Skip to content

mcp_dart 2.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jul 18:44
· 24 commits to main since this release
v2.3.0
85af407
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

mcp_dart 2.3 adds the final MCP 2026-07-28 surface while
preserving the public 2.2.2 API. See the
2.2 to 2.3 migration guide
for upgrade steps and the
MCP 2026-07-28 transition guide
for protocol details.

Added

  • Added an SDK-owned offline validator with public Draft 2020-12 and declared
    Draft 7 APIs, removing the json_schema and quiver dependencies.
  • Added dual-era protocol profiles, server/discover, stateless metadata,
    subscriptions/listen, multi-round tool/resource/prompt callbacks, the
    independently pinned experimental Tasks extension, and any-root structured
    tool results for MCP 2026-07-28.
  • Added stateless registration helpers and a backward-compatible
    RegisteredStatelessTool handle without widening the existing 2.2.2
    registration interfaces.

Changed

  • McpProtocol.stable now prefers MCP 2026-07-28 and falls back to legacy
    initialization. Silent body-only discovery probes are bounded to five
    seconds; McpProtocol.legacy retains exact initialization-only behavior.
  • Preserved the 2.2.2 values of latestProtocolVersion and
    supportedProtocolVersions; use defaultProtocolVersion and
    allSupportedProtocolVersions for the dual-era profile.
  • Hardened JSON-RPC parsing, protocol-era isolation, capability and metadata
    validation, request direction, notification routing, and error-code mapping
    while preserving legacy wire behavior.
  • Aligned stateless identity, discovery caching, tracing metadata,
    request-scoped logging, and required client capabilities with MCP
    2026-07-28.
  • Hardened OAuth discovery and authorization-code flows with exact issuer
    matching, safe redirects, endpoint validation, client registration priority,
    and issuer/resource-bound tokens.
  • Restricted legacy server-initiated requests and global list/resource update
    helpers to initialization-era sessions; stateless interactions use embedded
    input requests and acknowledged subscriptions.
  • Tool input-schema failures now return CallToolResult(isError: true) under
    MCP 2025-11-25 and 2026-07-28; invalid registered schemas and output
    contract violations are reported as server errors.
  • Structured output validation now compiles schemas before handler side
    effects and preserves the accepted schema for task-backed results.
  • Tasks and subscriptions/listen now enforce their independent capabilities,
    status shapes, acknowledgment scope, URI boundaries, and cancellation
    lifecycle.
  • Stateless stdio clients recover from bounded child failures and restore
    subscriptions without replaying ordinary requests.
  • Streamable HTTP now isolates concurrent requests, promotes responses to SSE
    when intermediate traffic requires it, and cancels pending work promptly on
    disconnect.
  • mcp_dart inspect-server now accepts protocol-appropriate array and primitive
    output schemas.

Fixed

  • Registered tool, prompt, resource, and resource-template handles now remove
    and rename their registrations consistently.
  • Stdio legacy fallback now starts a fresh child when the initial
    server/discover compatibility probe causes the server process to exit.
  • Malformed newline-delimited frames no longer strand valid messages later in
    the same input chunk.
  • Shutdown, restart, request-ID reuse, subscription cancellation, and
    response-stream races no longer leak work or cross request boundaries.

Validation and documentation

  • Added public API compatibility checks against mcp_dart 2.2.2, minimum-Dart
    dependency testing, and pinned core, Tasks, and JSON Schema conformance data.
  • The official alpha.10 MCP 2026-07-28 client and server suites pass with no
    expected failures, including all 25 OAuth scenarios.
  • Published TypeScript SDK 2.0.0 and Python SDK 2.0.0rc1 interoperate
    bidirectionally on the post-#3002 discovery wire.

Breaking and compatibility notes

  • DiscoverResult.serverInfo is now nullable because MCP 2026-07-28 permits
    anonymous servers. Check for null before reading identity fields. MCP
    2025-11-25 behavior is unchanged.
  • mcp_dart 2.3 requires Dart 3.4 or newer; the CLI requires Dart 3.12.
  • The direct http constraint is now ^1.5.0 because cancellation uses APIs
    introduced in 1.5. Normal ^1.4.0 constraints remain compatible, but pins
    below 1.5 must be updated.
  • Stateless stdio clients now restart an unexpectedly terminated child by
    default and restore active subscriptions/listen requests. Set
    StdioServerParameters.restartOnUnexpectedExit to false to retain the
    prior close-on-exit behavior. Ordinary in-flight requests are never replayed.
  • ProtocolOptions.taskStore and taskMessageQueue remain available for MCP
    2025-11-25 task augmentation and may coexist with the independent Tasks
    extension, whose handlers and persistence remain application-owned.
  • OAuth providers now treat a non-empty clientId as pre-registered client
    information. Return an empty clientId only to opt into deprecated Dynamic
    Client Registration.
  • OAuth discovery and token endpoints on another origin now require an
    explicit oauthUriValidator; client redirect URIs must use HTTPS or loopback
    HTTP, and malformed or incomplete metadata is rejected.
  • The exact v2.2.2 finishAuth(String) override remains available but is
    deprecated. New integrations should use finishAuthRedirect to validate the
    returned state and optional issuer.
  • A schema-invalid tools/call now completes at the JSON-RPC level and returns
    a tool error result instead of throwing McpError(ErrorCode.invalidParams).
    Inspect CallToolResult.isError instead; MCP 2025-06-18 and earlier peers
    retain invalidParams.
  • Under MCP 2025-11-25 and 2026-07-28, an invalid registered input or output
    schema or invalid server-produced output returns JSON-RPC internalError.
    Malformed call parameters continue to return invalidParams.
  • Clients now reject successful tool results that omit structuredContent when
    the advertised outputSchema requires it. MCP 2025-11-25 and earlier
    clients retain object-root compatibility; MCP 2026-07-28 accepts any JSON
    root.
  • Under MCP 2025-11-25, task-mode negotiation now runs before input-schema
    validation. Task-required or task-forbidden negotiation failures return
    methodNotFound; earlier protocol versions retain invalidParams.
  • CallToolResult.extra entries named content, isError, _meta, or
    structuredContent no longer replace protocol-owned fields. Use their
    dedicated constructor parameters.
Assets 2
Loading