v0.18.2

What's Changed

• Validate message endpoint in SSE client transport by @Kehrlann in #945

Full Changelog: v0.18.1...v0.18.2

v2.0.0-M2

What's Changed

• fix: Return empty prompt completion result when prompt has no arguments by @chemicL in #934

Full Changelog: v2.0.0-M1...v2.0.0-M2

v1.1.2

What's Changed

• HttpClientStreamableHttpTransport: handle HTTP 405 by @Kehrlann in #900

Full Changelog: v1.1.1...v1.1.2

v2.0.0-M1

MCP Java SDK 2.0.0-M1

The 2.0.0-M1 release introduces foundational changes for the 2.x line, focusing on flexibility, spec compliance, and robust validation. The primary themes driving this major release include:

1. Breaking API Changes in McpSchema for Forward/Backward Compatibility

The 1.x line was constrained by sealed interfaces, which made it impossible to add permitted subtypes without breaking exhaustive pattern-match switch expressions in caller code. In v2.0.0, these constraints are lifted:

• Removal of Sealed Interfaces: Sealed interfaces have been removed from JSONRPCMessage, Request, Result, Notification, ResourceContents, CompleteReference, and Content. This allows domain types to absorb new fields and subtypes without breaking existing clients or servers.
• Lenient Deserialization: All domain records now tolerate unknown JSON fields, ensuring that a client built against an older SDK version won't fail when a newer server sends unrecognized fields.
• Dialect Support: JsonSchema was removed and replaced with a Map for inputSchema to properly support various JSON Schema dialects.

2. Incorporating Breaking Changes for the 2025-11-25 MCP Specification

The release aligns with the 2025-11-25 MCP specification updates:

• Tool Input Validation: Tool input arguments validation is now activated by default. Invalid inputs will now cause a tool execution error, enforcing stricter compliance with the spec.
• Spec-Required Fields: Adjustments to how nulls and absent fields are handled on the wire (e.g., CompleteCompletion.total and .hasMore are now absent from the wire when not set, rather than being emitted as null).

3. API Cleanup and Modernization

As a major version bump, v2.0.0 takes the opportunity to clean up the API surface:

• Removal of Deprecated Methods: Deprecated methods from the Server transports builder have been removed entirely.
• Transport Improvements: Added proper handling for HTTP 405 in HttpClientStreamableHttpTransport and fixed UTF-8 encoding for non-ASCII tool names.
• Pagination Support: Added support for the meta parameter in client paginated list queries.

---

Detailed Commit Log (v1.1.0 to v2.0.0-M1)

• 4c85963 feat!: consistent JSON forward/backward compatibility - 2.0 foundation (#972) by @chemicL
• d182338 feat!: #697 added tool input arguments validation (#873) by @ashakirin
• 9520323 fix: Remove JsonSchema and use a Map for inputSchema to support json schemas dialect (#749) by @bilaloumehdi
• eaa0c69 feat: add support for meta parameter in client paginated list queries (#906) by @smohite04
• 8fd9903 Fix UTF-8 encoding for non-ASCII tool names in HTTP client transports (#850) by @rameshreddy-adutla
• 8c7774a Client transports: remove deprecated methods from builder (#899) by @Kehrlann
• 301dbe4 Deprecate Builder.customizeRequest() in favor of httpRequestCustomizer() (#791) by @gyeo009
• cd2c21c docs: document best practice for handling argument errors in MCP tools (#891) by @radeshgovind-2005
• 22e7bd4 conformance: update to mcp-security 0.1.5, pass scope-step-up (#895) by @Kehrlann
• 3a78182 fix: proper URL links from README.md to 'Java Dependencies', 'Java MCP Client', 'Java MCP Server' pages (#874) by @sleepytomcat

---

New contributors

A big thank you to the following contributors who made their first commit in this release:

• @sleepytomcat made their first contribution in #874
• @radeshgovind-2005 made their first contribution in #891
• @gyeo009 made their first contribution in #791
• @rameshreddy-adutla made their first contribution in #850
• @smohite04 made their first contribution in #906
• @bilaloumehdi made their first contribution in #749

Full Changelog: v1.1.0...v2.0.0-M1

v1.1.1

What's Changed

• Remove "Access-control-allow-origin" header in server transports by @srikanthramu and @Kehrlann

Full Changelog: v1.1.0...v1.1.1

v1.0.1

What's Changed

• Remove "Access-control-allow-origin" header in server transports by @srikanthramu and @Kehrlann

Full Changelog: v1.0.0...v1.0.1

v1.1.0

What's Changed

• Use dynamic jar discovery for conformance tests by @chemicL in #832
• Add migration notes for 0.18.1 to 1.0.0 update by @chemicL in #828
• Support resource subscriptions by @chemicL in #839
• Add explicit UTF-8 charset to InputStreamReader in StdioServerTransportProvider by @xxxxxxjun in #826
• Document resource subscription support in server and client guides by @tzolov in #843
• Fix elicitation and resource subscription tests that deadlock on a single CPU by @chemicL in #854
• HttpClientStreamHttpTransport: add authorization error handler by @Kehrlann in #861
• fix: prepare POMs for Maven Central release readiness by @tzolov in #863

New Contributors

• @xxxxxxjun made their first contribution in #826

Full Changelog: v1.0.0...v1.1.0

v1.0.0

MCP Java SDK 1.0.0

We are pleased to announce the 1.0.0 GA release of the MCP Java SDK — the official Java SDK for Model Context Protocol servers and clients, maintained in collaboration with Spring AI.

---

Major Features

• MCP Protocol Implementation — Spec-compliant implementation of the Model Context Protocol, including tools, resources, prompts, sampling, elicitation, and progress tracking.
• Synchronous and Asynchronous APIs — First-class support for both blocking (McpSyncClient / McpSyncServer) and reactive (McpAsyncClient / McpAsyncServer) programming models.
• Official Transport Options — STDIO, Servlet-based (Streamable HTTP and HTTP/SSE) transports out of the box.
• Pluggable JSON Serialization — Supports both Jackson 2 and Jackson 3, with Jackson 3 as the default. Integration is decoupled so projects can supply their own binding.
• MCP Protocol Version Negotiation — Clients and servers automatically negotiate the highest mutually supported protocol version at connection time.
• Authorization & Security — DNS rebinding protection, Origin header validation, and conformance-tested OAuth/auth flows via relevant hooks.
• OSGi Support — All modules ship with correct OSGi bundle manifests for use in Eclipse/OSGi runtimes.
• BOM for Dependency Management — mcp-bom keeps all SDK module versions aligned with a single import.
• MCP Test Module — Reusable test utilities and a conformance test suite for validating server and client implementations.

---

Spec Compliance

The SDK is compliant with the 2025-06-18 MCP specification and supports protocol version negotiation across 2024-11-05, 2025-03-26, and 2025-06-18.

Work towards 2025-11-25 spec compliance is actively in progress. Key features in that revision include tasks (durable request tracking), tool calling in sampling, URL elicitation, icon metadata, enhanced JSON Schema support, and updated OAuth/security flows. See the Roadmap for details.

---

Stability in the 1.x Line

With 1.0.0, the SDK transitions to a stable, semantically versioned release line. The project follows Semantic Versioning 2.0.0:

• Patch releases (1.0.x) deliver backward-compatible bug fixes.
• Minor releases (1.x.0) deliver new, backward-compatible features — including new MCP spec support.
• Major releases (2.x) are reserved for breaking API changes or MCP spec revisions that require code changes on the caller side.

Breaking changes are always documented with migration instructions, APIs are deprecated before removal, and pull requests containing breaking changes are labeled accordingly. See VERSIONING.md for the full policy.

---

What's Changed in 1.0.0

Spring Transports Move to Spring AI 2.0

• Moved mcp-spring-webflux and mcp-spring-webmvc to Spring AI 2.0 (#805)

API Cleanup

• Removed all APIs deprecated during the RC cycle to establish a clean stable baseline (#807)

Security & Conformance

• Added authorization conformance testing using Spring Security (#806)
• Updated SECURITY.md to use GitHub Security Advisories (#801)

OSGi

• Fixed and simplified OSGi manifest.mf generation (#792)

Governance & Community

• Added governance documentation (#808)
• Updated community support channel to Stack Overflow (#824)

---

New Contributors

• @scottslewis — OSGi manifest fixes (#792)
• @localden — Security advisory process (#801)

Full Changelog: v0.18.1...v1.0.0

v1.0.0-RC3

We are pleased to announce the v1.0.0-RC3 release 🚀 marking the beginning of a stable 1.x release line.

What's Changed

• Move mcp-spring-webflux and mcp-spring-webmvc to Spring AI 2.0 by @tzolov in #805
• Remove deprecations from 1.0.0 by @chemicL in #807
• Conformance testing: add auth conformance testing by @Kehrlann in #806
• Add governance documentation for SEP-1730 by @chemicL in #808
• Fix and simplification for osgi manifest.mf generation by @scottslewis in #792
• Update SECURITY.md to use GitHub Security Advisories by @localden in #801
• Change StackOverflow link and tag for support by @chemicL in #824

New Contributors

• @scottslewis made their first contribution in #792
• @localden made their first contribution in #801

Full Changelog: v0.18.1...v1.0.0-RC3

v0.18.1

What's Changed

• Fix and simplification for osgi manifest.mf contents generation - Cherry-picked from main (159eb96)

Full Changelog: v0.18.0...v0.18.1