v0.25.0

Added

• Support SEP-990 Cross-App Access via ID-JAG and the jwt-bearer grant (#454)
• Support client-side sampling via MCP::Client#on_sampling (#458)

Fixed

• Reject notifications carrying an unknown or expired session (#455)
• Handle an initialize request sent without an ID (#456)
• Bound client-side message buffering in the HTTP transport (#459)
• Lowercase response header names in StreamableHTTPTransport (#460)

v0.24.0

Added

• Support SSE reconnection per SEP-1699 in the HTTP client transport (#426)
• Validate the RFC 9207 iss authorization response parameter per SEP-2468 (#431)
• Support private_key_jwt client authentication for the client_credentials grant (#432)
• Recognize multi round-trip input_required results per SEP-2322 (#433)
• Add opt-in ttlMs / cacheScope cache hints to List and Read results per SEP-2549 (#436)
• Add server/discover and stateless lifecycle error codes per SEP-2575 (#438)
• Associate server-to-client requests with the originating client request per SEP-2260 (#440)
• Add server-side MCP Apps helpers per SEP-1865 (#441)
• Support client-side elicitation with SEP-1034 schema defaults (#443)
• Support class-based Resource and ResourceTemplate definitions (#447)

Changed

• Bind stored client credentials to the authorization server issuer per SEP-2352 (#439)

Fixed

• Handle non-object JSON-RPC messages without raising (#448)
• Perform SSE stream writes outside the session mutex (#449)
• Validate required params for initialize and resources/subscribe (#451)

v0.23.0

Added

• Add a session-ownership hook to StreamableHTTPTransport

Changed

• Require calling MCP::Client#connect before sending requests on stdio transport (#427)

Deprecated

• Annotate Roots, Sampling, and Logging APIs as deprecated per SEP-2577 (#429)

Fixed

• Fix an incorrect result: null response to an id-bearing notification message (#435)
• Validate Host and Origin headers to prevent DNS rebinding per MCP 2025-11-25
• Bound stateful session retention to prevent an initialize-flood DoS
• Bound stdio frame reads with max_line_bytes
• Bound request body and frame reads to prevent memory-exhaustion DoS

v0.22.0

Added

• Add audience role validation for MCP::Annotations per MCP specification (#422)
• Send SEP-2243 Mcp-Method and Mcp-Name headers per MCP specification (#423)
• Support client-side notifications/cancelled per MCP specification (#425)

Changed

• Conform Tool Schemas to JSON Schema 2020-12 per SEP-2106 (#417)

Fixed

• Fix a SyntaxError on Ruby 2.7.0 caused by arguments forwarding syntax (#419)

v0.21.0

Added

• Support capability extensions per SEP-2133 (#405)
• Add range validation for MCP::Annotations#priority per MCP specification (#410)
• Isolate stateless requests in ephemeral sessions per SEP-2567 (#415)

Changed

• Set OIDC application_type on Dynamic Client Registration per SEP-837 (#408)
• Fall back to legacy 2025-03-26 OAuth discovery for servers without PRM (#414)

v0.20.0

Added

• Support W3C Trace Context Propagation via _meta per SEP-414 (#397)
• Support OAuth client_credentials grant in OAuth client (#399)
• Add annotations field to MCP::Resource and MCP::ResourceTemplate per MCP specification (#403)

Changed

• Re-run OAuth flow on 403 insufficient_scope (step-up) (#368)
• Speed up Tool::Schema validation by 5x to 100x (#369)
• Use JSON-RPC error envelope for StreamableHTTPTransport errors (#371)
• Pin RFC 8414 default well-known suffix per SEP-2351 (#395)
• Default missing MCP-Protocol-Version to 2025-03-26 in StreamableHTTPTransport (#392)

Fixed

• Preserve the request ID in invalid request error responses (#400)
• Standardize Resource Not Found errors on -32602 with URI data per SEP-2164 (#402)

v0.19.0

Added

• Support Client ID Metadata Documents in OAuth client (#361)
• Request offline_access scope when supported (#365)
• Add size field to MCP::Resource per MCP specification (#393)

v0.18.0

Added

• Support server-to-client ping per MCP specification (#358)

Changed

• Warn on implicit stdio initialization (#338)
• Cache Tool::Schema validation to avoid re-validating identical schemas (#363)

Fixed

• Fix case-sensitive Accept header comparison (#359)

v0.17.0

Added

• Add OAuth 2.1 client support for MCP authorization flow (#353)

Fixed

• Validate MCP-Protocol-Version header in StreamableHTTPTransport (#347)
• Reject duplicate initialize requests (#350)
• Reject non-Hash JSON-RPC bodies in StreamableHTTPTransport (#354)

v0.16.0

Added

• Add opt-in tool output validation (#344)

Changed

• Advertise JSON Schema 2020-12 dialect on emitted tool schemas (#342)

Fixed

• Preserve client tool output schemas (#343)
• Fix missing output_schema argument in define_tool API (#301)