Skip to content

Commit 2fd159a

Browse files
tzolovKehrlann
authored andcommitted
Prepare SDK Tier 2 assessment submission
- Add CHANGELOG.md with release lines and history - Refresh ROADMAP.md: 2.x stable line, 3.0.x for 2026-07-28 spec (first milestones Sep 2026), Tier 2 commitment, 1.x/0.x security-patches-only - Refresh VALIDATION_RESULTS.md: 2026-08-17 run on conformance suite 0.2.0-alpha.11 (server 73/73, auth 193/193, client 3/4 w/ sse-retry baselined) - Bump conformance CI action pins v0.1.11 -> v0.1.16 - Update docs with missing features Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>
1 parent 8ee8ccb commit 2fd159a

7 files changed

Lines changed: 432 additions & 105 deletions

File tree

.github/workflows/conformance.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
timeout 30 bash -c 'until curl -s http://localhost:8080/mcp > /dev/null 2>&1; do sleep 0.5; done'
2828
2929
- name: Run conformance tests
30-
uses: modelcontextprotocol/conformance@v0.1.11
30+
uses: modelcontextprotocol/conformance@v0.1.16
3131
with:
3232
mode: server
3333
url: http://localhost:8080/mcp
@@ -54,7 +54,7 @@ jobs:
5454
run: mvn clean install -DskipTests
5555

5656
- name: Run conformance test
57-
uses: modelcontextprotocol/conformance@v0.1.11
57+
uses: modelcontextprotocol/conformance@v0.1.16
5858
with:
5959
mode: client
6060
command: 'java -jar conformance-tests/client-jdk-http-client/target/client-jdk-http-client-*-SNAPSHOT.jar'

CHANGELOG.md

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Changelog
2+
3+
All notable changes to the MCP Java SDK are documented in the
4+
[GitHub Releases](https://github.com/modelcontextprotocol/java-sdk/releases),
5+
which serve as the canonical, detailed changelog for every version. This file
6+
summarizes the release history and the currently maintained release lines.
7+
8+
Versioning follows [Semantic Versioning](https://semver.org/); see
9+
[VERSIONING.md](VERSIONING.md) for the breaking-change policy and
10+
[SECURITY.md](SECURITY.md) for the supported-versions security policy.
11+
12+
## Release lines
13+
14+
| Line | Latest | Spec revision | Status |
15+
|------|--------|---------------|--------|
16+
| 2.x | [2.0.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0) (2026-06-11) | 2025-11-25 | Active development |
17+
| 1.1.x | [1.1.3](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.3) (2026-05-21) | 2025-06-18 | Security patches only |
18+
| 1.0.x | [1.0.2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.2) (2026-05-21) | 2025-06-18 | Security patches only |
19+
| 0.18.x | [0.18.3](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.3) (2026-06-09) | 2025-06-18 | Security patches only |
20+
21+
## 2.0.0 — 2026-06-11
22+
23+
First major release since 1.x, tracking the **2025-11-25** MCP specification.
24+
Upgrading from 1.x? See the [v2 migration guide](MIGRATION-2.0.md).
25+
26+
- New JSON compatibility foundation for forward/backward wire compatibility,
27+
with pluggable Jackson 2 / Jackson 3 serialization modules
28+
- Spec-accurate schema: enforced required fields, lenient wire deserialization
29+
- End-to-end validation of tool inputs and embedded JSON Schema documents
30+
(JSON Schema 2020-12, SEP-1613)
31+
- Richer elicitation: client-side schema defaults (SEP-1034), URL elicitation
32+
(SEP-1036), form-based elicitation schemas
33+
- Icons and metadata support (SEP-973)
34+
- Streamable HTTP first: SSE transports deprecated in favor of Streamable HTTP
35+
- Module restructuring: `mcp-core`, `mcp-json-jackson2`, `mcp-json-jackson3`,
36+
`mcp-bom`
37+
38+
Full notes: [v2.0.0 release](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0)
39+
(preceded by milestones [M1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-M1),
40+
[M2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-M2),
41+
[M3](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-M3),
42+
[RC1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0-RC1)).
43+
44+
## 1.x
45+
46+
- [1.1.3](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.3) /
47+
[1.0.2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.2) — 2026-05-21:
48+
SSE client transport message-endpoint validation (backports)
49+
- [1.1.2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.2) — 2026-04-25
50+
- [1.1.1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.1) /
51+
[1.0.1](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.1) — 2026-03-27
52+
- [1.1.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.1.0) — 2026-03-13
53+
- [1.0.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.0) — 2026-02-23:
54+
first stable release; see the [1.0 migration guide](MIGRATION-1.0.md)
55+
56+
## 0.x
57+
58+
- [0.18.3](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.3) — 2026-06-09:
59+
security fix for GHSA-hv2w-8mjj-jw22
60+
- [0.18.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.0)
61+
[0.18.2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.18.2) — 2026-02 to 2026-05
62+
- [0.8.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.8.0)
63+
[0.17.2](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v0.17.2) — 2025-03 to 2026-01:
64+
see the [full release list](https://github.com/modelcontextprotocol/java-sdk/releases)

