mcp 1.9.0 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95dcc461ef4ba74c3128e82441b81587135488d8c9e4d17f5ea91ba45867f080
-  data.tar.gz: 2d0afc689585aad6ffaf37c4ca5528497e30bf81e733514a05faf724cfb3e2f4
+  metadata.gz: 87d807c4e295950341aa7123459ac862a601c3bb840a881ac2a8c48ae2b8b2f0
+  data.tar.gz: b09a469593f943812b51f7d1f3db3eb1fb6d1c63c4d321c1cf6d6936158f842a
 SHA512:
-  metadata.gz: 68e755e7b252d6680ca82ce073b3e541e0b4202ac18ce5b73a5175c326aa655e7cbdf4d0685cdb06d4007cc35696b0e7ad60c7a50820567b63b84e4cce5d7c7c
-  data.tar.gz: 68a614ac492dfcfa34a1429efc57e031089dfa65b10db2f6b18b9d0bbffe6ebbcb03c13eacbac9cb3dea178fda603b279825b2cb67ccb81081523db809e27e98
+  metadata.gz: 124b4d117e0b4c0079a4af053d2de713bce66847f1c0d95404cd99d54a929ef0f250669b7207c8d6658ced4a70e63f1708376dcbe379a848f65cf8e4c5880cc0
+  data.tar.gz: 4e77573617cbafc37ac1b1fb59aee3fe6f96825c474fc912ca24f766c6690fd3d5df4b2e0c24831210b4d8c7700340f1daf4043ceaa3977b8dfaf589b5e75a01

data/README.md

@@ -122,6 +122,9 @@ response = client.call_tool(
 stdio_transport.close
 ```
 
+Stdio servers inherit only a small base environment by default, including `GEM_HOME` and `GEM_PATH`.
+Pass extra variables through `env:`, or set `inherit_env: true` to restore full inheritance.
+
 The same client can connect to Streamable HTTP servers with `MCP::Client::HTTP`;
 see [Client Transports](https://ruby.sdk.modelcontextprotocol.io/client/transports/).
 

data/lib/json_rpc_handler.rb

@@ -227,7 +227,7 @@ module JsonRpcHandler
   end
 
   def valid_method_name?(method)
-    method.is_a?(String) && !method.start_with?("rpc.")
+    method.is_a?(String) && method.valid_encoding? && !method.start_with?("rpc.")
   end
 
   def valid_params?(params)

data/lib/mcp/client/http.rb

@@ -6,7 +6,7 @@ require_relative "../configuration"
 require_relative "../methods"
 require_relative "../protocol_deprecations"
 require_relative "../version"
-require_relative "mcp_param_headers"
+require_relative "../mcp_param_headers"
 require_relative "modern_envelope"
 
 module MCP
@@ -545,8 +545,12 @@ module MCP
       def send_notification(notification:)
         method = notification[:method] || notification["method"]
 
-        redacting_authorization_header { client.post("", notification, session_headers) }
+        redacting_authorization_header do
+          client.post("", notification, session_headers) { |req| req.options.on_data = bounded_on_data }
+        end
         nil
+      rescue MessageTooLargeError => e
+        raise RequestHandlerError.new(e.message, { method: method }, error_type: :internal_error)
       rescue Faraday::Error => e
         raise RequestHandlerError.new(
           "Failed to send #{method} notification",
@@ -573,7 +577,11 @@ module MCP
         end
 
         begin
-          redacting_authorization_header { client.delete("", nil, session_headers) }
+          redacting_authorization_header do
+            client.delete("", nil, session_headers) { |req| req.options.on_data = bounded_on_data }
+          end
+        rescue MessageTooLargeError => e
+          raise RequestHandlerError.new(e.message, {}, error_type: :internal_error)
         rescue Faraday::ClientError => e
           raise unless [404, 405].include?(e.response&.dig(:status))
         ensure
@@ -1196,12 +1204,13 @@ module MCP
               error: { code: e.code, message: e.message },
             }
           rescue StandardError => e
+            warn("MCP::Client::HTTP: error handling #{message["method"]} request: #{e.class}: #{e.message.dump}")
             {
               jsonrpc: JsonRpcHandler::Version::V2_0,
               id: message["id"],
               error: {
                 code: JsonRpcHandler::ErrorCode::INTERNAL_ERROR,
-                message: "Internal error handling #{message["method"]} request: #{e.message}",
+                message: "Internal error",
               },
             }
           end
@@ -1233,7 +1242,22 @@ module MCP
       end
 
       def send_client_response(response)
-        redacting_authorization_header { client.post("", response, session_headers) }
+        redacting_authorization_header do
+          client.post("", response, session_headers) { |req| req.options.on_data = bounded_on_data }
+        end
+      end
+
+      # Counts discarded response bytes without parsing the body, whatever its content type.
