stateless-mcp 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: acccfae88cee7f634e762e143c5599f2b76ef514f1534555e8407a0f1cb297e0
+  data.tar.gz: f118030ce51d056a96520e008dec2fb21508cb4fc73cf8f258942727efdb8537
+SHA512:
+  metadata.gz: a174f3a50fee8ff7fa31f495642685716a1586c7b1cdb97592e0680cf2794a640a7013261c6ffbf7ce770c463f78130a578d57798ecf0a642cf719bc3866d5e1
+  data.tar.gz: 3f471987cc08462b81ee9865ceb28ac673d42e2f71f48fae48a9d896bc86c000bea2a2b5062c4808902bd7796c753486a3c2576e475d30e8bc4e7b986fd31f66

data/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+Changes to the `stateless-mcp` gem. The Rails integration has [its own changelog](../stateless-mcp-rails/CHANGELOG.md). The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.0.1] - 2026-10-19
+
+First release: a Rack endpoint for the stateless MCP protocol, 2026-07-28.
+
+- `StatelessMcp::Server`: one endpoint's settings, validated, with a default for each.
+- `StatelessMcp::Middleware`: reads the JSON-RPC body within the server's limit, checks `Origin`, and refuses requests whose headers disagree with the body.
+- JSON-RPC errors with the HTTP status the spec gives each.
+- `StatelessMcp::ToolDeclaration`, `StatelessMcp::Result` and `StatelessMcp::Pagination`: tool listings, results, and cursor paging of lists and long text.
+- Guides and examples for plain Rack and Sinatra.
+
+[Unreleased]: https://github.com/Jamedjo/stateless-mcp/compare/v0.0.1...HEAD
+[0.0.1]: https://github.com/Jamedjo/stateless-mcp/tree/v0.0.1/stateless-mcp

data/LICENSE-APACHE

@@ -0,0 +1,203 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

data/LICENSE-MIT

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 James Edwards-Jones
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,13 @@
+# stateless-mcp
+
+Rack middleware and building blocks for serving [Model Context Protocol](https://modelcontextprotocol.io/specification/2026-07-28) tools without sessions, from any Rack app, Sinatra included.
+
+> **Status:** early. Releases before 1.0 may change the API.
+
+```ruby
+gem "stateless-mcp"
+```
+
+The documentation is in the [main README](https://github.com/Jamedjo/stateless-mcp#readme), with guides for [plain Rack](https://github.com/Jamedjo/stateless-mcp/blob/main/docs/rack.md) and [Sinatra](https://github.com/Jamedjo/stateless-mcp/blob/main/docs/sinatra.md). Rails apps can use [`stateless-mcp-rails`](https://github.com/Jamedjo/stateless-mcp/tree/main/stateless-mcp-rails) instead.
+
+Licensed under either of Apache-2.0 or MIT, at your option.

data/lib/stateless-mcp.rb

@@ -0,0 +1 @@
+require "stateless_mcp"

data/lib/stateless_mcp/cursor.rb

@@ -0,0 +1,22 @@
+module StatelessMcp
+  # Cursors are opaque to the client, so a model carries next_cursor forward
+  # rather than inventing positions of its own. Inside, a cursor is a JSON
+  # array of values in URL-safe base64.
+  module Cursor
+    # Raised for a cursor this library didn't issue.
+    Invalid = Class.new(StandardError)
+
+    def self.encode(*values)
+      Base64.urlsafe_encode64(JSON.generate(values), padding: false)
+    end
+
+    # The values encoded, as an array of exactly count of them when count is given.
+    def self.decode(cursor, count: nil)
+      values = JSON.parse(Base64.urlsafe_decode64(cursor.to_s))
+      raise Invalid unless values.is_a?(Array) && (count.nil? || values.size == count)
+      values
+    rescue ArgumentError, EncodingError, JSON::ParserError
+      raise Invalid
+    end
+  end
+end

