Added
- route SEP-2260 associated server requests to the originating SSE stream (#1029)
- [breaking] add distributed SSE event store (#1024)
- add client-side TTL-honoring response cache (SEP-2549) (#1025)
- [breaking] Implement SEP-2663 Tasks Extension (#1020)
- add subscription listen streams (SEP-2575) (#1000)
- (auth) bind DCR client credentials to issuing authorization server (SEP-2352) (#998)
- add modern client lifecycle modes (SEP-2575) (#995)
- (auth) accumulate client-side scopes during step-up authorization (#888)
- [breaking] add server discovery and negotiation (SEP-2575) (#973)
- (conformance) add SEP-2243 header validation tool (#997)
- [breaking] align metadata models with draft schema (#993)
- [breaking] implement SEP-2549 cache hints (#889)
- [breaking] add MRTR behavior support (SEP-2322) (#929)
- [breaking] type Annotations.lastModified as a string (#956)
- [breaking] add SEP-2243 HTTP standard headers (#907)
- relax outputSchema to accept non-object JSON Schema types (SEP-2106) (#895)
- [breaking] relax tool result structuredContent type (SEP-2106) (#933)
- [breaking] add MRTR model types (SEP-2322) (#915)
Fixed
- reap completed response send tasks (#1026)
- accept stringified numeric response IDs (#1021)
- re-register after auth server change (#1011)
- .with_stateful_mode -> .with_legacy_session_mode (#1015)
- preserve negotiated progress responses (#1005)
- (server) serve draft-version requests statelessly per SEP-2567 (#999)
- pass client header conformance (#1012)
- (auth) add an SDK path for pre-registered OAuth clients (#994)
- (transport) cancel in-flight request on stateless streamable-HTTP client disconnect (#857) (#967)
- (auth) distinguish rejected refresh tokens from transient failures (#963)
- (auth) validate discovered metadata issuer (#996)
- bound streamable HTTP memory usage (#970)
- (streamable-http) preserve progress in JSON mode (#990)
- specify compatible sse-stream version (#968)
- flag schema derive on schemars feature (#966)
Other
- refactor OAuth client authorization api (#1009)
- update for 2026-07-28 version (#1032)
- (deps) update hmac requirement from 0.12 to 0.13 (#988)
- serialize JavaScript dependency install (#972)
Changed
- BREAKING: rename
StreamableHttpServerConfig::stateful_modetolegacy_session_mode(and the builderwith_stateful_modetowith_legacy_session_mode) to clarify that the option only affects legacy protocol versions (< 2026-07-28); per SEP-2567 the2026-07-28draft version is always served statelessly (#999)
Fixed
- use the authorization server issuer as the default
private_key_jwtaudience