fix(deps): update dependency io.modelcontextprotocol:kotlin-sdk to v0.15.0 by renovate[bot] · Pull Request #19 · ptitjes/konvo

renovate · 2026-04-03T13:27:54Z

This PR contains the following updates:

Package	Change	Age	Confidence
io.modelcontextprotocol:kotlin-sdk	`0.11.0` → `0.15.0`

Release Notes

modelcontextprotocol/kotlin-sdk (io.modelcontextprotocol:kotlin-sdk)

`v0.15.0`

Compare Source

Description

This release makes inbound message handling concurrent after the initialization handshake, adds SSE heartbeats and elicitation schema validation, and fixes several Streamable HTTP response and session-lifecycle bugs.

Breaking Changes

Concurrent inbound dispatch by @devcrocod in #884

Inbound messages were processed serially on the transport read loop, so one slow or peer-awaiting handler (sampling, elicitation, roots) blocked every later message on the connection, including the responses and notifications/cancelled those handlers depend on. After the handshake, handlers may now run concurrently; processing stays serial during initialization.

ProtocolOptions / ClientOptions / ServerOptions gain a handlerCoroutineContext parameter (defaults to Dispatchers.Default). Concurrency is bounded internally; there is no opt-out flag by design.
RequestHandlerExtra is now a CoroutineContext.Element and is no longer user-constructible. It exposes requestId, method, sendRequest, and sendNotification, and can be read inside a handler via the new currentRequestHandlerExtra().

- val extra = RequestHandlerExtra()
+ val extra = currentRequestHandlerExtra()

Duplicate feature names are rejected at registration by @devcrocod in #883

addTool/addPrompt/addResource/addResourceTemplate silently replaced an existing entry and emitted a spurious list_changed notification. They now throw IllegalArgumentException and leave the existing registration intact. The batch variants (addTools/addPrompts/addResources) are all-or-nothing. To replace a feature, remove it first.

- server.addTool(name = "search", ...)  // silently overwrote
+ server.removeTool("search")
+ server.addTool(name = "search", ...)

eventStore removed from mcpStatelessStreamableHttp by @devcrocod in #909

The parameter was never read or written: a stateless endpoint answers GET with 405, so no stream exists to store or replay events on. The old overload is retained at DeprecationLevel.ERROR with a ReplaceWith migration hint. Use mcpStreamableHttp when you need resumability.

  application.mcpStatelessStreamableHttp(
      path = "/mcp",
-     eventStore = myEventStore,
  ) { server }

Features

Optional SSE heartbeats for Streamable HTTP servers via mcpStreamableHttp(sseHeartbeatConfig = { ... }), keeping long-lived streams alive against clients that disconnect on idle. Heartbeats stay off by default, by @UnscientificJsZhai in #761
Accepted form-mode elicitation content is now validated against requestedSchema; a mismatch fails createElicitation with McpException (INVALID_PARAMS) instead of reaching server code unchecked, by @rea9r in #896
The Streamable HTTP client now sends the standard Mcp-Method and Mcp-Name POST headers, by @AndreKalberer in #894

Fixed

Stateless Streamable HTTP now closes its per-request session, fixing unbounded growth of the session registry and notification subscriptions, by @KlyneChrysler in #872
Streamable HTTP responses keep their status and body when the client accepts only text/event-stream, by @devcrocod in #911
The Accept header is parsed as media ranges, so clients sending */* or application/* are matched correctly, by @devcrocod in #912
Malformed request params are reported as Invalid params (-32602) instead of Internal error, by @jstar0 in #886
Duplicate initialize errors preserve the JSON-RPC request id, by @jstar0 in #868
Connection teardown clears the recently-cancelled request id buffer, by @devcrocod in #892

Maintenance

Create the server session before connecting the client in tests, avoiding a ChannelTransport startup race, by @devcrocod in #885

Dependencies

Kotlin to v2.4.0 in #834
Ktor to v3.5.1 in #832
kotlinx-collections-immutable to v0.5.1 in #873
Netty BOM to v4.2.16.Final in #889
Kotest to v6.2.3 in #888, #915
logback-classic to v1.6.0 in #890, #897, #914
detekt-gradle-plugin to v2.0.0-alpha.5 in #849
Kover to v0.9.9 in #902
junit-jupiter to v6.1.2 in #897
Shadow plugin to v9.6.1 and anthropic-java to v2.52.0 in #882, #914
Sample projects updated to Kotlin 2.4.x, Ktor BOM 3.5.1, and mcp-kotlin 0.14.0 in #819, #822, #825, #827, #829, #859, #860, #861, #862, #863, #875, #876, #877, #878, #879, #899
Test harness and CI updates (TypeScript integration-test dependencies, actions/setup-node v7) in #880, #891, #898, #906, #907, #910

New Contributors

@UnscientificJsZhai made their first contribution in #761
@KlyneChrysler made their first contribution in #872
@AndreKalberer made their first contribution in #894

Full Changelog: modelcontextprotocol/kotlin-sdk@0.14.0...0.15.0

`v0.14.0`

Compare Source

Description

Adds wire-level support for SEP-1686 Tasks and SEP-1036 URL Mode Elicitation.