ROADMAP.md

Lines changed: 17 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -6,40 +6,35 @@ The SDK tracks implementation of MCP spec components via GitHub Projects, with a
66

77
## Current Focus Areas
88

9-
### 2025-11-25 Spec Implementation
9+
### 2.x — Stable Line (2025-11-25 spec)
1010

11-
The Java SDK is actively implementing the [2025-11-25 MCP specification revision](https://github.com/orgs/modelcontextprotocol/projects/26/views/1).
11+
The current stable release line is **2.x** ([2.0.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v2.0.0), June 2026), implementing the [2025-11-25 MCP specification revision](https://modelcontextprotocol.io/specification/2025-11-25), including:
1212

13-
Key features in this revision include:
13+
- **Spec-accurate schema**: enforced required fields with lenient wire deserialization, and a JSON compatibility foundation for forward/backward wire compatibility
14+
- **Enhanced schemas**: JSON Schema 2020-12 validation of tool inputs and embedded schema documents (SEP-1613)
15+
- **Richer elicitation**: client-side schema defaults (SEP-1034), URL mode elicitation (SEP-1036), form-based elicitation schemas
16+
- **Icons metadata** (SEP-973): icons for tools, resources, resource templates, and prompts
17+
- **Streamable HTTP first**: SSE transports deprecated in favor of Streamable HTTP
18+
- **Pluggable JSON serialization**: Jackson 2 and Jackson 3 modules
1419

15-
- **Tasks**: Experimental support for tracking durable requests with polling and deferred result retrieval
16-
- **Tool calling in sampling**: Support for `tools` and `toolChoice` parameters
17-
- **URL mode elicitation**: Client-side URL elicitation requests
18-
- **Icons metadata**: Servers can expose icons for tools, resources, resource templates, and prompts
19-
- **Enhanced schemas**: JSON Schema 2020-12 as default, improved enum support, default values for elicitation
20-
- **Security improvements**: Updated security best practices, enhanced authorization flows, enabling OAuth integrations
20+
2.x development continues with patch and minor releases for bug fixes, conformance improvements, and non-breaking features. See [CHANGELOG.md](CHANGELOG.md) for the release history.
2121

22-
See the full [changelog](https://modelcontextprotocol.io/specification/2025-11-25/changelog) for details.
22+
The earlier **1.x and 0.x release lines receive security patches only** — no feature or bug-fix backports. Users on those lines are encouraged to upgrade via the [v2 migration guide](MIGRATION-2.0.md).
2323

24-
### Tier 1 SDK Support
24+
### 3.x — 2026-07-28 Spec Support
2525

26-
Once we catch up on the most recent MCP specification revision we aim to fully support all the upcoming specification features on the day of its release.
26+
The next major version, **3.x**, will implement the [2026-07-28 MCP specification revision](https://modelcontextprotocol.io/specification/2026-07-28), including `server/discover` and the SEP-2575 stateless lifecycle. The first 3.0.0 milestone releases are planned for **September 2026**, tracked via a dedicated spec revision project board.
2727

28-
### v1.x Development
28+
### SDK Tiering
2929

30-
The Java SDK is currently in active development as v1.x, following a recent stable 1.0.0 release. The SDK provides:
30+
The Java SDK is an official [Tier 2 SDK](https://modelcontextprotocol.io/community/sdk-tiers) committed to full protocol support: new spec revisions are implemented within the Tier 2 six-month window, with conformance continuously verified against the [MCP conformance suite](https://github.com/modelcontextprotocol/conformance) in CI. Once caught up on the most recent specification revision, we aim for Tier 1: fully supporting new specification features on the day of their release.
3131

