v1.2.0

What's Changed

The server verifies every echoed requestState itself once given a RequestStateSigner, binding each state to its caller, method, target and arguments, and expiring it after ten minutes. The HTTP endpoint keeps checking the valid Mcp-Param-* headers of a tool that also declares an invalid one.

Added

• ServerBuilder::setRequestStateSigner(): the server verifies every echoed requestState before its handler runs, answering -32602 for one it did not mint, and hands the handler the verified payload as $context->requestStatePayload and a bound signer as $context->requestStateSigner.
• RequestStateSigner binds a state to the authenticated subject, the method, its target and a digest of its arguments by default, and bindBy() replaces that policy.

Fixed

• The HTTP endpoint checks the Mcp-Param-* headers of a tool whose only invalid x-mcp-header is a number-typed one, where it used to skip every header of that tool.

Changed

• A RequestStateSigner state expires, after ten minutes by default (ttlSeconds). The wire format carries the expiry, so a state minted before this release no longer verifies.

Full Changelog: v1.1.0...v1.2.0