Breaking Changes

These changes are source-compatible (existing Kotlin code compiles unchanged thanks to default values) but binary-incompatible — recompile against 0.14.0, and update any Java or fully-positional call sites.

SseServerTransport constructor and the mcp { } Ktor server extensions gained a request-body-size limit by @devcrocod in #839

A new maxRequestBodySize parameter (default applied) was added, changing the binary signatures.

- SseServerTransport(endpoint, session)
+ SseServerTransport(endpoint, session, maxRequestBodySize = DEFAULT_MAX_REQUEST_BODY_SIZE)

StreamableHttpClientTransport constructor gained an inline SSE event-size limit by @devcrocod in #841

A new maxInlineSseEventSize parameter was inserted before requestBuilder. Trailing-lambda Kotlin calls are unaffected; positional callers must adjust.

CallToolRequestParams and CreateMessageRequestParams gained a task field by @devcrocod in #844

Added as part of SEP-1686 Tasks; the generated copy()/componentN() signatures shifted, so dependents must recompile.

Features

Add SEP-1686 Tasks wire-level types (TaskMetadata, task on tool-call and sampling params) by @devcrocod in #844
Add SEP-1036 URL Mode Elicitation, including UrlElicitationRequiredException, UrlElicitationRequiredData, and the Elicitation.supportsUrl capability flag by @devcrocod in #843

Fixed

Bound incoming HTTP POST body size in the SSE and Streamable HTTP server transports to prevent memory exhaustion from oversized requests by @devcrocod in #839
Bound the size of a single inline SSE event parsed from a POST response in StreamableHttpClientTransport by @devcrocod in #841
Validate Origin against localhost by default in DNS rebinding protection, rejecting requests with a valid Host but hostile or null Origin by @devcrocod in #840
Gate completion/complete on the server's completions capability instead of prompts by @rea9r in #846
Close stdio read sources during shutdown so StdioClientTransport.close() no longer hangs on a blocked read by @jstar0 in #798
Polish SEP-1577 sampling handling — reject empty sampling content and emit an explicit error when tool_use is not followed by tool_result by @MukundaKatta in #765

Dependencies

kotlinx-io-core to v0.9.1 in #855
kotlinx-collections-immutable to v0.5.0 in #833
Gradle wrapper to v9.6.1 in #851, #856
gradle-maven-publish-plugin to v0.37.0 in #848
actions/checkout to v7 in #852
Kotest group updates in #847
MockK to v1.14.11 in #792
Logback to v1.5.37 in #794, #857
Infrastructure group updates in #797
Sample and integration-test dependency bumps (mcp-kotlin/kotlin-sdk-client to 0.13.0, anthropic-java to 2.40.1, hono, esbuild, tsx, @types/node) in #795, #799, #818, #820, #821, #823, #824, #826, #828, #831, #837, #853, #854, #864, #865

New Contributors

@MukundaKatta made their first contribution in #765
@rea9r made their first contribution in #846
@jstar0 made their first contribution in #798

Full Changelog: modelcontextprotocol/kotlin-sdk@0.13.0...0.14.0

`v0.13.0`

Compare Source

Description

Adds a tasks capability and a typed elicitation capability, hardens transport lifecycle, dispatchers, and back-pressure, and enables DNS rebinding protection by default.

Breaking Changes

Typed elicitation capability and new tasks capability by @devcrocod in #732

ClientCapabilities.elicitation is now a typed ClientCapabilities.Elicitation (form, url) instead of a raw JsonObject?, and both ClientCapabilities and ServerCapabilities gained a typed tasks capability. The constructors of both types changed and are binary-incompatible; recompilation is required.

Transport handlers now run on Dispatchers.Default by @devcrocod in #778

Handlers moved from Dispatchers.IO to Dispatchers.Default (override via handlerDispatcher), send() now suspends under back-pressure instead of buffering unbounded, and the two-argument StdioServerTransport(input, output) constructor is deprecated in favor of the builder-lambda form. Also fixes a start()/close() race, consistent CancellationException propagation, and an input-Source leak (closes #573, #574, #708).

DNS rebinding protection enabled by default by @devcrocod in #659

enableDnsRebindingProtection now defaults to true on mcpStreamableHttp/mcpStatelessStreamableHttp, and the Route.mcp() / Application.mcp() overloads gained enableDnsRebindingProtection, allowedHosts, and allowedOrigins parameters (binary-incompatible on JVM). Only localhost, 127.0.0.1, and [::1] are allowed by default; opt out with enableDnsRebindingProtection = false. The Configuration.enableDnsRebindingProtection, .allowedHosts, and .allowedOrigins properties are deprecated in favor of the new DnsRebindingProtection plugin.

