mcp 0.24.0 → 0.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4773bb2a9b8bce187692737d82d8ba204da880a68255258bc1bc697ee994d356
-  data.tar.gz: e27c758cacba095342a7b8a7b1feb7299298773d0399676f5ee3827322765fd5
+  metadata.gz: 829c2bc3c3644f2a7edcf5fd44b96d87887c37da3a4cf4766eed79a2676425ee
+  data.tar.gz: 1a168f15a16ad704db47e8c8c2aa7be3f4f869af2a5199fa54d44b4a05990aa0
 SHA512:
-  metadata.gz: 83c6b8ab2f63916f03f6d79a5e0f8e572f828d5153f0ee3dcb43e002c97b46a9e686959dd0e8e46a620b5155b456739a4ffd78dc51093898c56ddf2c6a21f99c
-  data.tar.gz: 46687cedce187961437298f5d9d4a807e058099a8c8e4f7793473999eb79a4dc70cf3a9cceaad8a3c8df4c20e4bebc85e7995844f413e64c6d4109918ffa856f
+  metadata.gz: e6ca51112faf60a4a2b9f5be2db20f9fe25b6581ca327708f483c03f021b9a68ce8df8c3342e5430132ac670103a26d4ac2f9617e3e0358e074745d6fa4c7743
+  data.tar.gz: a57eea28ea7e173422e855702789780381032e888bed42eb42900251e05f8a2806df4220c50c0727423d6c5a8e9124127cdc53e9e9bf34170e6a7c2afa058e7a

data/README.md

@@ -2318,6 +2318,10 @@ response = client.call_tool(
 
 The server will send `notifications/progress` back to the client during execution.
 
+`MCP::Client::HTTP.new` accepts an optional `max_message_bytes:` keyword that caps the bytes buffered in memory for a single message from the server -
+an SSE event or a JSON response body. A message that reaches this limit before completing is rejected as a transport error, preventing unbounded memory growth from
+a server that never terminates an SSE event. It defaults to `4 * 1024 * 1024` (4 MiB); raise it if your server returns larger responses.
+
 #### Server-to-Client Requests (Elicitation)
 
 Servers can send requests back to the client while one of the client's own requests is in flight - for example,
@@ -2342,6 +2346,44 @@ since servers deliver requests that are not tied to a client request on that str
 a JSON-RPC `-32601` (method not found) error. To handle methods other than `elicitation/create`, register directly on the transport with
 `http_transport.on_server_request("method/name") { |params| ... }`.
 
+#### Server-to-Client Requests (Sampling)
+
+Servers can also request an LLM completion from the client with [`sampling/createMessage`](https://modelcontextprotocol.io/specification/2025-11-25/client/sampling),
+letting a server leverage the client's model access without its own API keys.
+
+> MCP Sampling is deprecated as of protocol version `2026-07-28` (SEP-2577), while remaining fully supported under `2025-11-25`.
+> Register this handler to interoperate with servers that still send sampling requests during the deprecation window;
+> new servers should call LLM provider APIs directly.
+
+Register a handler and advertise the capability on `connect`:
+
+```ruby
+client.connect(capabilities: { sampling: {} })
+
+client.on_sampling do |params|
+  completion = my_llm.complete(params["messages"], max_tokens: params["maxTokens"])
+  {
+    role: "assistant",
+    content: { type: "text", text: completion.text },
+    model: completion.model,
+    stopReason: "endTurn",
+  }
+end
+```
+
+For trust and safety, the spec recommends a human in the loop able to review, edit, or reject the request and the generated response.
+To reject a request, raise `MCP::Client::ServerRequestError` with the spec's user-rejection code `-1`:
+
+```ruby
+client.on_sampling do |params|
+  raise MCP::Client::ServerRequestError.new("User rejected sampling request", code: -1) unless approved?(params)
+
+  generate_completion(params)
+end
+```
+
+Use `capabilities: { sampling: { tools: {} } }` to receive tool-enabled sampling requests. Like elicitation, this uses the same standalone GET SSE listening stream.
+
 #### HTTP Authorization
 
 By default, the HTTP transport layer provides no authentication to the server, but you can provide custom headers if you need authentication. For example, to use Bearer token authentication:
@@ -2505,6 +2547,43 @@ Keyword arguments:
 - `token_endpoint_auth_method`: `"client_secret_basic"` (default) or `"client_secret_post"`. `"none"` is rejected with `ClientCredentialsProvider::InvalidCredentialsError`.
 - `scope`, `storage`: Optional, same meaning as on `Provider`.
 