32-
- MCP protocol implementation
33-
- Synchronous and asynchronous programming models
34-
- Multiple transport options (STDIO, HTTP/SSE, Servlet)
35-
- Pluggable JSON serialization (Jackson 2 and Jackson 3)
36-
37-
Development is tracked via [GitHub Issues](https://github.com/modelcontextprotocol/java-sdk/issues) and [GitHub Projects](https://github.com/orgs/modelcontextprotocol/projects).
38-
39-
### Future Versions
32+
### Future Directions
4033

4134
Major version updates will align with MCP specification changes and breaking API changes as needed. The SDK is designed to evolve with the Java ecosystem, including:
4235

4336
- Virtual Threads and Structured Concurrency support
4437
- Additional transport implementations
4538
- Performance optimizations
39+
40+
Development is tracked via [GitHub Issues](https://github.com/modelcontextprotocol/java-sdk/issues) and [GitHub Projects](https://github.com/orgs/modelcontextprotocol/projects).

conformance-tests/VALIDATION_RESULTS.md

Lines changed: 63 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -1,127 +1,110 @@
11
# MCP Java SDK Conformance Test Validation Results
22

3+
Last validated: **2026-08-17** against conformance suite
4+
**`@modelcontextprotocol/conformance@0.2.0-alpha.11`** (SDK at `main`, 2.0.1-SNAPSHOT), targetting
5+
version 2025-11-25 (`--spec-version 2025-11-25`).
6+
37
## Summary
48

5-
**Server Tests (active suite):** 44/44 passed (31 scenarios, 100%)
6-
**Server Tests (spec 2025-11-25):** 4/4 passed — SEP-1613 `json-schema-2020-12` scenario ✨
7-
**Client Tests:** 3/4 scenarios passed (9/10 checks passed)
8-
**Auth Tests:** 15/15 scenarios fully passing (195 passed, 0 failed, 0 warnings, 100% scenarios, 100% checks)
9+
**Server Tests (active suite):** 73/73 checks passed (31 scenarios, 100%)
10+
**Server Tests (SEP-1613 `json-schema-2020-12`):** 5/5 checks passed (SEP-2106 checks skipped — post-2025-11-25 spec additions)
11+
**Client Tests:** 3/4 scenarios passed; `sse-retry` fails (tracked in `conformance-baseline.yml`)
12+
**Auth Tests:** 14/14 scenarios passing (193 checks, 0 failed, 0 warnings)
13+
14+
Baseline check passed on every run: all failures are expected per
15+
[`conformance-baseline.yml`](conformance-baseline.yml).
916

1017
## Server Test Results
1118

12-
### Active Suite — Passing (31/31 scenarios, 44/44 checks)
19+
### Active Suite — Passing (31/31 scenarios, 73/73 checks)
1320

14-
- **Lifecycle & Utilities (4/4):** initialize, ping, logging-set-level, completion-complete
15-
- **Tools (13/13):** All scenarios including progress notifications, sampling, elicitation
16-
- **Elicitation (10/10):** SEP-1034 defaults (5 checks), SEP-1330 enums (5 checks)
17-
- **Resources (7/7):** list, read-text, read-binary, templates-read, subscribe, unsubscribe, SEP-2164 resource-not-found
18-
- **Prompts (5/5):** list, simple, with-args, embedded-resource, with-image
19-
- **SSE Transport (2/2):** Multiple streams
20-
- **Security (2/2):** Localhost validation passes, DNS rebinding protection
21+
- **Lifecycle & Utilities:** initialize, ping, logging-set-level, completion-complete
22+
- **Tools (13/13):** all scenarios including progress notifications, sampling, elicitation
23+
- **Elicitation:** SEP-1034 defaults (6 checks), SEP-1330 enums (6 checks)
24+
- **Resources:** list, read-text, read-binary, templates-read, subscribe, unsubscribe
25+
- **Prompts:** list, simple, with-args, embedded-resource, with-image
26+
- **SSE Transport:** multiple streams
27+
- **Security:** DNS rebinding protection
2128

22-
### Spec 2025-11-25 Scenarios — Passing (1/1 scenario, 4/4 checks)
29+
### SEP-1613 — JSON Schema 2020-12 (5/5 checks)
2330

