.body
         else
+          return if request_id.nil? && response.success?
+
           raise RequestHandlerError.new(
             "Unsupported Content-Type: #{content_type.inspect}. Expected application/json or text/event-stream.",
             { method: method, params: params },
@@ -1147,7 +1218,7 @@ module MCP
       end
 
       def send_client_response(response)
-        client.post("", response, session_headers)
+        redacting_authorization_header { client.post("", response, session_headers) }
       end
 
       def parse_json_buffer(buffer, method, params)
@@ -1162,6 +1233,20 @@ module MCP
         )
       end
 
+      # A response is a JSON object whose `jsonrpc` is exactly "2.0". No body at all (202, or an empty 200)
+      # is not a message and is left to the caller as before; a JSON `null` body parses to the same `nil`.
+      # The received value is left out of the message because it can be any JSON value.
+      def reject_invalid_response!(body, method, params)
+        return if body.nil?
+        return if body.is_a?(Hash) && JsonRpcHandler.valid_version?(body["jsonrpc"])
+
+        raise RequestHandlerError.new(
+          'Server response is not a valid JSON-RPC 2.0 message: "jsonrpc" must be "2.0"',
+          { method: method, params: params },
+          error_type: :parse_error,
+        )
+      end
+
       # SEP-1699 resumability: the server closed the SSE stream after a priming event
       # without delivering the response. Treat the graceful close like a network failure:
       # wait the `retry:` interval the server asked for (default 1000ms), then reconnect with
@@ -1196,12 +1281,14 @@ module MCP
           read_timeout = remaining_reconnection_budget(deadline)
 
           reconnect_response = begin
-            client.get("") do |req|
-              req.headers.update(session_headers)
-              req.headers["Accept"] = SSE_ACCEPT_HEADER
-              req.headers[LAST_EVENT_ID_HEADER] = stream.last_event_id if stream.last_event_id
-              req.options.read_timeout = read_timeout
-              req.options.on_data = stream.on_data
+            redacting_authorization_header do
+              client.get("") do |req|
+                req.headers.update(session_headers)
+                req.headers["Accept"] = SSE_ACCEPT_HEADER
+                req.headers[LAST_EVENT_ID_HEADER] = stream.last_event_id if stream.last_event_id
+                req.options.read_timeout = read_timeout
+                req.options.on_data = stream.on_data
+              end
             end
           rescue StreamAbort
             # The awaited response arrived on the reconnected stream.