+##### Cross-App Access (JWT Bearer) Grant
+
+For enterprise MCP deployments where an identity provider (IdP) governs authorization (SEP-990), use `MCP::Client::OAuth::CrossAppAccessProvider` instead of `Provider`.
+The client exchanges an IdP-issued ID token for an Identity Assertion Authorization Grant (ID-JAG) at the IdP via RFC 8693 token exchange, then presents the ID-JAG
+to the MCP authorization server with the RFC 7523 `jwt-bearer` grant, authenticating with `client_secret_basic`. There is no authorization request, PKCE, DCR, or `offline_access`.
+Mirrors `CrossAppAccessProvider` and `requestJwtAuthorizationGrant` in the TypeScript SDK.
+
+`MCP::Client::OAuth::IDJAGTokenExchange.request` performs the RFC 8693 exchange at the IdP token endpoint. Wrap it in a callable so the same provider can plug into
+an enterprise secret store or a test double without changing the transport wiring.
+
+```ruby
+provider = MCP::Client::OAuth::CrossAppAccessProvider.new(
+  client_id: "my-mcp-client",
+  client_secret: ENV.fetch("MCP_CLIENT_SECRET"),
+  assertion_provider: ->(audience:, resource:) {
+    MCP::Client::OAuth::IDJAGTokenExchange.request(
+      token_endpoint: "https://idp.example.com/token",
+      id_token: ENV.fetch("IDP_ID_TOKEN"),
+      client_id: "my-idp-client",
+      audience: audience,
+      resource: resource,
+    )
+  },
+  # scope: "mcp:read mcp:write" (optional; used when neither WWW-Authenticate nor PRM specify one)
+)
+
+transport = MCP::Client::HTTP.new(url: "https://api.example.com/mcp", oauth: provider)
+```
+
+Keyword arguments:
+
+- `client_id`, `client_secret`: Required. The `jwt-bearer` grant authenticates with `client_secret_basic` at the MCP authorization server.
+- `assertion_provider`: Required. Callable invoked as `call(audience:, resource:)` and returning the ID-JAG assertion.
+  `audience` is the MCP authorization server's validated issuer identifier; `resource` is the canonical MCP server URL (RFC 8707).
+  Passing both through to `IDJAGTokenExchange.request` covers the common case.
+- `scope`, `storage`: Optional, same meaning as on `Provider`.
+
 ##### Communication Security
 
 When `oauth:` is set, the MCP transport URL and every OAuth-facing URL (PRM, Authorization Server metadata, `authorization_endpoint`, `token_endpoint`, `registration_endpoint`,

data/lib/json_rpc_handler.rb

@@ -16,7 +16,7 @@ module JsonRpcHandler
     PARSE_ERROR = -32700
   end
 
-  DEFAULT_ALLOWED_ID_CHARACTERS = /\A[a-zA-Z0-9_-]+\z/
+  DEFAULT_ALLOWED_ID_CHARACTERS = /\A[a-zA-Z0-9_-]+\z/.freeze
 
   # Sentinel return value from a handler. When a handler returns this,
   # `process_request` emits no JSON-RPC response for the request,

data/lib/mcp/client/http.rb

@@ -30,6 +30,13 @@ module MCP
       # (60 seconds for Net::HTTP) would recycle quiet streams too eagerly.
       SSE_LISTENER_READ_TIMEOUT = 300
 
+      # Upper bound in bytes on a single JSON-RPC message from the server - an SSE event or
+      # a JSON response body - buffered in memory while reading a response. Without a bound,
+      # a server that never terminates an SSE event (or never ends a JSON body) grows
+      # the buffer indefinitely. Matches the 4 MiB default of `MCP::Client::Stdio::MAX_LINE_BYTES`
+      # and the server transports' request cap.
+      MAX_MESSAGE_BYTES = 4 * 1024 * 1024
+
       # Raised when an `oauth:` provider is paired with an MCP URL that is neither HTTPS nor
       # a loopback `http://` URL, since a bearer token sent over plain HTTP to a remote host
       # is trivially observed and stolen.
@@ -71,6 +78,12 @@ module MCP
       class StreamAbort < StandardError; end
       private_constant :StreamAbort
 
