v2.6.0

v2.6.0 — Stateless streamable HTTP (MCP protocol 2026-07-28)

This release completes the adoption of MCP go-sdk v1.7.0 and closes #259: the server now speaks the latest MCP protocol (2026-07-28) over streamable HTTP, using the sessionless transport model from SEP-2567.

⚠️ Breaking change: HTTP mode is stateless by default

--stateless now defaults to true. Protocol 2026-07-28 is only served over HTTP in stateless mode — stateful sessions negotiate down to 2025-11-25 — so the default follows the spec's direction. In stateless mode:

• The server neither reads nor sets Mcp-Session-Id; every POST is a self-contained JSON-RPC exchange (no initialize round-trip required).
• GET and DELETE on the MCP endpoint return 405 Method Not Allowed (/health and /.well-known/* are unaffected).
• Elicitation keeps working for protocol 2026-07-28 clients through multi round-trip requests (SEP-2322, adopted in v2.5.3); legacy-protocol clients fall back to non-interactive alternatives (e.g. the confirm parameter for destructive actions).
• The per-token server pool still applies, so repeated requests reuse a cached server instance.

Migration: HTTP deployments that need session-based behavior (legacy clients relying on the standalone SSE stream or synchronous elicitation) must now pass --stateless=false. This legacy mode logs a startup warning and is intended for eventual removal once client ecosystems migrate. Stdio mode is unaffected.

New HTTP transport options

Flag	Default	Description
--stateless	true	Sessionless streamable HTTP (see above); --stateless=false restores legacy stateful sessions
--json-response	false	Return application/json bodies instead of text/event-stream (SSE) — useful for gateways and simple HTTP clients
--max-request-body-bytes	0	Cap on request body size; 0 uses the SDK default (4 MiB), oversized bodies get 413, negative values are rejected

Other improvements

• Request cancellation — client aborts now cancel the in-flight GitLab API call server-side (PropagateRequestCancellation, protocol 2026-07-28 requests; legacy clients unaffected).
• Cache hints (SEP-2549) — every cacheable result (tools/list, prompts/list, resources/*, server/discover) now carries ttlMs/cacheScope. All results are cacheScope: private because catalogs are filtered by token scopes and licensing tier — this also overrides the SDK's public default, which would have allowed shared caches to serve one user's catalog to another. TTLs: catalogs 5m, static resource reads (guides/schemas/tool manifest) 1h, live GitLab data none.
• Gateway routing (SEP-2243) — gitlab_execute_action's action property carries an x-mcp-header: Mcp-Param-Action annotation, so MCP-aware proxies can route and observe calls without inspecting the JSON-RPC body.
• Validation tooling — make validate-http-stateless (compiled binary) and make validate-http-stateless-docker (Docker image) smoke-validate a stateless deployment end to end.
• Docs — the HTTP server mode guide covers the stateless model, legacy stateful mode, cache hints, and gateway routing (English and Spanish).

PRs: #260, #261, #262.

---

Changelog

✨ Features

• 05ff168: feat(http)!: stateless by default plus SDK v1.7.0 follow-ups (cache hints, cancellation, body limit, x-mcp-header) (#261) (@jmrplens)
• 517fe69: feat(http): stateless streamable HTTP mode (SEP-2567, protocol 2026-07-28) (#260) (@jmrplens)

🚧 Maintenance

• 3e36df9: chore: bump version to 2.6.0 (#262) (@jmrplens)
• 4486f0c: chore: update manifests for v2.5.3 (@jmrplens)
• 69f135c: ci(release): retry cosign signing on transient OIDC failures (#258) (@jmrplens)