data/lib/stateless_mcp/header_check.rb

@@ -0,0 +1,53 @@
+module StatelessMcp
+  # 2026-07-28 clients mirror the method and its target into Mcp-Method and
+  # Mcp-Name for intermediaries to route on, and the spec requires refusing any
+  # request whose headers disagree with its body: otherwise a proxy could log
+  # one method while the server runs another.
+  module HeaderCheck
+    # Raises a Refusal for the first disagreement. A base64-wrapped Mcp-Name is
+    # decoded in env, so routes match the name itself.
+    def self.check!(env, body)
+      check_version(env["HTTP_MCP_PROTOCOL_VERSION"])
+      must_match("Mcp-Method", env["HTTP_MCP_METHOD"], body["method"])
+      env["HTTP_MCP_NAME"] = decode(env["HTTP_MCP_NAME"]) if env["HTTP_MCP_NAME"]
+      target = StatelessMcp.target_name(body)
+      must_match("Mcp-Name", env["HTTP_MCP_NAME"], target) if target
+      check_envelope(env, body) unless MCP::Methods.notification?(body["method"])
+    end
+
+    # Header values outside plain ASCII arrive base64 encoded inside a
+    # =?base64?…?= wrapper.
+    def self.decode(value)
+      encoded = value.to_s[/\A=\?base64\?(.*)\?=\z/m, 1]
+      encoded ? Base64.strict_decode64(encoded).force_encoding(Encoding::UTF_8) : value
+    rescue ArgumentError
+      value
+    end
+
+    # A missing header is a mismatch; a version this server doesn't speak is
+    # answered with the versions it does.
+    def self.check_version(version)
+      raise header_mismatch("MCP-Protocol-Version header is required") if version.to_s.empty?
+      return if MCP::Configuration.modern_protocol_version?(version)
+      raise Refusal.new(MCP::ErrorCodes::UNSUPPORTED_PROTOCOL_VERSION, "Unsupported protocol version", data: { supported: MCP::Configuration::SUPPORTED_MODERN_PROTOCOL_VERSIONS, requested: version })
+    end
+
+    def self.check_envelope(env, body)
+      must_match("MCP-Protocol-Version", env["HTTP_MCP_PROTOCOL_VERSION"], body.dig("params", "_meta", MCP::RequestEnvelope::PROTOCOL_VERSION_META_KEY)) if MCP::RequestEnvelope.modern?(body["params"])
+      MCP::RequestEnvelope.parse!(body["params"])
+    rescue MCP::Server::RequestHandlerError => error
+      raise Refusal.new(error.error_code, error.message, data: error.error_data)
+    end
+
+    def self.must_match(header, sent, expected)
+      return if sent == expected
+      raise header_mismatch(sent.to_s.empty? ? "#{header} header is required" : "#{header} header value '#{sent}' does not match body value '#{expected}'")
+    end
+
+    def self.header_mismatch(detail)
+      Refusal.new(MCP::ErrorCodes::HEADER_MISMATCH, "Header mismatch: #{detail}")
+    end
+
+    private_class_method :check_version, :check_envelope, :must_match, :header_mismatch
+  end
+end

data/lib/stateless_mcp/middleware.rb

@@ -0,0 +1,54 @@
+module StatelessMcp
+  # Rack middleware for one server's endpoint. A POST to the server's path has
+  # its body read within the server's limit and its headers checked against
+  # the body; the app then finds the server in env[Server::ENV_KEY] and the
+  # parsed body in env[REQUEST_ENV_KEY]. Requests to other paths pass through
+  # untouched.
+  #
+  #   use StatelessMcp::Middleware, server: StatelessMcp::Server.new(path: "/mcp")
+  #
+  # A request whose Origin header names another site is refused with a 403
+  # before anything else, unless the server allows that origin or has
+  # check_origin off. Authentication and rate limits are the app's, so
+  # middleware doing them goes before this one: a request it refuses is then
+  # never read.
+  class Middleware
+    def initialize(app, server:)
+      raise ArgumentError, "server: must be a StatelessMcp::Server; got #{server.inspect}" unless server.is_a?(Server)
+      @app = app
+      @server = server
+    end
+
+    def call(env)
+      return @app.call(env) unless @server.endpoint?(env)
+      env[Server::ENV_KEY] = @server
+      return forbidden_origin unless @server.origin_allowed?(env)
+      return method_not_allowed if ["GET", "DELETE"].include?(env["REQUEST_METHOD"])
+      return @app.call(env) unless env["REQUEST_METHOD"] == "POST"
+      body = env[REQUEST_ENV_KEY] = RequestBody.read(env, max_bytes: @server.max_body_bytes)
+      check(env, body)
+      @app.call(env)
+    rescue Refusal => refusal
+      refusal.to_rack(env[REQUEST_ENV_KEY])
+    end
+
+    private
+
+    # Every request is held to 2026-07-28. Serving earlier protocol revisions
+    # means deciding here which rules a request is held to.
+    def check(env, body)
+      HeaderCheck.check!(env, body)
+    end
+
+    # The spec allows a JSON-RPC error without an id in the body.
+    def forbidden_origin
+      [403, { "content-type" => "application/json" }, [JSON.generate(Rpc.error(nil, Rpc::ErrorCode::INVALID_REQUEST, "Origin not allowed"))]]
+    end
+
+    # Clients on earlier revisions open a stream with GET and end a session
+    # with DELETE; the spec has a stateless server answer both with 405.
+    def method_not_allowed
+      [405, { "allow" => "POST" }, []]
+    end
+  end
+end

