feat: implement MCP 2026-07-28 stateless protocol, task management, CIMD/OAuth 2.1 hardening, and MRTR support - #20

Merged

manish-wekan merged 59 commits into

nitrocloudofficial:statelessfrom

pallavt93:feature/stateless_2.0

Sep 9, 2026

Commits on Sep 4, 2026

feat: add MCP 2.0 (2026-07-28) foundation and stateless HTTP transport
pallavt93
committed
d7d1496
eat: add MCP 2.0 stateless HTTP ingress pipeline and discovery
pallavt93
committed
40e6195
feat: add MCP 2.0 JSON-RPC wire protocol and error codes
pallavt93
committed
6dc4dc4
feat: add MCP 2.0 tool/resource/prompt wire contracts
pallavt93
committed
5984f7b
feat: implement MCP 2.0 tasks protocol lifecycle and negotiation
pallavt93
committed
9e962f2
feat: add pluggable TaskStore with terminal-only TTL eviction
pallavt93
committed
be4cf8a
feat: add task authorization and multi-tenant isolation
pallavt93
committed
30dea68
feat: add CIMD resolver with SSRF defenses and RFC 9207 iss validation
pallavt93
committed
2bd87c4
feat: add MCP 2.0 extensions map, cache hints, and trace context propagation
pallavt93
committed
79b0dd5
feat: add MCP 2.0 blueprint conformance registry and verification tests
pallavt93
committed
58778c6

Commits on Sep 5, 2026

Commits on Sep 7, 2026

reference clean merge
pallavt93
committed
0a804fe
added security deps fix
pallavt93
committed
f5adf8a
added sync env
pallavt93
committed
1b6d9f3

Commits on Sep 8, 2026

Merge upstream/develop into feature/stateless_2.0
pallavt93
committed
a5ea77e
feat: default MCP protocol era to auto without forcing stateless HTTP
pallavt93
committed
9700d46
feat: thread protocol era through HTTP instead of a stateless boolean
pallavt93
committed
6b052a1
feat: serve 2025 and 2026 clients on one sessionless /mcp
pallavt93
committed
d8c639e
feat: reject 2025 wire when protocol era is modern
pallavt93
committed
e270bb0
feat: fall back to ServerConfig protocol era when env is unset
pallavt93
committed
af58ba1
feat: accept TypeScript protocol era aliases
pallavt93
committed
cb66e92
feat: select the HTTP engine from the protocol era
pallavt93
committed
1659811
feat: advertise the resolved protocol era on /mcp/health
pallavt93
committed
309f91e
feat: serve server/discover from the HTTP engine
pallavt93
committed
65ba22c
feat: answer sessionless initialize on the auto-era engine
pallavt93
committed
73a339e
feat: map request envelope onto execution context without unsigned
pallavt93
committed
a9be2f6
feat: resolve handler identity from verified JWT before envelope claims
pallavt93
committed
ad30215
feat: reject incoming Mcp-Session-Id on sessionless MCP engines
pallavt93
committed
15daa12
feat: drop incoming Mcp-Session-Id before the sessionless HTTP engine
pallavt93
committed
8972304
feat: require Mcp-Name on tools/call and reject header mismatches
pallavt93
committed
844deb8
feat: require Mcp-Method on modern JSON-RPC POST and tools/call
pallavt93
committed
ea6b595
feat: reject protocol version header when it disagrees with the envelope
pallavt93
committed
41e3b6c
feat: return -32022 for an unsupported MCP protocol version
pallavt93
committed
83faf59
eat: keep MCP-Protocol-Version through HeaderCompat middleware
pallavt93
committed
d58d1f7
feat: mirror Mcp-Param headers into missing tool arguments
pallavt93
committed
8eb47fc
feat: echo protocol version and method on MCP responses
pallavt93
committed
c07d931
feat: allow 2026 MCP headers on CORS preflight
pallavt93
committed
cc1f65a
fix: keep OPTIONS 204 scoped to /mcp when CORS is on
pallavt93
committed
e69a4fe
feat: expose MCP echo headers on CORS responses
pallavt93
committed
61a1272
ix: default HTTP bind host to 127.0.0.1
pallavt93
committed
02233b6
feat: honor forwarded host only from trusted proxies
pallavt93
committed
da7a003
feat: answer header-only Mcp-Method ping without a JSON-RPC body
pallavt93
committed
157e4c2
feat: apply SEP-2243 header rules from one method contract table
pallavt93
committed
e40e6bc
feat: pin validated MCP headers on replay and drop session ids
pallavt93
committed
d823151
feat: answer 2025 initialize on auto without a session
pallavt93
committed
e34c9c4
feat: reject 2025 initialize on modern without a session
pallavt93
committed
74519b5
feat: mount sessionful HTTP only for the legacy era
pallavt93
committed
880f66f
feat: serve /mcp with official mcp 2.x
pallavt93
committed
a3487f4
feat: serve /mcp with official mcp 2.x
pallavt93
committed
a4061d5
feat: reject non-2020-12 schemas at tool registration
pallavt93
committed
65a7d5d
feat: mount /subscriptions/listen on the official v2 bus
pallavt93
committed
dadd0f9
feat: isolate concurrent JSON-RPC calls that reuse the same id
pallavt93
committed
c1774c8
feat: apply deprecated-method policy on every modern route
pallavt93
committed
0a7a4bd
feat: default unset protocol era to auto
pallavt93
committed
e404f17
feat: strip envelope keys from tool arguments
pallavt93
committed
488839d
feat: serve modern and auto stdio on official mcp 2.x
pallavt93
committed
12b12f8

Commits on Sep 9, 2026

feat: fan out task status to listen, SSE, and stdio
pallavt93
committed
5ea3834
fixed mcp-method-id strict checks issue
pallavt93
committed
8934ca2