+      def bounded_on_data
+        received_bytes = 0
+
+        proc do |chunk, _received_bytes, _env|
+          received_bytes += chunk.bytesize
+
+          if received_bytes > @max_message_bytes
+            raise MessageTooLargeError, "Server response body exceeds #{@max_message_bytes} bytes"
+          end
+        end
       end
 
       def parse_json_buffer(buffer, method, params)

data/lib/mcp/client/oauth/client_credentials_provider.rb

@@ -35,6 +35,9 @@ module MCP
       #   the server's `token_endpoint_auth_signing_alg_values_supported` fails
       #   loudly at construction instead of as a 401 (the TypeScript and Python SDKs
       #   also take the algorithm as an explicit option).
+      # - `issuer`  - String issuer identifier of the authorization server the credentials belong to.
+      #   A different authorization server raises `Flow::AuthorizationError`. Omitting this is deprecated
+      #   and emits a warning; without it, credentials go to whichever authorization server the MCP server names.
       # - `scope`   - String of space-separated scopes to request when the server's
       #   `WWW-Authenticate` and the Protected Resource Metadata do not specify one.
       # - `storage` - Object responding to `tokens`, `save_tokens(tokens)`, `client_information`,
@@ -59,12 +62,14 @@ module MCP
 
         attr_reader :scope, :storage
 
+        # @note Omitting `issuer:` is deprecated. Pass the authorization server's issuer URL to limit the credentials to that server.
         def initialize(
           client_id:,
           client_secret: nil,
           token_endpoint_auth_method: "client_secret_basic",
           private_key: nil,
           signing_algorithm: nil,
+          issuer: nil,
           scope: nil,
           storage: nil,
           authorization_request_validator: nil,
@@ -82,7 +87,18 @@ module MCP
                 "client_credentials request is not allowed."
           end
 
+          if issuer.nil?
+            warn(
+              "Omitting `issuer:` is deprecated. Without it, the credentials go to whichever authorization server " \
+                "the MCP server names. Pass the authorization server's issuer URL as `issuer:` so they are only sent there.",
+              uplevel: 1,
+            )
+          elsif !issuer.is_a?(String) || blank?(issuer)
+            raise InvalidCredentialsError, "issuer must be a non-empty String: the issuer identifier of the authorization server the credentials belong to."
+          end
+
           client_information = { "client_id" => client_id, "token_endpoint_auth_method" => token_endpoint_auth_method }
+          client_information["issuer"] = issuer if issuer
 
           if token_endpoint_auth_method == "private_key_jwt"
             validate_private_key_jwt_arguments!(

data/lib/mcp/client/oauth/cross_app_access_provider.rb

@@ -21,6 +21,9 @@ module MCP
       #
       # Optional keyword arguments:
       #
+      # - `issuer`  - String issuer identifier of the MCP authorization server the credentials belong to.
+      #   A mismatch raises `Flow::AuthorizationError` before `assertion_provider` is called. Omitting this is
+      #   deprecated and emits a warning; without it, credentials go to whichever authorization server the MCP server names.
       # - `scope`   - String of space-separated scopes to request when the server's `WWW-Authenticate` and
       #   the Protected Resource Metadata do not specify one.
       # - `storage` - Object responding to `tokens`, `save_tokens(tokens)`, `client_information`, and `save_client_information(info)`.
@@ -41,10 +44,12 @@ module MCP
 
         attr_reader :scope, :storage
 
+        # @note Omitting `issuer:` is deprecated. Pass the authorization server's issuer URL to limit the credentials to that server.
         def initialize(
           client_id:,
           client_secret:,
           assertion_provider:,
+          issuer: nil,
           scope: nil,
           storage: nil,
           authorization_request_validator: nil,
@@ -63,6 +68,16 @@ module MCP
             raise InvalidConfigurationError, "assertion_provider must be callable as `call(audience:, resource:)` and return the ID-JAG assertion."
           end
 
+          if issuer.nil?
+            warn(
+              "Omitting `issuer:` is deprecated. Without it, the credentials go to whichever authorization server " \
+                "the MCP server names. Pass the authorization server's issuer URL as `issuer:` so they are only sent there.",
+              uplevel: 1,
+            )
+          elsif !issuer.is_a?(String) || blank?(issuer)
+            raise InvalidConfigurationError, "issuer must be a non-empty String: the issuer identifier of the authorization server the credentials belong to."