data/lib/stateless_mcp/pagination.rb

@@ -0,0 +1,39 @@
+module StatelessMcp
+  # Paging tool results by cursor. A tool declares `paginated` among its
+  # arguments, which adds limit and cursor, and pages with these. A list or
+  # text is paged by position, so it suits data that doesn't change between
+  # calls; records that do are better paged by key, as the Rails ActiveRecord
+  # add-on does.
+  module Pagination
+    # The page size a call asked for, held to the server's limits.
+    def self.limit(requested, server)
+      (requested.nil? || requested.to_s.empty? ? server.page_size : Integer(requested)).clamp(1, server.max_page_size)
+    rescue ArgumentError, TypeError
+      server.page_size
+    end
+
+    # One page of items, and the cursor for the next while more remain.
+    def self.list(items, cursor:, limit:)
+      start = offset(cursor)
+      rows = items[start, limit + 1] || []
+      [rows.first(limit), (Cursor.encode(start + limit) if rows.size > limit)]
+    end
+
+    # A long text in parts of part_size characters, and the cursor for the
+    # next part while more remains. The block reads length characters of the
+    # text from start, so a text kept elsewhere is never read whole.
+    def self.text(cursor, part_size)
+      start = offset(cursor)
+      slice = yield(start, part_size + 1).to_s
+      [slice[0, part_size], (Cursor.encode(start + part_size) if slice.length > part_size)]
+    end
+
+    # Where a list or text continues from: the start, without a cursor.
+    def self.offset(cursor)
+      return 0 if cursor.nil? || cursor.to_s.empty?
+      position = Cursor.decode(cursor, count: 1).first
+      raise Cursor::Invalid unless position.is_a?(Integer) && !position.negative?
+      position
+    end
+  end
+end

data/lib/stateless_mcp/refusal.rb

@@ -0,0 +1,18 @@
+module StatelessMcp
+  # A request turned away before it reaches the app, answered as a JSON-RPC
+  # error.
+  class Refusal < StandardError
+    attr_reader :code, :data
+
+    def initialize(code, message, data: nil)
+      super(message)
+      @code = code
+      @data = data
+    end
+
+    def to_rack(body)
+      id = body["id"] if body.is_a?(Hash)
+      [Rpc.status_for(code), { "content-type" => "application/json" }, [JSON.generate(Rpc.error(id, code, message, data: data))]]
+    end
+  end
+end