+      # Raised inside the streaming callback when the server sends more bytes than
+      # `max_message_bytes` without completing a message. Translated into
+      # a `RequestHandlerError` (or a listener stop) where the request context is known.
+      class MessageTooLargeError < StandardError; end
+      private_constant :MessageTooLargeError
+
       # Per-exchange SSE state shared between the initial POST stream and any SEP-1699 reconnection GET streams:
       # the incrementally parsed JSON-RPC response, the last received SSE event id (for `Last-Event-ID`),
       # and the server's `retry:` reconnection delay. Non-SSE bodies accumulate in `buffer` for the JSON path.
@@ -78,8 +91,9 @@ module MCP
         attr_reader :buffer, :response, :last_event_id, :retry_ms
         attr_accessor :abortable
 
-        def initialize(abortable:, on_request: nil)
+        def initialize(abortable:, max_message_bytes: MAX_MESSAGE_BYTES, on_request: nil)
           @abortable = abortable
+          @max_message_bytes = max_message_bytes
           @on_request = on_request
           @buffer = +""
           @parser = nil
@@ -95,14 +109,24 @@ module MCP
         end
 
         # Faraday `on_data` streaming callback. SSE chunks are parsed incrementally;
-        # anything else (JSON bodies) accumulates in `buffer`.
+        # anything else (JSON bodies) accumulates in `buffer`. Both paths are bounded
+        # by `max_message_bytes`, checked after the awaited response had its chance to
+        # abort the stream so an over-limit tail cannot mask a response that already arrived.
         def on_data
           proc do |chunk, _received_bytes, env|
             if event_stream?(env)
               feed(chunk)
               raise StreamAbort if @abortable && @response
+
+              if parser_buffered_bytes > @max_message_bytes
+                raise MessageTooLargeError, "Server SSE event exceeds #{@max_message_bytes} bytes without completing"
+              end
             else
               @buffer << chunk
+
+              if @buffer.bytesize > @max_message_bytes
+                raise MessageTooLargeError, "Server response body exceeds #{@max_message_bytes} bytes"
+              end
             end
           end
         end
@@ -154,6 +178,20 @@ module MCP
           end
         end
 
+        # Bytes the parser has buffered for a not-yet-dispatched event: the partial line
+        # and the accumulated `data:` field values (plus the small event type and last event id buffers).
+        # External byte counting cannot tell consumed-and-discarded bytes (comments, field names, delimiters)
+        # from consumed-and-retained ones, so the parser's own String buffers are measured instead;
+        # summing every String instance variable keeps the measurement valid if the parser renames or adds buffers.
+        # A parser rewrite that buffered elsewhere would make this return 0 and quietly lift the cap -
+        # the regression tests feeding an over-limit event guard against that.
+        def parser_buffered_bytes
+          parser.instance_variables.sum do |name|
+            value = parser.instance_variable_get(name)
+            value.is_a?(String) ? value.bytesize : 0
+          end
+        end
+
         def parser
           @parser ||= begin
             require "event_stream_parser"
@@ -169,7 +207,13 @@ module MCP
 
       attr_reader :url, :session_id, :protocol_version, :server_info, :oauth
 
-      def initialize(url:, headers: {}, oauth: nil, &block)
+      def initialize(url:, headers: {}, oauth: nil, max_message_bytes: MAX_MESSAGE_BYTES, &block)
+        # `nil` or a non-positive value would make the buffering unbounded and silently
+        # disable the protection, so reject it up front.
+        unless max_message_bytes.is_a?(Integer) && max_message_bytes > 0
+          raise ArgumentError, "max_message_bytes must be a positive Integer"
+        end
+
         if oauth && !MCP::Client::OAuth::Discovery.secure_url?(url)
           # Mask credentials (userinfo) and query parameters before quoting the URL in the error message
           # so they cannot leak into logs.
@@ -183,6 +227,7 @@ module MCP
         @headers = headers
         @faraday_customizer = block
         @oauth = oauth
+        @max_message_bytes = max_message_bytes
         # Snapshot the canonical URL at construction time. This single value
         # serves two related roles, both of which need to see the query string:
         #
@@ -336,6 +381,7 @@ module MCP
           # so the response object (and its `Mcp-Session-Id` header) is always available for capture.
           stream = SSEStream.new(
             abortable: method.to_s != MCP::Methods::INITIALIZE,
+            max_message_bytes: @max_message_bytes,
             on_request: ->(message) { dispatch_server_request(message) },
           )
 
