3.1.2

New

• McpDtoTool<T>: a tool whose input is a @Dto class. The input schema comes from the DTO, so @Describe texts show up in tools/list. The arguments are checked like a DTO in a controller (async rules like @Unique too). handle gets the typed object.

  class CreateCategory extends McpDtoTool<NewCategory> {
    @override
    String get name => 'create_category';
  
    @override
    String get description => 'Add a category.';
  
    @override
    DtoSchema<NewCategory> get dto => $NewCategoryDto;
  
    @override
    Future<McpToolResult> handle(NewCategory input, McpContext context) async {
      // save input.name ...
      return McpToolResult.text('Created ${input.name}');
    }
  }

  Bad arguments come back as a tool result with isError: true that lists each problem, so the model can fix them and try again. They never become a JSON-RPC error.

• McpToolResult.invalidArguments(tool, issues), the error result for bad arguments.

Docs: https://dartondox.dev/latest/packages/mcp/

Fixes

• McpOAuth: a code_verifier with non-ASCII characters gave a 500. Now a verifier must be 43 to 128 characters of A-Z a-z 0-9 - . _ ~ (RFC 7636). Other verifiers get invalid_request, and the code is not used up.
• approve checks that code_challenge has the shape of an S256 challenge (43 base64url characters).
• A redirect address at registration may be at most 2048 characters (McpOAuth.maxRedirectUriLength).

Changed

• Needs dox_core 3.1.2.

Full list: the CHANGELOG.

3.1.1

New

• McpOAuth: OAuth 2.1 sign-in for your MCP server, as the MCP spec describes it.
  • Discovery files (RFC 9728 and RFC 8414), so MCP clients find the sign-in by themselves.
  • Dynamic client registration with signed client ids. Nothing is stored.
  • PKCE with S256 only. Codes are one-time and short-lived, kept in a Dox cache that all isolates share.
  • authenticate reads Authorization: Bearer. unauthorized answers with WWW-Authenticate.
  • Your app gives the consent page and the tokens (McpOAuthTokens). Show the redirect host on the consent page, and escape the client name.

Docs: https://dartondox.dev/latest/packages/mcp/

Changed

• Uses only the public package:dox_core/dox_core.dart library. Needs dox_core 3.1.1.

Full list: the CHANGELOG.