+          end
+
           http_client_customizer = validated_http_client_customizer(http_client_customizer)
 
           @assertion_provider = assertion_provider
@@ -71,11 +86,13 @@ module MCP
           @authorization_request_validator = authorization_request_validator
           @token_request_params = frozen_token_request_params(token_request_params)
           @http_client_customizer = http_client_customizer
-          @storage.save_client_information(
+          client_information = {
             "client_id" => client_id,
             "client_secret" => client_secret,
             "token_endpoint_auth_method" => "client_secret_basic",
-          )
+          }
+          client_information["issuer"] = issuer if issuer
+          @storage.save_client_information(client_information)
         end
 
         # See `Provider#authorization_flow`.

data/lib/mcp/client/oauth/flow.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "base64"
 require "json"
 require "openssl"
 require "securerandom"
@@ -380,7 +379,10 @@ module MCP
         def ensure_client_credentials_issuer!(client_info, as_metadata:)
           stored_issuer = client_info_required_value(client_info, "issuer")
           return if stored_issuer.nil?
-          return if stored_issuer == as_metadata["issuer"]
+
+          current_issuer = as_metadata["issuer"]
+          return if stored_issuer == current_issuer
+          return if stored_issuer == "#{current_issuer}/" || "#{stored_issuer}/" == current_issuer
 
           raise AuthorizationError,
             "Stored client credentials are bound to a different authorization server " \
@@ -399,6 +401,7 @@ module MCP
           unless client_info.is_a?(Hash) && client_info_required_value(client_info, "client_id")
             raise AuthorizationError, "Cannot run the jwt-bearer grant: the provider has no stored `client_id`."
           end
+          ensure_client_credentials_issuer!(client_info, as_metadata: as_metadata)
 
           # Asked before the assertion is minted, for the same reason registration waits on the authorization-code grant:
           # obtaining an ID-JAG sends the identity provider an audience of this authorization server, which must not happen once
@@ -1106,6 +1109,11 @@ module MCP
         end
 
         def ensure_refreshable_client_information!(client_info, as_metadata:)
+          case provider_authorization_flow
+          when :client_credentials, :jwt_bearer
+            return ensure_client_credentials_issuer!(client_info, as_metadata: as_metadata)
+          end
+
           stored_issuer = client_info_required_value(client_info, "issuer")
           return if stored_issuer.nil?
           return if stored_issuer == as_metadata["issuer"]
@@ -1644,7 +1652,7 @@ module MCP
         def basic_auth_credentials(client_id, client_secret)
           encoded_id = URI.encode_www_form_component(client_id)
           encoded_secret = URI.encode_www_form_component(client_secret)
-          Base64.strict_encode64("#{encoded_id}:#{encoded_secret}")
+          ["#{encoded_id}:#{encoded_secret}"].pack("m0")
         end
 
         def http_get(url)

data/lib/mcp/client/oauth/jwt_client_assertion.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "base64"
 require "json"
 require "openssl"
 require "securerandom"
@@ -118,8 +117,10 @@ module MCP
             end.join.then { |hex| [hex].pack("H*") }
           end
 
+          # base64url without padding (RFC 7515 Section 2), spelled with `pack` because `base64` is no longer
+          # a default gem as of Ruby 3.4 and this gem does not depend on it.
           def base64url(data)
-            Base64.urlsafe_encode64(data, padding: false)
+            [data].pack("m0").tr("+/", "-_").delete("=")
           end
         end
       end

data/lib/mcp/client/oauth/pkce.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "base64"
 require "digest"
 require "securerandom"
 
@@ -27,7 +26,9 @@ module MCP
           # Generates a PKCE pair (code_verifier and S256 code_challenge).
           def generate
             verifier = SecureRandom.urlsafe_base64(64)
-            challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
+            # base64url without padding (RFC 7636 Appendix A), spelled with `pack` because `base64` is no longer
+            # a default gem as of Ruby 3.4 and this gem does not depend on it.
+            challenge = [Digest::SHA256.digest(verifier)].pack("m0").tr("+/", "-_").delete("=")
 
             { code_verifier: verifier, code_challenge: challenge, code_challenge_method: "S256" }
           end

data/lib/mcp/client/stdio.rb

@@ -34,9 +34,20 @@ module MCP
       # Matches the C# SDK's `DiscoverProbeTimeout` default.
       DEFAULT_DISCOVER_PROBE_TIMEOUT = 5
 
+      # Inherited Windows environment, including RubyGems paths.
+      WINDOWS_INHERITED_ENV_VARS = %w[
+        APPDATA HOMEDRIVE HOMEPATH LOCALAPPDATA PATH PATHEXT PROCESSOR_ARCHITECTURE
+        SYSTEMDRIVE SYSTEMROOT TEMP USERNAME USERPROFILE GEM_HOME GEM_PATH
+      ].freeze
+
+      # Inherited Unix environment, including RubyGems paths.