Features

Add a tasks capability (list, cancel, and per-request augmentation for sampling and elicitation) on ClientCapabilities and ServerCapabilities, with assertions for tasks/* and notifications/tasks/status enforced by Client and ServerSession by @devcrocod in #732
Configurable handlerDispatcher and ioDispatcher, plus an optional caller-supplied CoroutineScope, on transports by @devcrocod in #778

Fixed

Fire onClose callbacks on SseClientTransport when the SSE session ends — whether closed gracefully or terminated by an error — matching the other client transports by @jskjw157 in #738

Security

Enable DNS rebinding protection by default across all HTTP transports, including the SSE endpoints that previously had none (see Breaking Changes for migration) by @devcrocod in #659
Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new TooLongFrameException instead of buffering unbounded when a peer never sends a newline terminator by @devcrocod in 6e6f805

Maintenance

Remove the test-only dev.mokksy:mokksy dependency in favor of MockEngine and embeddedServer by @devcrocod in #754

Dependencies

Ktor to v3.4.3 in #785
kotlinx.coroutines to v1.11.0 in #760
kotlin-logging to v8.0.03 in #752, #783
24 further Dependabot updates across sample projects, TypeScript conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple, Gradle wrapper, anthropic-java)

Full Changelog: modelcontextprotocol/kotlin-sdk@0.12.0...0.13.0

`v0.12.0`

Compare Source

Description

Adds sampling-with-tools per SEP-1577, JSON Schema dialect declaration on tool schemas, server-side tool name validation, and capability extensions; fixes SSE reconnect on the same session and stops swallowing CancellationException.

Breaking Changes

Sampling messages can carry tool calls and results (SEP-1577) by @devcrocod in #718

SamplingMessage.content is now typed as a new SamplingMessageContent supertype, with MediaContent (text/image/audio), ToolUseContent, and ToolResultContent as variants. MediaContent still exists and now extends SamplingMessageContent, so most source code that constructs sampling messages compiles unchanged — but the binary signatures of SamplingMessage, CreateMessageResult, and related types have changed. ClientCapabilities.sampling is also now a typed Sampling object instead of a raw JsonObject. Recompilation is required; consumers reading sampling as JsonObject must migrate to the typed accessors.

watchosX64 and tvosX64 Kotlin/Native targets removed by @devcrocod in #727

These targets have been deprecated upstream. Migrate to the corresponding ARM/simulator targets (watchosArm64, watchosSimulatorArm64, tvosArm64, tvosSimulatorArm64).

Features

Add $schema field to ToolSchema, declaring JSON Schema 2020-12 as the default dialect (SEP-1613) by @devcrocod in #696
Validate tool names at registration time on the server, following the MCP tool naming standard (SEP-986) by @devcrocod in #695
Add extensions field to ClientCapabilities and ServerCapabilities for advertising supported MCP extensions during the initialize handshake by @eritscher in #678

Fixed

Validate the mcp-protocol-version HTTP header on initialization requests and correct DEFAULT_NEGOTIATED_PROTOCOL_VERSION to match the spec by @devcrocod in #697
Propagate CancellationException instead of logging it as an error by @devcrocod in #706
Evict stale GET SSE stream mapping on reconnect so a new GET on the same session is no longer silently rejected by the leftover entry from the previous stream by @amr in #716

Maintenance

Add kotlinlang MCP server sample with search and get_page tools by @devcrocod in #713
Migrate detekt to a buildSrc convention plugin with a fully explicit, version-locked YAML config by @devcrocod in #729
Add Streamable HTTP integration tests for pagination, bad-request handling, and logging by @jskjw157 in #613
Remove unused OpenAPI Generator plugin and configuration by @devcrocod in #683
Remove Codecov configuration in favor of kover by @devcrocod in #691
Remove redundant JUnit XML report configuration by @devcrocod in #728
Remove IDEA files tied to the incompatible detekt IDE plugin by @devcrocod in #714
Add Node.js setup to the release workflow so TypeScript integration tests run on macOS runners by @devcrocod in #684

Dependencies

Kotlin to v2.3.21 in #704, #723
kotlinx.serialization-json to v1.11.0 in #687

New Contributors

@eritscher made their first contribution in #678
@amr made their first contribution in #716

Full Changelog: modelcontextprotocol/kotlin-sdk@0.11.1...0.12.0

`v0.11.1`

Compare Source

Description

Fixes an SSE stream crash on Netty when clients connect to the Streamable HTTP GET endpoint.

Fixed

Fixed GET SSE stream crash on Netty in Streamable HTTP where appendSseHeaders() was called after response headers were already committed, causing UnsupportedOperationException and client retry loops by @devcrocod in #681

Dependencies

mcp-kotlin to v0.11.0 in #672, #673, #675, #676
Ktor BOM to v3.3.3 in #650, #653, #656
Kotest assertions to v6.1.11 in #674
anthropic-java to v2.19.0 in #671
@modelcontextprotocol/sdk to v1.29.0, @types/node update in #677
hono to v4.12.12 in #680
@hono/node-server to v1.19.13 in #679

Full Changelog: modelcontextprotocol/kotlin-sdk@0.11.0...0.11.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-04-03T13:31:48Z