data/lib/stateless_mcp/request_body.rb

@@ -0,0 +1,29 @@
+module StatelessMcp
+  # Reads and parses a request's JSON-RPC body, refusing it before reading
+  # past max_bytes. The body is put back as a fresh input, so the app can read
+  # it again as it would any other request.
+  module RequestBody
+    def self.read(env, max_bytes:)
+      raise too_large(max_bytes) if env["CONTENT_LENGTH"].to_i > max_bytes
+      raw = env["rack.input"]&.read(max_bytes + 1).to_s
+      raise too_large(max_bytes) if raw.bytesize > max_bytes
+      env["rack.input"] = StringIO.new(raw)
+      body = JSON.parse(raw)
+      raise Refusal.new(Rpc::ErrorCode::INVALID_REQUEST, "Body must be a single JSON-RPC request object") unless single_request?(body)
+      body
+    rescue JSON::ParserError
+      raise Refusal.new(Rpc::ErrorCode::PARSE_ERROR, "Parse error")
+    end
+
+    # Batches are refused: 2026-07-28 carries one message per POST.
+    def self.single_request?(body)
+      body.is_a?(Hash) && JsonRpcHandler.valid_version?(body["jsonrpc"]) && JsonRpcHandler.valid_method_name?(body["method"])
+    end
+
+    def self.too_large(max_bytes)
+      Refusal.new(Rpc::ErrorCode::INVALID_REQUEST, "Request body is larger than #{max_bytes} bytes")
+    end
+
+    private_class_method :single_request?, :too_large
+  end
+end

data/lib/stateless_mcp/result.rb

@@ -0,0 +1,32 @@
+module StatelessMcp
+  # The result objects a server answers with, before they are wrapped in a
+  # JSON-RPC response.
+  module Result
+    # Every 2026-07-28 result names its type. A cacheable one also carries the
+    # spec's cache hints, set so a client caches it only for this caller and
+    # checks again before reusing it.
+    def self.complete(result, cacheable: false)
+      result = { ttlMs: 0, cacheScope: "private" }.merge(result) if cacheable
+      result.merge(resultType: MCP::ResultType::COMPLETE)
+    end
+
+    # A tool's answer, as JSON in one text block, leaving out a hash's nil
+    # values. Clients hand the text to the model. structuredContent is for
+    # programs validating against an outputSchema, which these tools don't
+    # declare, so sending it as well would only double every result.
+    def self.tool(payload)
+      payload = payload.compact if payload.is_a?(Hash)
+      complete(MCP::Tool::Response.new([{ type: "text", text: payload.to_json }]).to_h)
+    end
+
+    # A tool call turned down with a message the model can read and act on.
+    def self.refusal(message)
+      complete(MCP::Tool::Response.new([{ type: "text", text: message }], error: true).to_h)
+    end
+
+    # The answer to server/discover.
+    def self.discover(server, capabilities:)
+      complete({ supportedVersions: MCP::Configuration::SUPPORTED_MODERN_PROTOCOL_VERSIONS, capabilities: capabilities, instructions: server.instructions, _meta: { MCP::RequestEnvelope::SERVER_INFO_META_KEY => server.info } }.compact, cacheable: true)
+    end
+  end
+end

data/lib/stateless_mcp/rpc.rb

@@ -0,0 +1,24 @@
+module StatelessMcp
+  # JSON-RPC envelopes, and the HTTP status each error travels with. The
+  # envelopes are the mcp gem's own.
+  module Rpc
+    ErrorCode = JsonRpcHandler::ErrorCode
+    BAD_REQUEST_CODES = MCP::Server::Transports::StreamableHTTPTransport::MODERN_BAD_REQUEST_CODES
+
+    def self.success(id, result)
+      JsonRpcHandler.success_response(id: id, result: result)
+    end
+
+    # A request whose id is missing or malformed is answered with a null id.
+    def self.error(id, code, message, data: nil)
+      JsonRpcHandler.error_response(id: id.nil? ? :unknown_id : id, id_validation_pattern: JsonRpcHandler::DEFAULT_ALLOWED_ID_CHARACTERS, error: { code: code, message: message, data: data })
+    end
+
+    # A 404 carrying a JSON-RPC body tells a client it reached a current server
+    # that lacks the method, rather than a missing endpoint.
+    def self.status_for(code)
+      return 404 if code == ErrorCode::METHOD_NOT_FOUND
+      BAD_REQUEST_CODES.include?(code) ? 400 : 200
+    end
+  end
+end