@@ -354,6 +400,12 @@ module MCP
           capture_session_info(method, response, body) if response
 
           body
+        rescue MessageTooLargeError => e
+          raise RequestHandlerError.new(
+            e.message,
+            { method: method, params: params },
+            error_type: :internal_error,
+          )
         rescue Faraday::BadRequestError => e
           raise RequestHandlerError.new(
             "The #{method} request is invalid",
@@ -699,6 +751,7 @@ module MCP
       def listen_for_server_requests
         stream = SSEStream.new(
           abortable: false,
+          max_message_bytes: @max_message_bytes,
           on_request: ->(message) { dispatch_server_request(message) },
         )
         consecutive_failures = 0
@@ -714,6 +767,9 @@ module MCP
             end
 
             consecutive_failures = 0
+          rescue MessageTooLargeError
+            # Reconnecting would let the server stream the same over-limit event again, so stop listening instead of retrying.
+            break
           rescue Faraday::Error => e
             break if e.response&.dig(:status) == 405
 

data/lib/mcp/client/oauth/cross_app_access_provider.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module MCP
+  class Client
+    module OAuth
+      # OAuth client configuration for the MCP Enterprise Managed Authorization extension (SEP-990, "Cross-App Access"):
+      # the client obtains an Identity Assertion Authorization Grant (ID-JAG) from an enterprise identity provider and
+      # presents it to the MCP authorization server with the RFC 7523 `jwt-bearer` grant, authenticating with
+      # `client_secret_basic`. Handed to `MCP::Client::HTTP` via the `oauth:` keyword, the same as `Provider`.
+      #
+      # Mirrors `CrossAppAccessProvider` in the TypeScript SDK: the assertion is supplied by a callable so it can come
+      # from `IDJAGTokenExchange` (the common case), an enterprise secret store, or a test double.
+      #
+      # Required keyword arguments:
+      #
+      # - `client_id`     - String identifying the pre-registered confidential client at the MCP authorization server.
+      # - `client_secret` - String shared secret for `client_secret_basic`.
+      # - `assertion_provider` - Callable invoked as `call(audience:, resource:)`, returning the ID-JAG assertion to
+      #   present. `audience` is the authorization server's issuer identifier and `resource` is the canonical MCP server URL;
+      #   pass both through to `IDJAGTokenExchange.request` when exchanging an IdP ID token.
+      #
+      # Optional keyword arguments:
+      #
+      # - `scope`   - String of space-separated scopes to request when the server's `WWW-Authenticate` and
+      #   the Protected Resource Metadata do not specify one.
+      # - `storage` - Object responding to `tokens`, `save_tokens(tokens)`, `client_information`, and `save_client_information(info)`.
+      #   Defaults to an `InMemoryStorage`.
+      #
+      # https://github.com/modelcontextprotocol/modelcontextprotocol/issues/990
+      class CrossAppAccessProvider
+        include StorageBackedProvider
+
+        # Raised when the provider is constructed without the pieces the `jwt-bearer` grant needs.
+        class InvalidConfigurationError < ArgumentError; end
+
+        attr_reader :scope, :storage
+
+        def initialize(client_id:, client_secret:, assertion_provider:, scope: nil, storage: nil)
+          if blank?(client_id)
+            raise InvalidConfigurationError, "client_id is required for the jwt-bearer grant."
+          end
+
+          if blank?(client_secret)
+            raise InvalidConfigurationError, "client_secret is required: SEP-990 authenticates the jwt-bearer grant with client_secret_basic."
+          end
+
+          unless assertion_provider.respond_to?(:call)
+            raise InvalidConfigurationError, "assertion_provider must be callable as `call(audience:, resource:)` and return the ID-JAG assertion."
+          end
+
+          @assertion_provider = assertion_provider
+          @scope = scope
+          @storage = storage || InMemoryStorage.new
+          @storage.save_client_information(
+            "client_id" => client_id,
+            "client_secret" => client_secret,
+            "token_endpoint_auth_method" => "client_secret_basic",
+          )
+        end
+
+        # See `Provider#authorization_flow`.
+        def authorization_flow
+          :jwt_bearer
+        end
+
+        # Returns the ID-JAG assertion to present at the MCP authorization server. Called by `Flow#run_jwt_bearer!` with the audience
+        # and resource resolved during discovery.
+        def jwt_bearer_assertion(audience:, resource:)
+          @assertion_provider.call(audience: audience, resource: resource)
+        end
+
+        private
+
+        def blank?(value)
+          value.nil? || (value.is_a?(String) && value.strip.empty?)
+        end
+      end
+    end
+  end
+end

data/lib/mcp/client/oauth/discovery.rb

@@ -37,7 +37,7 @@ module MCP
         # Matches a single `key=value` pair inside an HTTP auth-scheme challenge.
         # `value` is either a quoted string (which can contain commas and spaces)
         # or a bare token, per RFC 7235.
-        WWW_AUTH_PARAM_PATTERN = /\A([A-Za-z0-9_-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/
+        WWW_AUTH_PARAM_PATTERN = /\A([A-Za-z0-9_-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/.freeze
 
         class << self
           # Parses a `WWW-Authenticate` header and returns the parameters of

data/lib/mcp/client/oauth/flow.rb

@@ -51,8 +51,11 @@ module MCP
 
           as_metadata = authorization_server_metadata(authorization_server: authorization_server, legacy: prm.nil?)
 
-          if provider_authorization_flow == :client_credentials
+          case provider_authorization_flow
+          when :client_credentials
             return run_client_credentials!(as_metadata: as_metadata, prm: prm, resource: resource, scope: scope)
+          when :jwt_bearer
+            return run_jwt_bearer!(as_metadata: as_metadata, prm: prm, resource: resource, scope: scope)
           end
 
           ensure_pkce_supported!(as_metadata)
@@ -154,6 +157,36 @@ module MCP
               "refusing to send them to the current authorization server (SEP-2352)."
         end
 
+        # Runs the RFC 7523 `jwt-bearer` grant for the SEP-990 Enterprise Managed Authorization extension:
+        # the provider supplies an ID-JAG assertion (typically obtained from an enterprise IdP via `IDJAGTokenExchange`),
+        # which is presented at the token endpoint with `client_secret_basic` authentication. Shares the same discovery
+        # and security checks as `run!`; like `client_credentials`, there is no PKCE, redirect, or authorization request.
+        # The assertion's audience is the issuer identifier that `ensure_issuer_matches!` validated.
+        # https://github.com/modelcontextprotocol/modelcontextprotocol/issues/990
+        def run_jwt_bearer!(as_metadata:, prm:, resource:, scope:)
+          client_info = @provider.client_information
+          unless client_info.is_a?(Hash) && client_info_required_value(client_info, "client_id")
+            raise AuthorizationError, "Cannot run the jwt-bearer grant: the provider has no stored `client_id`."
+          end
+
+          assertion = @provider.jwt_bearer_assertion(audience: as_metadata["issuer"], resource: resource)
+          if assertion.nil? || assertion.to_s.empty?
+            raise AuthorizationError, "The provider's assertion_provider returned no ID-JAG assertion."
+          end
+
+          form = {
+            "grant_type" => "urn:ietf:params:oauth:grant-type:jwt-bearer",
+            "assertion" => assertion,
+          }
+          effective_scope = resolve_scope(scope: scope, prm: prm)
+          form["scope"] = effective_scope if effective_scope
+          form["resource"] = resource if resource
+
+          tokens = post_to_token_endpoint(as_metadata: as_metadata, client_info: client_info, form: form)
+          @provider.save_tokens(tokens)
+          :authorized
+        end
+
         # Exchanges the saved `refresh_token` for a fresh access token (RFC 6749 Section 6).
         # Re-discovers PRM and AS metadata so we always pick up a moved token endpoint, and re-runs the audience / issuer / security
         # checks before talking to it.