+      UNIX_INHERITED_ENV_VARS = %w[HOME LOGNAME PATH SHELL TERM USER GEM_HOME GEM_PATH].freeze
+
+      DEFAULT_INHERITED_ENV_VARS = Gem.win_platform? ? WINDOWS_INHERITED_ENV_VARS : UNIX_INHERITED_ENV_VARS
+
       attr_reader :command, :args, :env, :server_info
 
-      def initialize(command:, args: [], env: nil, read_timeout: nil, max_line_bytes: MAX_LINE_BYTES)
+      def initialize(command:, args: [], env: nil, inherit_env: false, read_timeout: nil, max_line_bytes: MAX_LINE_BYTES)
         # Reject `nil` or non-positive values: `IO#gets("\n", nil)` and a negative
         # limit read without an upper bound, which would silently disable the
         # protection this option exists to provide.
@@ -47,6 +58,7 @@ module MCP
         @command = command
         @args = args
         @env = env
+        @inherit_env = inherit_env
         @read_timeout = read_timeout
         @max_line_bytes = max_line_bytes
         @stdin = nil
@@ -166,8 +178,8 @@ module MCP
       def start
         raise "MCP::Client::Stdio already started" if @started
 
-        spawn_env = @env || {}
-        @stdin, @stdout, @stderr, @wait_thread = Open3.popen3(spawn_env, @command, *@args)
+        spawn_env = DEFAULT_INHERITED_ENV_VARS.to_h { |key| [key, ENV[key]] }.compact.merge(@env || {})
+        @stdin, @stdout, @stderr, @wait_thread = Open3.popen3(spawn_env, @command, *@args, unsetenv_others: !@inherit_env)
         @stdout.set_encoding("UTF-8")
         @stdin.set_encoding("UTF-8")
 

data/lib/mcp/client.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require_relative "client/elicitation"
-require_relative "client/mcp_param_headers"
 require_relative "client/modern_envelope"
 require_relative "client/oauth"
 require_relative "client/stdio"
@@ -20,6 +19,11 @@ module MCP
     # every response would otherwise be followed indefinitely, growing the retained pages with it.
     MAX_PAGES = 1_000
 
+    # The custom-header codec lived under this name until the server transport came to share it;
+    # the name stays for code that referenced it.
+    # @api private
+    McpParamHeaders = MCP::McpParamHeaders
+
     class ServerError < StandardError
       attr_reader :code, :data
 

data/lib/mcp/instrumentation.rb

@@ -5,16 +5,17 @@ module MCP
     def instrument_call(method, server_context: {}, exception_already_reported: nil, &block)
       start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
       begin
-        @instrumentation_data = {}
-        add_instrumentation_data(method: method)
+        instrumentation_data = {}
+        @instrumentation_data = instrumentation_data
+        instrumentation_data.merge!(method: method)
         # `self.` is required: the `server_context:` keyword above shadows the
         # reader, and the value we want here is the user-defined hash passed to
         # `Server.new`, not the per-call reporter context.
         if configuration.instrument_server_context? && respond_to?(:server_context)
-          add_instrumentation_data(server_context: self.server_context)
+          instrumentation_data.merge!(server_context: self.server_context)
         end
 
-        result = configuration.around_request.call(@instrumentation_data, &block)
+        result = configuration.around_request.call(instrumentation_data) { block.call(instrumentation_data) }
 
         result
       rescue => e
@@ -28,22 +29,26 @@ module MCP
         end
 
         unless already_reported
-          add_instrumentation_data(error: :internal_error) unless @instrumentation_data.key?(:error)
+          instrumentation_data.merge!(error: :internal_error) unless instrumentation_data.key?(:error)
           configuration.exception_reporter.call(e, server_context)
         end
 
         raise
       ensure
         end_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        add_instrumentation_data(duration: end_time - start_time)
+        instrumentation_data.merge!(duration: end_time - start_time)
 
         # Backward compatibility: `instrumentation_callback` is soft-deprecated
         # in favor of `around_request`, but existing callers still expect it
         # to fire after every request until it is removed in a future version.
-        configuration.instrumentation_callback.call(@instrumentation_data)
+        configuration.instrumentation_callback.call(instrumentation_data)
       end
     end
 
+    # @deprecated Use the data hash passed to the {#instrument_call} block or
+    #   `around_request` instead. `add_instrumentation_data` uses a shared record
+    #   and is not safe for concurrent calls.
+    # @see #instrument_call
     def add_instrumentation_data(**kwargs)
       @instrumentation_data.merge!(kwargs)
     end