Skip to content

v1.108.150 — stateless-MCP forward cover

Choose a tag to compare

View all tags
@jgravelle jgravelle released this 20 Jul 23:28
v1.108.150
fead9ad

The MCP 2026-07-28 spec removes protocol sessions (Mcp-Session-Id) from HTTP transports and deprecates SSE. This release ships the forward cover that needs no new SDK:

  • Auth-principal session keying. Session-scoped state (tool-tier overrides, advisory budgets, session stats, verdict calibration) now falls back to a hashed auth principal (sha256 of the Authorization header — never the raw credential) when the transport issues no session id. Byte-identical under today's sessionful transport; under stateless MCP, authenticated HTTP callers keep durable per-credential state instead of silently resetting every request.
  • No-principal demand signal. One INFO line per process when an HTTP session is created without an Authorization header.
  • SSE deprecation notice. serve --transport sse prints a startup notice recommending --transport streamable-http. SSE keeps working for hosts that haven't migrated (e.g. Odysseus); docs updated.

No tool-count, schema, wire-shape, or INDEX_VERSION change. Full suite: 5423 passed.

Assets 10
Loading