data/lib/mcp/client/oauth/id_jag_token_exchange.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+
+module MCP
+  class Client
+    module OAuth
+      # RFC 8693 token exchange against an enterprise identity provider, turning an IdP-issued ID token into
+      # an Identity Assertion Authorization Grant (ID-JAG) per the MCP Enterprise Managed Authorization extension (SEP-990).
+      # The returned ID-JAG is an opaque assertion the client then presents to the MCP authorization server with
+      # the RFC 7523 `jwt-bearer` grant (see `CrossAppAccessProvider`).
+      # Mirrors `requestJwtAuthorizationGrant` in the TypeScript SDK.
+      #
+      # - https://github.com/modelcontextprotocol/modelcontextprotocol/issues/990
+      # - https://www.rfc-editor.org/rfc/rfc8693
+      module IDJAGTokenExchange
+        # Raised when the identity provider's token exchange fails or returns something other than an ID-JAG.
+        class ExchangeError < StandardError; end
+
+        GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange"
+        ID_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id_token"
+        ID_JAG_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id-jag"
+
+        class << self
+          # Exchanges `id_token` for an ID-JAG at the IdP's token endpoint and returns the assertion string.
+          #
+          # @param token_endpoint [String] The identity provider's token endpoint.
+          # @param id_token [String] The IdP-issued ID token (the subject token).
+          # @param client_id [String] The client's identifier at the IdP.
+          # @param audience [String] The MCP authorization server's issuer identifier.
+          # @param resource [String] The canonical MCP server URL (RFC 8707).
+          # @param http_client [Object, nil] Faraday-compatible client; built lazily by default.
+          def request(token_endpoint:, id_token:, client_id:, audience:, resource:, http_client: nil)
+            http_client ||= default_http_client
+
+            response = begin
+              http_client.post(token_endpoint) do |req|
+                req.headers["Content-Type"] = "application/x-www-form-urlencoded"
+                req.headers["Accept"] = "application/json"
+                req.body = URI.encode_www_form(
+                  "grant_type" => GRANT_TYPE,
+                  "subject_token" => id_token,
+                  "subject_token_type" => ID_TOKEN_TYPE,
+                  "requested_token_type" => ID_JAG_TOKEN_TYPE,
+                  "audience" => audience,
+                  "resource" => resource,
+                  "client_id" => client_id,
+                )
+              end
+            rescue Faraday::Error => e
+              raise ExchangeError, "Token exchange request to #{token_endpoint} failed: #{e.class}: #{e.message}."
+            end
+
+            if response.status < 200 || response.status >= 300
+              raise ExchangeError, "Identity provider token exchange returned status #{response.status}."
+            end
+
+            parse_id_jag(response)
+          end
+
+          private
+
+          def parse_id_jag(response)
+            body = response.body.is_a?(String) ? response.body : response.body.to_s
+            parsed = begin
+              JSON.parse(body)
+            rescue JSON::ParserError => e
+              raise ExchangeError, "Failed to parse token exchange response: #{e.message}."
+            end
+
+            unless parsed.is_a?(Hash)
+              raise ExchangeError, "Token exchange response is not a JSON object (got #{parsed.class})."
+            end
+
+            issued_token_type = parsed["issued_token_type"]
+            unless issued_token_type == ID_JAG_TOKEN_TYPE
+              raise ExchangeError,
+                "Token exchange did not issue an ID-JAG " \
+                  "(expected issued_token_type #{ID_JAG_TOKEN_TYPE.inspect}, got #{issued_token_type.inspect})."
+            end
+
+            assertion = parsed["access_token"]
+            if assertion.nil? || assertion.to_s.empty?
+              raise ExchangeError, "Token exchange response is missing `access_token`."
+            end
+
+            assertion
+          end
+
+          def default_http_client
+            require "faraday"
+            Faraday.new do |faraday|
+              faraday.headers["Accept"] = "application/json"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mcp/client/oauth.rb

@@ -8,12 +8,15 @@ require_relative "oauth/storage_backed_provider"
 require_relative "oauth/jwt_client_assertion"
 require_relative "oauth/provider"
 require_relative "oauth/client_credentials_provider"
+require_relative "oauth/id_jag_token_exchange"
+require_relative "oauth/cross_app_access_provider"
 
 module MCP
   class Client
     # OAuth client support for the MCP Authorization spec (PRM discovery,
     # Authorization Server metadata discovery, Dynamic Client Registration,
-    # OAuth 2.1 Authorization Code + PKCE, and the client_credentials grant).
+    # OAuth 2.1 Authorization Code + PKCE, the client_credentials grant,
+    # and the SEP-990 Enterprise Managed Authorization jwt-bearer grant).
     # https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization
     module OAuth
     end

data/lib/mcp/client.rb

@@ -423,6 +423,44 @@ module MCP
       transport.on_server_request(Methods::ELICITATION_CREATE, &handler)
     end
 