24-
- **JSON Schema 2020-12 (SEP-1613) (4/4):**
25-
- `json_schema_2020_12_tool` found
26-
- `inputSchema.$schema` field preserved
27-
- `inputSchema.$defs` field preserved
28-
- `inputSchema.additionalProperties` field preserved
31+
- `json_schema_2020_12_tool` found; `$schema`, `$defs`, and `additionalProperties`
32+
fields preserved; every JSON-RPC message valid per the spec JSON schema for the
33+
negotiated spec version (`wire-schema-valid`)
34+
- SEP-2106 checks (composition/conditional/anchor keywords) reported SKIPPED:
35+
they postdate the 2025-11-25 spec release and are excluded from scoring
2936

3037
## Client Test Results
3138

32-
### Passing (3/4 scenarios, 9/10 checks)
33-
34-
- **initialize (1/1):** Protocol negotiation, clientInfo, capabilities
35-
- **tools_call (1/1):** Tool discovery and invocation
36-
- **elicitation-sep1034-client-defaults (5/5):** Default values for string, integer, number, enum, boolean
39+
### Passing (3/4 scenarios)
3740

38-
### Partially Passing (1/4 scenarios, 1/2 checks)
41+
- **initialize (1/1):** protocol negotiation, clientInfo, capabilities
42+
- **tools_call (2/2):** tool discovery and invocation
43+
- **elicitation-sep1034-client-defaults (5/5):** default values for string, integer, number, enum, boolean
3944

40-
- **sse-retry (1/2 + 1 warning):**
41-
- ✅ Reconnects after stream closure
42-
- ❌ Does not respect retry timing
43-
- ⚠️ Does not send Last-Event-ID header (SHOULD requirement)
45+
### Failing — in baseline (1/4 scenarios)
4446

45-
**Issue:** Client treats `retry:` SSE field as invalid instead of parsing it for reconnection timing.
47+
- **sse-retry:** client does not parse/respect the `retry:` SSE field timing and
48+
does not send the `Last-Event-ID` header (SHOULD requirement). Expected failure,
49+
listed in `conformance-baseline.yml`.
4650

4751
## Auth Test Results (Spring HTTP Client)
4852

49-
**Status: 195 passed, 0 failed, 0 warnings across 15 scenarios**
53+
**Status: 193 checks passed, 0 failed, 0 warnings across 14 scenarios**
5054

51-
Uses the `client-spring-http-client` module with Spring Security OAuth2 and the [mcp-client-security](https://github.com/springaicommunity/mcp-client-security) library.
55+
Uses the `client-spring-http-client` module with Spring Security OAuth2 and the
56+
[mcp-client-security](https://github.com/springaicommunity/mcp-client-security) library.
5257

53-
### Fully Passing (15/15 scenarios)
58+
Fully passing: metadata-default, metadata-var1/2/3, basic-cimd,
59+
scope-from-www-authenticate, scope-from-scopes-supported, scope-omitted-when-undefined,
60+
scope-step-up, scope-retry-limit, token-endpoint-auth-basic/post/none, pre-registration.
5461

55-
- **auth/metadata-default (13/13):** Default metadata discovery
56-
- **auth/metadata-var1 (13/13):** Metadata discovery variant 1
57-
- **auth/metadata-var2 (13/13):** Metadata discovery variant 2
58-
- **auth/metadata-var3 (13/13):** Metadata discovery variant 3
59-
- **auth/basic-cimd (12/12):** Basic Client-Initiated Metadata Discovery
60-
- **auth/scope-from-www-authenticate (14/14):** Scope extraction from WWW-Authenticate header
61-
- **auth/scope-from-scopes-supported (14/14):** Scope extraction from scopes_supported
62-
- **auth/scope-omitted-when-undefined (14/14):** Scope omitted when not defined
63-
- **auth/scope-step-up (16/16):** Scope step-up challenge
64-
- **auth/scope-retry-limit (11/11):** Scope retry limit handling
65-
- **auth/token-endpoint-auth-basic (18/18):** Token endpoint with HTTP Basic auth
66-
- **auth/token-endpoint-auth-post (18/18):** Token endpoint with POST body auth
67-
- **auth/token-endpoint-auth-none (18/18):** Token endpoint with no client auth
68-
- **auth/resource-mismatch (2/2):** Resource mismatch handling
69-
- **auth/pre-registration (6/6):** Pre-registered client credentials flow
62+
Note: `auth/resource-mismatch` (present in earlier suite versions) is no longer part
63+
of the 0.2.0-alpha auth suite.
7064

