0.14.0

Description

Adds wire-level support for SEP-1686 Tasks and SEP-1036 URL Mode Elicitation.

Breaking Changes

These changes are source-compatible (existing Kotlin code compiles unchanged thanks to default values) but binary-incompatible — recompile against 0.14.0, and update any Java or fully-positional call sites.

SseServerTransport constructor and the mcp { } Ktor server extensions gained a request-body-size limit by @devcrocod in #839

A new maxRequestBodySize parameter (default applied) was added, changing the binary signatures.

- SseServerTransport(endpoint, session)
+ SseServerTransport(endpoint, session, maxRequestBodySize = DEFAULT_MAX_REQUEST_BODY_SIZE)

StreamableHttpClientTransport constructor gained an inline SSE event-size limit by @devcrocod in #841

A new maxInlineSseEventSize parameter was inserted before requestBuilder. Trailing-lambda Kotlin calls are unaffected; positional callers must adjust.

CallToolRequestParams and CreateMessageRequestParams gained a task field by @devcrocod in #844

Added as part of SEP-1686 Tasks; the generated copy()/componentN() signatures shifted, so dependents must recompile.

Features

• Add SEP-1686 Tasks wire-level types (TaskMetadata, task on tool-call and sampling params) by @devcrocod in #844
• Add SEP-1036 URL Mode Elicitation, including UrlElicitationRequiredException, UrlElicitationRequiredData, and the Elicitation.supportsUrl capability flag by @devcrocod in #843

Fixed

• Bound incoming HTTP POST body size in the SSE and Streamable HTTP server transports to prevent memory exhaustion from oversized requests by @devcrocod in #839
• Bound the size of a single inline SSE event parsed from a POST response in StreamableHttpClientTransport by @devcrocod in #841
• Validate Origin against localhost by default in DNS rebinding protection, rejecting requests with a valid Host but hostile or null Origin by @devcrocod in #840
• Gate completion/complete on the server's completions capability instead of prompts by @rea9r in #846
• Close stdio read sources during shutdown so StdioClientTransport.close() no longer hangs on a blocked read by @jstar0 in #798
• Polish SEP-1577 sampling handling — reject empty sampling content and emit an explicit error when tool_use is not followed by tool_result by @MukundaKatta in #765

Dependencies

• kotlinx-io-core to v0.9.1 in #855
• kotlinx-collections-immutable to v0.5.0 in #833
• Gradle wrapper to v9.6.1 in #851, #856
• gradle-maven-publish-plugin to v0.37.0 in #848
• actions/checkout to v7 in #852
• Kotest group updates in #847
• MockK to v1.14.11 in #792
• Logback to v1.5.37 in #794, #857
• Infrastructure group updates in #797
• Sample and integration-test dependency bumps (mcp-kotlin/kotlin-sdk-client to 0.13.0, anthropic-java to 2.40.1, hono, esbuild, tsx, @types/node) in #795, #799, #818, #820, #821, #823, #824, #826, #828, #831, #837, #853, #854, #864, #865

New Contributors

• @MukundaKatta made their first contribution in #765
• @rea9r made their first contribution in #846
• @jstar0 made their first contribution in #798

Full Changelog: 0.13.0...0.14.0