+    # Registers a handler for `sampling/createMessage` requests the server sends while one of this client's requests is in flight.
+    # The handler receives the request `params` (`messages`, `maxTokens`, optionally `systemPrompt`, `modelPreferences`, `tools`,
+    # `toolChoice`, ...; string keys) and must return a `CreateMessageResult`-shaped Hash:
+    # `{ role: "assistant", content: { type: "text", text: "..." }, model: "...", stopReason: "..." }`.
+    #
+    # For trust and safety, the spec recommends a human in the loop able to review, edit, or reject the request and the generated response
+    # before it is returned to the server. To reject, raise `ServerRequestError` with the spec's user-rejection code `-1`.
+    #
+    # Requires a transport that supports server-to-client requests (e.g. `MCP::Client::HTTP`); pass `capabilities: { sampling: {} }` to
+    # `connect` (or `{ sampling: { tools: {} } }` to receive tool-enabled sampling requests) so the server knows it may send them.
+    #
+    # @example Forward the request to an LLM and return its completion
+    #
+    #   client.on_sampling do |params|
+    #     raise MCP::Client::ServerRequestError.new("User rejected sampling request", code: -1) unless approved?(params)
+    #
+    #     completion = my_llm.complete(params["messages"], max_tokens: params["maxTokens"])
+    #     {
+    #       role: "assistant",
+    #       content: { type: "text", text: completion.text },
+    #       model: completion.model,
+    #       stopReason: "endTurn",
+    #     }
+    #   end
+    #
+    # https://modelcontextprotocol.io/specification/2025-11-25/client/sampling
+    #
+    # @deprecated MCP Sampling (`sampling/createMessage`) is deprecated as of MCP protocol version 2026-07-28 (SEP-2577).
+    #   Register this handler only to interoperate with servers that still send sampling requests during the deprecation window;
+    #   new servers should call LLM provider APIs directly.
+    def on_sampling(&handler)
+      unless transport.respond_to?(:on_server_request)
+        raise ArgumentError, "The transport does not support server-to-client requests"
+      end
+
+      transport.on_server_request(Methods::SAMPLING_CREATE_MESSAGE, &handler)
+    end
+
     # Sends a `ping` request to the server to verify the connection is alive.
     # Per the MCP spec, the server responds with an empty result.
     #

data/lib/mcp/configuration.rb

@@ -5,7 +5,7 @@ module MCP
     LATEST_STABLE_PROTOCOL_VERSION = "2025-11-25"
     SUPPORTED_STABLE_PROTOCOL_VERSIONS = [
       LATEST_STABLE_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05",
-    ]
+    ].freeze
     DEFAULT_NEGOTIATED_PROTOCOL_VERSION = "2025-03-26"
 
     attr_writer :exception_reporter, :around_request

data/lib/mcp/icon.rb

@@ -2,7 +2,7 @@
 
 module MCP
   class Icon
-    SUPPORTED_THEMES = ["light", "dark"]
+    SUPPORTED_THEMES = ["light", "dark"].freeze
 
     attr_reader :mime_type, :sizes, :src, :theme
 

data/lib/mcp/instrumentation.rb

@@ -14,9 +14,7 @@ module MCP
       rescue => e
         already_reported = begin
           !!exception_already_reported&.call(e)
-        # rubocop:disable Lint/RescueException
         rescue Exception
-          # rubocop:enable Lint/RescueException
           # The predicate is expected to be side-effect-free and return a boolean.
           # Any exception raised from it (including non-StandardError such as SystemExit)
           # must not shadow the original exception.

data/lib/mcp/resource_template.rb

@@ -8,7 +8,7 @@ module MCP
       # Applied after `Regexp.escape`, which turns `{` and `}` into `\{` and `\}`.
       # Variable names are restricted to valid Regexp named-group names,
       # so RFC 6570 operator expressions (e.g. `{?query}`) stay literal and never match.
-      VARIABLE_PATTERN = /\\\{([A-Za-z_]\w*)\\\}/
+      VARIABLE_PATTERN = /\\\{([A-Za-z_]\w*)\\\}/.freeze
 
       attr_reader :uri_template_value
       attr_reader :title_value

data/lib/mcp/server/transports/streamable_http_transport.rb

@@ -19,9 +19,9 @@ module MCP
         class InvalidJsonError < StandardError; end
 
         SSE_HEADERS = {
-          "Content-Type" => "text/event-stream",
-          "Cache-Control" => "no-cache",
-          "Connection" => "keep-alive",
+          "content-type" => "text/event-stream",
+          "cache-control" => "no-cache",
+          "connection" => "keep-alive",
         }.freeze
 