data/lib/stateless_mcp/server.rb

@@ -0,0 +1,128 @@
+module StatelessMcp
+  # One MCP endpoint: where it is served, how it describes itself, and the
+  # limits it holds requests to. Every other part of the library is handed the
+  # server it serves, so an app can run several side by side:
+  #
+  #   admin = StatelessMcp::Server.new(path: "/admin/mcp", name: "admin", max_body_bytes: 16_384)
+  #
+  # A server is frozen once built, so it can be shared between threads.
+  class Server
+    # Raised for a setting that can't be served, naming the setting.
+    Invalid = Class.new(ArgumentError)
+
+    # The server a request was routed to, which the middleware leaves in the Rack env.
+    ENV_KEY = "stateless_mcp.server"
+
+    # How a resource's tools are named from its actions: index on notes is list_notes.
+    DEFAULT_TOOL_VERBS = { index: "list", show: "get", create: "create", update: "update", destroy: "delete" }.freeze
+
+    DEFAULTS = {
+      path: "/mcp",
+      name: "mcp",
+      version: "1.0.0",
+      title: nil,
+      instructions: nil,
+      max_body_bytes: 1_048_576,
+      page_size: 20,
+      max_page_size: 100,
+      tool_verbs: DEFAULT_TOOL_VERBS,
+      # The MCP spec has servers refuse a request whose Origin header names
+      # another site, so a page in a browser can't drive the tools with the
+      # visitor's credentials. Requests without an Origin, from non-browser
+      # clients, are unaffected.
+      check_origin: true,
+      # Origins other than the server's own that may call it, such as
+      # "https://app.example".
+      allowed_origins: []
+    }.freeze
+
+    attr_reader(*DEFAULTS.keys)
+
+    # tool_verbs are merged over the defaults, so an app can rename one verb
+    # without restating the rest.
+    def initialize(**settings)
+      unknown = settings.keys - DEFAULTS.keys
+      raise Invalid, "Unknown server settings: #{unknown.join(", ")}" if unknown.any?
+      settings = DEFAULTS.merge(settings.compact)
+      @path = check_path(settings[:path])
+      @name = check_text(:name, settings[:name])
+      @version = check_text(:version, settings[:version])
+      @title = check_text(:title, settings[:title]) unless settings[:title].nil?
+      @instructions = check_text(:instructions, settings[:instructions]) unless settings[:instructions].nil?
+      @max_body_bytes = check_positive(:max_body_bytes, settings[:max_body_bytes])
+      @page_size = check_positive(:page_size, settings[:page_size])
+      @max_page_size = check_positive(:max_page_size, settings[:max_page_size])
+      raise Invalid, "page_size (#{page_size}) can't be larger than max_page_size (#{max_page_size})" if page_size > max_page_size
+      @tool_verbs = check_tool_verbs(settings[:tool_verbs])
+      @check_origin = check_boolean(:check_origin, settings[:check_origin])
+      @allowed_origins = check_origins(settings[:allowed_origins])
+      freeze
+    end
+
+    # Whether a request is addressed to this server's endpoint.
+    def endpoint?(env)
+      env["PATH_INFO"] == path
+    end
+
+    # Whether a request's Origin header, if it has one, may call this server:
+    # the server's own origin, or one of allowed_origins.
+    def origin_allowed?(env)
+      origin = env["HTTP_ORIGIN"]
+      return true if origin.nil? || !check_origin
+      origin = origin.downcase
+      origin == Rack::Request.new(env).base_url.downcase || allowed_origins.include?(origin)
+    end
+
+    # The serverInfo object the protocol describes a server with.
+    def info
+      { name: name, title: title, version: version }.compact
+    end
+
+    def inspect
+      "#<#{self.class.name} #{path} #{name}>"
+    end
+
+    private
+
+    def check_path(value)
+      return value.dup.freeze if value.is_a?(String) && value.match?(%r{\A/[^?#\s]*\z}) && (value == "/" || !value.end_with?("/"))
+      raise Invalid, "path must be an absolute path such as \"/mcp\", without a trailing slash, query or fragment; got #{value.inspect}"
+    end
+
+    def check_text(setting, value)
+      return value.dup.freeze if value.is_a?(String) && !value.strip.empty?
+      raise Invalid, "#{setting} must be a non-empty string; got #{value.inspect}"
+    end
+
+    def check_positive(setting, value)
+      return value if value.is_a?(Integer) && value.positive?
+      raise Invalid, "#{setting} must be a positive integer; got #{value.inspect}"
+    end
+
+    def check_boolean(setting, value)
+      return value if value == true || value == false
+      raise Invalid, "#{setting} must be true or false; got #{value.inspect}"
+    end
+
+    def check_origins(value)
+      raise Invalid, "allowed_origins must be an array of origins such as \"https://app.example\"; got #{value.inspect}" unless value.is_a?(Array)
+      value.map { |origin| check_origin_url(origin) }.freeze
+    end
+
+    # Only scheme, host and port: an Origin header carries nothing more.
+    def check_origin_url(value)
+      uri = URI.parse(value.to_s)
+      return value.downcase.freeze if uri.is_a?(URI::HTTP) && uri.host && !uri.host.empty? && uri.path.empty? && uri.query.nil? && uri.fragment.nil? && uri.userinfo.nil?
+      raise Invalid, "allowed_origins entries must be origins such as \"https://app.example\", without a path; got #{value.inspect}"
+    rescue URI::InvalidURIError
+      raise Invalid, "allowed_origins entries must be origins such as \"https://app.example\", without a path; got #{value.inspect}"
+    end
+
+    def check_tool_verbs(value)
+      raise Invalid, "tool_verbs must be a hash of action to verb; got #{value.inspect}" unless value.is_a?(Hash)
+      verbs = DEFAULT_TOOL_VERBS.merge(value.to_h { |action, verb| [action.to_sym, verb] })
+      verbs.each { |action, verb| check_text(:"tool_verbs[:#{action}]", verb) }
+      verbs.transform_values { |verb| verb.dup.freeze }.freeze
+    end
+  end
+end