7165
## Known Limitations
7266

73-
1. **Client SSE Retry:** Client doesn't parse or respect the `retry:` field, reconnects immediately, and doesn't send Last-Event-ID header
67+
1. **Client SSE Retry:** client doesn't parse or respect the `retry:` field,
68+
reconnects immediately, and doesn't send the `Last-Event-ID` header
7469

7570
## Running Tests
7671

7772
### Server (active suite)
7873
```bash
79-
# Start server
80-
./mvnw compile -pl conformance-tests/server-servlet -am exec:java
81-
82-
# Run tests (in another terminal)
83-
npx @modelcontextprotocol/conformance server --url http://localhost:8080/mcp --suite active
74+
# Build and start server
75+
./mvnw clean install -DskipTests
76+
mvn exec:java -pl conformance-tests/server-servlet \
77+
-Dexec.mainClass="io.modelcontextprotocol.conformance.server.ConformanceServlet"
78+
79+
# Run tests (in another terminal, from the repo root)
80+
npx @modelcontextprotocol/conformance@0.2.0-alpha.11 server \
81+
--url http://localhost:8080/mcp --suite active \
82+
--expected-failures ./conformance-tests/conformance-baseline.yml
8483
```
8584

86-
### Server (spec 2025-11-25 scenarios — SEP-1613)
85+
### Server (SEP-1613 scenario)
8786
```bash
88-
# Start server (if not already running)
89-
./mvnw compile -pl conformance-tests/server-servlet -am exec:java
90-
91-
# Run json-schema-2020-12 scenario
92-
cd ../conformance && node --import tsx/esm src/index.ts server \
93-
--url http://localhost:8080/mcp \
94-
--scenario json-schema-2020-12
87+
npx @modelcontextprotocol/conformance@0.2.0-alpha.11 server \
88+
--url http://localhost:8080/mcp --scenario json-schema-2020-12
9589
```
9690

9791
### Client
9892
```bash
99-
# Build
100-
cd conformance-tests/client-jdk-http-client
101-
../../mvnw clean package -DskipTests
102-
103-
# Run all scenarios
10493
for scenario in initialize tools_call elicitation-sep1034-client-defaults sse-retry; do
105-
npx @modelcontextprotocol/conformance client \
106-
--command "java -jar target/client-jdk-http-client-1.1.0-SNAPSHOT.jar" \
107-
--scenario $scenario
94+
npx @modelcontextprotocol/conformance@0.2.0-alpha.11 client \
95+
--command "java -jar conformance-tests/client-jdk-http-client/target/client-jdk-http-client-*.jar" \
96+
--scenario $scenario \
97+
--expected-failures ./conformance-tests/conformance-baseline.yml
10898
done
10999
```
110100

111101
### Auth (Spring HTTP Client)
112-
113-
Ensure you run with the conformance testing suite `0.1.15` or higher.
114-
115102
```bash
116-
# Build
117-
cd conformance-tests/client-spring-http-client
118-
../../mvnw clean package -DskipTests
119-
120-
# Run auth suite
121-
npx @modelcontextprotocol/conformance@0.1.15 client \
103+
npx @modelcontextprotocol/conformance@0.2.0-alpha.11 client \
122104
--spec-version 2025-11-25 \
123-
--command "java -jar target/client-spring-http-client-1.1.0-SNAPSHOT.jar" \
124-
--suite auth
105+
--command "java -jar conformance-tests/client-spring-http-client/target/client-spring-http-client-*.jar" \
106+
--suite auth \
107+
--expected-failures ./conformance-tests/conformance-baseline.yml
125108
```
126109

127110
## Recommendations

conformance-tests/conformance-baseline.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,6 @@ client:
77
# - Client does not parse or respect retry: field timing
88
# - Client does not send Last-Event-ID header
99
- sse-retry
10+
# Not supporting versions > 1 year old
11+
- auth/2025-03-26-oauth-metadata-backcompat
12+
- auth/2025-03-26-oauth-endpoint-fallback

0 commit comments

Comments
 (0)