         # Secure defaults for stateful mode. Without a finite idle timeout, sessions live until an explicit client DELETE,
@@ -517,6 +517,11 @@ module MCP
             end
 
             if notification?(body)
+              # Reject a notification carrying an unknown or expired session ID instead of
+              # dispatching it against the shared `Server`. Mirrors the response and regular-request
+              # branches; without it a custom notification handler could run without a live session.
+              return session_not_found_response if !@stateless && !session_active?(session_id)
+
               dispatch_notification(body_string, session_id)
               handle_accepted
             elsif response?(body)
@@ -561,7 +566,7 @@ module MCP
         end
 
         def handle_delete(request)
-          success_response = [200, { "Content-Type" => "application/json" }, [{ success: true }.to_json]]
+          success_response = [200, { "content-type" => "application/json" }, [{ success: true }.to_json]]
 
           if @stateless
             protocol_version_error = validate_protocol_version_header(request)
@@ -757,7 +762,7 @@ module MCP
 
         def json_rpc_error_response(status:, code:, message:)
           body = { jsonrpc: "2.0", id: nil, error: { code: code, message: message } }
-          [status, { "Content-Type" => "application/json" }, [body.to_json]]
+          [status, { "content-type" => "application/json" }, [body.to_json]]
         end
 
         def notification?(body)
@@ -844,6 +849,17 @@ module MCP
 
           response = server_session.handle_json(body_string)
 
+          # `initialize_request?` matches on the method alone, so an `initialize` sent without
+          # an id (framed as a notification) reaches here. `Server#init` marks the session initialized,
+          # but JSON-RPC emits no response for an id-less request, so `response` is nil.
+          # Returning `[200, ..., [nil]]` would place nil in the Rack body (which the web server cannot serialize),
+          # and the session would be retained since it is marked initialized. Discard the orphaned session
+          # and ack with 202, mirroring the nil-response handling in a regular request.
+          if response.nil?
+            cleanup_session(session_id) if session_id
+            return handle_accepted
+          end
+
           # If `Server#init` produced an error response (e.g., malformed JSON-RPC envelope),
           # `mark_initialized!` was never called. Discard the orphaned session and omit
           # the `Mcp-Session-Id` header so the client retries from a clean state instead of
@@ -854,10 +870,10 @@ module MCP
           end
 
           headers = {
-            "Content-Type" => "application/json",
+            "content-type" => "application/json",
           }
 
-          headers["Mcp-Session-Id"] = session_id if session_id
+          headers["mcp-session-id"] = session_id if session_id
 
           [200, headers, [response]]
         end
@@ -899,7 +915,7 @@ module MCP
             # which would produce an empty body the client cannot parse as JSON.
             return handle_accepted if response.nil?
 
-            [200, { "Content-Type" => "application/json" }, [response]]
+            [200, { "content-type" => "application/json" }, [response]]
           end
         end
 
@@ -1132,7 +1148,7 @@ module MCP
               message: message,
             },
           }
-          [400, { "Content-Type" => "application/json" }, [body.to_json]]
+          [400, { "content-type" => "application/json" }, [body.to_json]]
         end
 
         def session_already_connected_response

data/lib/mcp/server.rb

@@ -963,9 +963,7 @@ module MCP
     end
 
     def index_resources_by_uri(resources)
-      resources.each_with_object({}) do |resource, hash|
-        hash[resource.uri] = resource
-      end
+      resources.to_h { |resource| [resource.uri, resource] }
     end
 
     def error_tool_response(text)

data/lib/mcp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MCP
-  VERSION = "0.24.0"
+  VERSION = "0.25.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mcp
 version: !ruby/object:Gem::Version
-  version: 0.24.0
+  version: 0.25.0
 platform: ruby
 authors:
 - Model Context Protocol
@@ -45,8 +45,10 @@ files:
 - lib/mcp/client/http.rb
 - lib/mcp/client/oauth.rb
 - lib/mcp/client/oauth/client_credentials_provider.rb
+- lib/mcp/client/oauth/cross_app_access_provider.rb
 - lib/mcp/client/oauth/discovery.rb
 - lib/mcp/client/oauth/flow.rb
+- lib/mcp/client/oauth/id_jag_token_exchange.rb
 - lib/mcp/client/oauth/in_memory_storage.rb
 - lib/mcp/client/oauth/jwt_client_assertion.rb
 - lib/mcp/client/oauth/pkce.rb
@@ -95,7 +97,7 @@ licenses:
 - Apache-2.0
 metadata:
   allowed_push_host: https://rubygems.org
-  changelog_uri: https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.24.0
+  changelog_uri: https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.25.0
   homepage_uri: https://ruby.sdk.modelcontextprotocol.io
   source_code_uri: https://github.com/modelcontextprotocol/ruby-sdk
   bug_tracker_uri: https://github.com/modelcontextprotocol/ruby-sdk/issues
@@ -114,7 +116,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: The official Ruby SDK for Model Context Protocol servers and clients
 test_files: []