data/lib/stateless_mcp/tool_declaration.rb

@@ -0,0 +1,70 @@
+module StatelessMcp
+  # What a tool says about itself in tools/list: its title, description,
+  # behaviour hints and arguments. The name is left to whatever routes calls
+  # to the tool, so one declaration can't be listed under two names by mistake.
+  #
+  #   StatelessMcp::ToolDeclaration.new(title: "List notes", description: "Lists notes, newest first.") do
+  #     argument :tag, :string, "Only notes with this tag"
+  #     argument :created_after, :datetime, "ISO 8601 date or time"
+  #     paginated "notes"
+  #   end
+  #
+  # The arguments are built once per server, because paginated describes that
+  # server's page sizes.
+  class ToolDeclaration
+    READ_ONLY = { read_only_hint: true, destructive_hint: false, idempotent_hint: true, open_world_hint: false }.freeze
+
+    attr_reader :title, :description, :annotations
+
+    def initialize(title:, description:, annotations: READ_ONLY, &arguments)
+      @title = title
+      @description = description
+      @annotations = annotations
+      @arguments = arguments
+      @input_schemas = {}
+      @lock = Mutex.new
+    end
+
+    # The JSON Schema the mcp gem validates a call's arguments with.
+    def input_schema(server)
+      @lock.synchronize { @input_schemas[server] ||= MCP::Tool::InputSchema.new(Arguments.build(server, &@arguments)) }
+    end
+
+    # The tools/list entry, built by the mcp gem so its shape keeps up with the spec.
+    def to_h(name, server)
+      MCP::Tool.define(name: name, title: title, description: description, input_schema: input_schema(server), annotations: annotations).to_h
+    end
+
+    # The block a declaration is written in.
+    class Arguments
+      def self.build(server, &block)
+        arguments = new(server)
+        arguments.instance_eval(&block) if block
+        arguments.to_h
+      end
+
+      def initialize(server)
+        @server = server
+        @properties = {}
+        @required = []
+      end
+
+      # Types are JSON Schema's, plus :datetime, which travels as a string.
+      # Further keywords, such as enum: or minimum:, go into the property as given.
+      def argument(name, type, description, required: false, **keywords)
+        @properties[name.to_s] = { type: type.to_s == "datetime" ? "string" : type.to_s, description: description, **keywords }
+        @required << name.to_s if required
+      end
+
+      # limit and cursor, described with the server's page sizes.
+      def paginated(noun = "results")
+        argument :limit, :integer, "How many #{noun} to return, #{@server.page_size} by default", minimum: 1, maximum: @server.max_page_size
+        argument :cursor, :string, "next_cursor from an earlier result, for the next page"
+      end
+
+      def to_h
+        { properties: @properties, required: (@required unless @required.empty?) }.compact
+      end
+    end
+  end
+end

