resque-mcp 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0415f5a9bbc7dddcc1c4def5de45835d49df86158b5261567af19ece94d6d36c
-  data.tar.gz: 6f4f8511f80a3107abd83e7e24053d0322dabb5feec212e52271bfe7bd844684
+  metadata.gz: aa2476b4d89a552651fd9fefbde7ebb001f75fbf684fa5182388c39cd501bcc5
+  data.tar.gz: bf79be53a377e49347c692bb78d2f2519e03756b63d07311bf473601414305ec
 SHA512:
-  metadata.gz: 95a256a4a7e92257568a474254fbd052306f0e915cebad24bfc6ff237a4a678ead0ddfae17611b0f6ab0f4b2f9a195ace9cc4eda54cd0b2d5122afc0827ebdb3
-  data.tar.gz: 2494d7df431b2b14f5a27eabc148f6a19670246afbb7051ad0144c2637773c52acaeb5d022b86e0e47d87cf691d044f6e6e1574c8640dd0389f8356189a494cf
+  metadata.gz: 75df4bb783023d55034a99235970952ea70f931fea145b3cebd48efa7404654c982d65a604ec29ee52086c3b3bbffae9f360eca7acc44e594a2d44a368bf9c40
+  data.tar.gz: a182d35074d8e72bc0f638cff1793405b37427093750810f0061f750c57f0adce34974d1e970cfcb1e4fd58f4f6663d659880bdd80f486e4fc42ecf07ae3a679

data/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [0.5.0]
+
+- MCP SDK 1.x support: the `mcp` dependency widens to `>= 0.23, < 2`, admitting the SDK's API-stable 1.x line. No configuration changes; existing deployments behave as before.
+- Sessionless 2026-07-28 lifecycle (SEP-2575, needs `mcp >= 1.2`): clients may skip the `initialize` handshake and carry the protocol version per request, and discover the server via `server/discover`. Older `mcp` versions keep serving the handshake lifecycle unchanged.
+- Capabilities are now declared explicitly instead of taking the SDK's default, dropping the `listChanged`/`subscribe` notification flags a per-request stateless endpoint cannot push. Empty `prompts`/`resources` capabilities stay declared, so `prompts/list` and `resources/list` keep answering with empty lists.
+- `subscriptions/listen` is declined with a correlatable JSON-RPC `-32601` error instead of an opaque `500`: a per-request stateless server has no notification stream to open. The refusal ships with HTTP 200 so clients that only parse successful responses still see it.
+
 ## [0.4.0]
 
 - Security: bump the minimum `mcp` dependency to `>= 0.23, < 1` for the DNS-rebinding fix (CVE-2026-63118); `<= 0.22` did not validate `Host`/`Origin` headers on the Streamable HTTP transport. Protection is now on by default, with loopback always allowed.

data/app/controllers/resque/mcp/endpoint_controller.rb

@@ -6,6 +6,8 @@ module Resque
       before_action :require_auth_token, only: :handle
 
       def handle
+        # Rack 3 input may not be rewindable: read before the transport does.
+        @raw_jsonrpc_body = request.raw_post
         server = ServerFactory.build(environment: Rails.env.to_s)
         config = Resque::Mcp.config
         # Passthrough first; our security-critical keys override, so nothing
@@ -20,21 +22,77 @@ module Resque
         transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(server, **options)
 
         status, headers, body = transport.handle_request(request)
-        headers.each { |key, value| response.set_header(key, value) }
+        render_transport_response(status, headers, body)
+      end
+
+      def method_not_allowed
+        head :method_not_allowed
+      end
+
+      private
+
+      # Rack 3 forbids these on a response; the SSE headers carry one.
+      HOP_BY_HOP_HEADERS = %w[
+        connection keep-alive proxy-authenticate proxy-authorization
+        te trailer transfer-encoding upgrade
+      ].freeze
+
+      # A callable body is a stream the transport wants to keep open (today
+      # only `subscriptions/listen`); stateless has nothing to push, so decline.
+      def render_transport_response(status, headers, body)
+        if body.respond_to?(:call)
+          # 200, not 501: clients that reject on `!response.ok` never parse the
+          # body, and the transport headers describe the declined stream.
+          return render json: {
+            jsonrpc: "2.0",
+            id: jsonrpc_request_id,
+            error: {
+              code: -32601,
+              message: "Method not found: #{jsonrpc_method_label} is not supported by this stateless endpoint"
+            }
+          }, status: :ok
+        end
+
+        headers.each do |key, value|
+          next if HOP_BY_HOP_HEADERS.include?(key.to_s.downcase)
+          response.set_header(key, value)
+        end
 
         payload = body.first
-        if payload
-          render json: payload, status: status
+        return head status unless payload
+
+        content_type = transport_content_type(headers)
+        if content_type && !content_type.start_with?("application/json")
+          render body: payload, content_type: content_type, status: status
         else
-          head status
+          render json: payload, status: status
         end
       end
 
-      def method_not_allowed
-        head :method_not_allowed
+      # A null id leaves a strict client unable to correlate the error.
+      def jsonrpc_payload
+        @jsonrpc_payload ||= begin
+          parsed = JSON.parse(@raw_jsonrpc_body.to_s)
+          parsed.is_a?(Hash) ? parsed : {}
+        rescue JSON::ParserError
+          {}
+        end
       end
 
-      private
+      def jsonrpc_request_id
+        id = jsonrpc_payload["id"]
+        id if id.is_a?(String) || id.is_a?(Integer)
+      end
+
+      def jsonrpc_method_label
+        method_name = jsonrpc_payload["method"]
+        method_name.is_a?(String) ? method_name : "this method"
+      end
+
+      def transport_content_type(headers)
+        _, value = headers.find { |key, _| key.to_s.casecmp("content-type").zero? }
+        value
+      end
 
       # No reliable boot-time hook exists (initializer ordering), so a
       # missing token is caught per request: 503, never silently open.

data/lib/resque/mcp/server_factory.rb

@@ -10,6 +10,10 @@ module Resque
           name: "resque-mcp",
           version: Resque::Mcp::VERSION,
           tools: [Tools::Overview, Tools::QueueStats, Tools::WorkerStats, Tools::ListFailures, Tools::GetFailure],
+          # Explicit, or the SDK advertises `listChanged`/`subscribe` streams
+          # we decline. This hash replaces the defaults and the SDK refuses
+          # methods whose key is absent — hence the empty prompts/resources.
+          capabilities: {tools: {}, prompts: {}, resources: {}, logging: {}},
           server_context: {adapter: Adapter.new, environment: environment}
         )
       end

data/lib/resque/mcp/version.rb

@@ -2,6 +2,6 @@
 
 module Resque
   module Mcp
-    VERSION = "0.4.0"
+    VERSION = "0.5.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: resque-mcp
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Josch Bockler
@@ -38,7 +38,7 @@ dependencies:
         version: '0.23'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -48,7 +48,7 @@ dependencies:
         version: '0.23'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '2'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement