chore(deps): update rust crate rmcp to v3 - #3778

v3.4.0

Compare Source

Added

• (model) add ServerConfig and ClientConfig (#​1266)

Fixed

• (rmcp) use ServerConfig in cancellation test (#​1273)
• (rmcp) route peer cancellation by lifecycle (#​1262)
• run first pre-init request in service loop (#​1263)
• (auth) let url origin decide prm discovery (#​1264)
• (model) deprecate ServerInfo and ClientInfo aliases (#​1156)
• (auth) ignore non-metadata JSON when probing for protected resource metadata (#​1204)
• do not treat malformed JSON 200 as Accepted for requests (#​1208)
• (streamable-http-server) map handler-generated HeaderMismatch to HTTP 400 (#​1259)
• (http) enforce Origin validation semantics (#​1192)

v3.3.0

Compare Source

Added

• add ServerHandler::negotiate_initialize (#​1247)
• (macros) reject empty tool_router (#​1233)
• (auth) add enterprise refresh-token and ID-JAG exchanges (#​1234)

Fixed

• (sse) saturate exponential reconnect backoff to avoid overflow panic (#​1231)
• resolve clippy warnings across workspace (#​1195)
• (auth) unify refresh checks and error handling (#​1236)

Other

• (deps) update process-wrap requirement from 9.0 to 10.0 (#​1229)

v3.2.0

Compare Source

Added

• (auth) coordinate OAuth refreshes through credential stores (#​1232)
• add request-state key rotation (#​1128)

Fixed

• keep initialize on legacy protocol versions (#​1228)
• (transport) fall back after sessionless HTTP discover rejections (#​1211)
• allow concurrent streamable http requests (#​1186)

v3.1.4

Compare Source

Fixed

• (rmcp) preserve elicitation requestedSchema $schema dialect (#​1176)
• harden signing key handling (#​1166)
• report pre-init metadata errors (#​1160)

v3.1.3

Compare Source

Fixed

• (auth) ignore query parameters when matching resources (#​1177)
• (auth) retain state until issuer validation (#​1167)
• (model) preserve elicitation property order metadata (#​1150)
• time out auto discovery probe (#​1149)
• (client) classify discover outcome at source, not at the error type (#​1133)

Other

• Fix typo in to_authorized_http_client doc comment (#​1158)

v3.1.2

Compare Source

Fixed

• (auth) map 401/403 challenges on the SSE GET stream (#​1152)
• (sse) loop instead of recursing when skipping SSE events (#​1146)
• (auth) preserve issuer trailing slash during discovery (#​1145)

v3.1.1

Compare Source

Fixed

• emit cache hints from handler macros (#​1120)
• expose MRTR state to tool handlers (#​1104)
• disambiguate input-required results (#​1103)

Other

• make async-trait optional (#​1119)

v3.1.0

Compare Source

Added

• classify authorization-required errors (#​1056)
• add strict stateless protocol metadata validation (#​1091)
• SEP-2260 stream-based enforcement of client receive-side request association (#​1055)

Fixed

• (model) decode metadata-bearing input-required results affecting mrtr (#​1097)
• require metadata for modern HTTP requests (#​1089)
• honor supported_protocol_versions when negotiating initialize (#​1093)

Other

• document the ping utility with examples (#​1106)
• complete Tier 1 feature docs and finalize roadmap (#​1101)
• (conformance) meeting requirements for tier 1 (#​1087)

v3.0.1

Compare Source

Fixed

• (auth) use discovered resource for token refresh (#​1084)
• return header mismatch for missing protocol header (#​1083)
• negotiate stateless initialize versions (#​1080)
• stamp server info on graceful subscription results (#​1078)

v3.0.0

Compare Source

RMCP 3.0 adds support for MCP 2026-07-28. Review the protocol key changes and the RMCP 3.0 migration guide before upgrading from 2.x.

Breaking changes

• Sessionless Streamable HTTP: MCP 2026-07-28 removes protocol-level sessions: no Mcp-Session-Id, standalone GET stream, DELETE-based session termination, or Last-Event-ID resumption. RMCP creates a fresh handler per request, so persistent state must live outside the handler. stateful_mode is renamed to legacy_session_mode and now only controls older protocol versions; custom SSE clients must also accept an optional session ID.
• Stateless lifecycle and discovery: the 2026-07-28 protocol removes initialize/notifications/initialized; each request carries the protocol version and client capabilities in _meta, and servers expose server/discover. RMCP clients opt into this lifecycle with serve_with_lifecycle and ClientLifecycleMode::Discover or Auto; the existing serve() path remains available for legacy initialization.
• Subscriptions and removed methods: subscriptions/listen replaces the standalone GET stream and resources/subscribe/resources/unsubscribe. ping, logging/setLevel, and notifications/roots/list_changed are unavailable under 2026-07-28; RMCP retains their APIs for legacy protocol sessions.
• Multi Round-Trip Requests and result types: ServerHandler::call_tool, get_prompt, and read_resource now return MRTR-aware response enums. Manual handler implementations and exhaustive ServerResult matches must handle InputRequiredResult, and result models carry an optional result_type for legacy wire compatibility.
• Tasks: the experimental core tasks API is replaced by the io.modelcontextprotocol/tasks extension, including new task handlers, methods, and TaskManager APIs.
• Rust model types: metadata is split into MetaObject, RequestMetaObject, and NotificationMetaObject; Annotations::last_modified is now Option<String>; and tool structured content accepts any serde_json::Value.
• OAuth: authorization startup is consolidated around AuthorizationRequest; metadata discovery is renamed to resolve_metadata and returns provenance; and custom OAuth HTTP errors are now boxed source errors.
• Compatibility: APIs deprecated before 3.0 have been removed, and the minimum supported Rust version is now 1.88.

What's Changed

• feat!: add MRTR model types (SEP-2322) by @​DaleSeo in #​915
• feat!: relax tool result structuredContent type (SEP-2106) by @​DaleSeo in #​933
• feat: relax outputSchema to accept non-object JSON Schema types (SEP-2106) by @​branben in #​895
• fix: flag schema derive on schemars feature by @​jamadeo in #​966
• feat!: add SEP-2243 HTTP standard headers by @​DaleSeo in #​907
• feat!: type Annotations.lastModified as a string by @​DaleSeo in #​956
• feat!: add MRTR behavior support (SEP-2322) by @​DaleSeo in #​929
• fix: specify compatible sse-stream version by @​jamadeo in #​968
• implementing SEP-2549 TTL for List Results by @​michaelneale in #​889
• test: enable supported draft SEP coverage by @​DaleSeo in #​971
• docs: retarget roadmap to 2026-07-28 spec by @​DaleSeo in #​986
• chore(deps): update tokio-tungstenite requirement from 0.29.0 to 0.30.0 by @​dependabot[bot] in #​989
• chore: update client conformance test scenarios by @​jamadeo in #​991
• test: stabilize JavaScript dependency install by @​DaleSeo in #​972
• fix(streamable-http): preserve progress in JSON mode by @​jstar0 in #​990
• fix: bound streamable HTTP memory usage by @​DaleSeo in #​970
• chore(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in #​992
• feat!: align metadata models with draft schema by @​DaleSeo in #​993
• feat(conformance): add SEP-2243 header validation tool by @​jstar0 in #​997
• feat!: add server discovery and negotiation (SEP-2575) by @​DaleSeo in #​973
• feat: accumulate client-side scopes during step-up authorization (SEP-2350) by @​stefanoamorelli in #​888
• chore(deps): update hmac requirement from 0.12 to 0.13 by @​dependabot[bot] in #​988
• fix(auth): validate discovered metadata issuer by @​jamadeo in #​996
• feat: add modern client lifecycle modes (SEP-2575) by @​DaleSeo in #​995
• fix(auth): distinguish rejected refresh tokens from transient failures by @​stevenlee-oai in #​963
• fix(transport): cancel in-flight request on streamable-HTTP client disconnect (#​857) by @​ameyypawar in #​967
• fix(auth): add an SDK path for pre-registered OAuth clients by @​jamadeo in #​994
• feat(auth): bind DCR client credentials to issuing authorization server (SEP-2352) by @​alexhancock in #​998
• fix: enumerate conformance client scenarios by @​jamadeo in #​1008
• fix: pass SEP-2243 client conformance by @​DaleSeo in #​1012
• fix(server): serve draft-version requests statelessly per SEP-2567 by @​alexhancock in #​999
• fix: preserve negotiated progress responses by @​DaleSeo in #​1005
• fix: .with_stateful_mode -> .with_legacy_session_mode by @​jamadeo in #​1015
• chore: run full conformance CI suite by @​jamadeo in #​1010
• ci: fix discovery response parsing by @​DaleSeo in #​1016
• feat: add subscription listen streams (SEP-2575) by @​DaleSeo in #​1000
• ci: add workflow to clean up stale PRs and issues by @​DaleSeo in #​1007
• fix: preserve JSON Schema 2020-12 keywords by @​DaleSeo in #​1018
• ci: expose extension conformance gaps by @​DaleSeo in #​1019
• fix: re-register after auth server change by @​DaleSeo in #​1011
• chore(deps): bump actions/labeler from 6 to 7 by @​dependabot[bot] in #​1023
• fix: accept stringified numeric response IDs by @​DaleSeo in #​1021
• fix: conformance tests for tools_call and auth/scope-step-up by @​alexhancock in #​1022
• feat: Implement SEP-2663 Tasks Extension by @​jamadeo in #​1020
• feat: add client-side TTL-honoring response cache (SEP-2549) by @​alexhancock in #​1025
• fix: reap completed response send tasks by @​N0zoM1z0 in #​1026
• feat: add distributed Streamable HTTP event store by @​DaleSeo in #​1024
• feat: route SEP-2260 associated server requests to the originating SSE stream by @​gocamille in #​1029
• docs: update for 2026-07-28 version by @​alexhancock in #​1032
• chore: refactor OAuth client authorization api by @​jamadeo in #​1009
• fix: use issuer for JWT client audience by @​DaleSeo in #​1031
• chore: release v3.0.0-beta.1 by @​github-actions[bot] in #​964
• chore: declare and check MSRV by @​jamadeo in #​1034
• fix!: omit resultType for legacy protocol sessions by @​DaleSeo in #​1038
• feat: expose oauth discovery metadata source by @​DaleSeo in #​1041
• chore: release v3.0.0-beta.2 by @​github-actions[bot] in #​1035
• fix: default to allowing missing issuer by @​jamadeo in #​1051
• refactor: make oauth discovery reactive by @​DaleSeo in #​1052
• fix: reject missing issuer in authorization server metadata by default by @​jamadeo in #​1054
• chore: release v3.0.0-beta.3 by @​github-actions[bot] in #​1053
• fix: accept namespaced discovery server information by @​tsarlandie-oai in #​1044
• ci: simplify conformance while running against both spec versions by @​alexhancock in #​1060
• chore(deps): update jsonwebtoken requirement from 10 to 11 by @​dependabot[bot] in #​1058
• chore(deps): update base64 requirement from 0.22 to 0.23 by @​dependabot[bot] in #​1059
• chore: release v3.0.0-beta.4 by @​github-actions[bot] in #​1061
• fix: gate client handler bounds for local by @​DaleSeo in #​1068
• fix!: preserve OAuth discovery transport errors by @​DaleSeo in #​1069
• refactor!: remove deprecated v3 APIs by @​DaleSeo in #​1066
• chore(deps): bump actions/stale from 10 to 11 by @​dependabot[bot] in #​1074
• fix: preserve transient OAuth discovery HTTP errors by @​tsarlandie-oai in #​1071
• RFC 9728 resource is used instead of base url when possible by @​fkonecny in #​962
• docs: prepare for stable 3.0 release by @​DaleSeo in #​1073
• fix: remove server_info from DiscoverResult by @​howardjohn in #​1065
• chore: release v3.0.0-beta.5 by @​github-actions[bot] in #​1070
• fix: recognize 2026-07-28 MCP methods by @​DaleSeo in #​1076
• chore: release v3.0.0 by @​github-actions[bot] in #​1077

New Contributors

• @​branben made their first contribution in #​895
• @​stevenlee-oai made their first contribution in #​963
• @​N0zoM1z0 made their first contribution in #​1026
• @​gocamille made their first contribution in #​1029
• @​tsarlandie-oai made their first contribution in #​1044
• @​fkonecny made their first contribution in #​962

Full Changelog: modelcontextprotocol/rust-sdk@rmcp-v2.2.0...rmcp-v3.0.0

v2.2.0

Compare Source

Added

• reject auth servers lacking S256 PKCE support (#​955)

Fixed

• pass client conformance suite (#​960)
• don't respond to cancelled requests (#​957)
• fail orphaned streamable HTTP responses on reinit (#​914)
• address 2025-11-25 conformance audit findings (#​951)

v2.1.0

Compare Source

Added

• add SEP-414 trace context meta accessors (#​910)
• add SEP-2575 meta helpers (#​942)

Fixed

• (transport) make AsyncRwTransport::receive cancel-safe (#​941) (#​947)
• (auth) preserve refresh_token when refresh response omits it (#​949)
• block redirect header leaks (#​936)
• don't respond to unparsable messages (#​940)
• negotiate protocol version in handler (#​930)

v2.0.0

Compare Source

Migration guide: https://redirect.github.com/modelcontextprotocol/rust-sdk/discussions/926

Added

• [breaking] (rmcp) add Audio variant to PromptMessageContent (#​865)
• [breaking] align model types with MCP 2025-11-25 spec (#​927)
• deprecate roots/sampling/logging types (#​923)

Fixed

• prevent OAuth resource spoofing (#​937)
• block oauth metadata ssrf (#​935)
• prevent streamable HTTP session leak (#​934)
• fill missing fully qualified syntax in prompt_handler macros (#​866)

Other

• consolidate repeated rmcp tests (#​931)
• align README examples with v2 model API (#​928)