data/lib/stateless_mcp/version.rb

@@ -0,0 +1,4 @@
+module StatelessMcp
+  # Shared by both gems, which are always released together at the same version.
+  VERSION = "0.0.1"
+end

data/lib/stateless_mcp.rb

@@ -0,0 +1,41 @@
+require "base64"
+require "json"
+require "rack"
+require "stringio"
+require "uri"
+require "mcp"
+require "mcp/server/transports/streamable_http_transport"
+require_relative "stateless_mcp/version"
+
+# Serves the 2026-07-28 Model Context Protocol without sessions: every request
+# carries its own protocol version and is answered on its own, so any process
+# can take any call.
+module StatelessMcp
+  # Raised with a message the model can act on, such as a date it couldn't
+  # read. It is answered as a refused tool call, which the model sees, rather
+  # than a protocol error, which it may not.
+  InvalidArgument = Class.new(StandardError)
+
+  # The parsed JSON-RPC body, which the middleware leaves in the Rack env.
+  REQUEST_ENV_KEY = "stateless_mcp.request"
+
+  # Methods whose target is mirrored into the Mcp-Name header.
+  NAME_BEARING_METHODS = MCP::Server::Transports::StreamableHTTPTransport::NAME_BEARING_METHODS
+
+  # The tool name, or resource URI, that a request's Mcp-Name header must repeat.
+  def self.target_name(body)
+    params = body["params"]
+    params["name"] || params["uri"] if NAME_BEARING_METHODS.include?(body["method"]) && params.is_a?(Hash)
+  end
+end
+
+require_relative "stateless_mcp/rpc"
+require_relative "stateless_mcp/refusal"
+require_relative "stateless_mcp/server"
+require_relative "stateless_mcp/cursor"
+require_relative "stateless_mcp/pagination"
+require_relative "stateless_mcp/request_body"
+require_relative "stateless_mcp/header_check"
+require_relative "stateless_mcp/middleware"
+require_relative "stateless_mcp/result"
+require_relative "stateless_mcp/tool_declaration"

metadata

@@ -0,0 +1,127 @@
+--- !ruby/object:Gem::Specification
+name: stateless-mcp
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- James Edwards-Jones
+bindir: bin
+cert_chain: []
+date: 2026-10-19 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1'
+- !ruby/object:Gem::Dependency
+  name: mcp
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+description: 'Serves the 2026-07-28 Model Context Protocol without sessions: every
+  request is answered on its own, so any instance behind a load balancer can take
+  any call. Rack middleware, JSON-RPC errors, cursors and tool schemas, with Rails
+  support in stateless-mcp-rails.'
+email:
+- git@jamedjo.co.uk
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE-APACHE
+- LICENSE-MIT
+- README.md
+- lib/stateless-mcp.rb
+- lib/stateless_mcp.rb
+- lib/stateless_mcp/cursor.rb
+- lib/stateless_mcp/header_check.rb
+- lib/stateless_mcp/middleware.rb
+- lib/stateless_mcp/pagination.rb
+- lib/stateless_mcp/refusal.rb
+- lib/stateless_mcp/request_body.rb
+- lib/stateless_mcp/result.rb
+- lib/stateless_mcp/rpc.rb
+- lib/stateless_mcp/server.rb
+- lib/stateless_mcp/tool_declaration.rb
+- lib/stateless_mcp/version.rb
+homepage: https://github.com/Jamedjo/stateless-mcp
+licenses:
+- MIT
+- Apache-2.0
+metadata:
+  homepage_uri: https://github.com/Jamedjo/stateless-mcp
+  source_code_uri: https://github.com/Jamedjo/stateless-mcp/tree/v0.0.1/stateless-mcp
+  changelog_uri: https://github.com/Jamedjo/stateless-mcp/blob/main/stateless-mcp/CHANGELOG.md
+  documentation_uri: https://github.com/Jamedjo/stateless-mcp/blob/main/README.md
+  bug_tracker_uri: https://github.com/Jamedjo/stateless-mcp/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: Stateless Model Context Protocol servers over plain HTTP, for any Rack app
+test_files: []