chore(deps): bump mcp/sdk from 0.7.0 to 0.7.1

[dependabot]

Bumps mcp/sdk from 0.7.0 to 0.7.1.

Release notes

Sourced from mcp/sdk's releases.

v0.7.1

What's Changed

• Hardening transports
• Fix codestyle pipeline on main by @​chr-hertel in modelcontextprotocol/php-sdk#402
• Fix 'notifcation' typo in docs by @​latent-9 in modelcontextprotocol/php-sdk#410

New Contributors

• @​latent-9 made their first contribution in modelcontextprotocol/php-sdk#410

Full Changelog: modelcontextprotocol/php-sdk@v0.7.0...v0.7.1

Changelog

Sourced from mcp/sdk's changelog.

Changelog

All notable changes to mcp/sdk will be documented in this file.

0.8.0

• Speak the 2026-07-28 lifecycle from the client: Client opens with server/discover instead of initialize on that revision, stamps each request's _meta with the protocol version, its own capabilities and client info, and sends the standard Mcp-Method / Mcp-Name / Mcp-Param-* headers an intermediary routes on — the last from the new Mcp\Client\Stateless\ToolCatalog, which knows from the tool list which arguments a call must mirror. An input_required result is answered automatically by InputRequestResolver, which asks the host's elicitation, sampling and roots handlers and retries the same request with inputResponses and the requestState the server sent. Mcp\Schema\Wire\McpHeader holds the header names and the =?base64?…?= sentinel both sides share.
• Serve both protocol eras from one endpoint: StreamableHttpTransport classifies each request — a 2026-07-28 envelope, an initialize handshake, or a session-bound follow-up — through the new Mcp\Server\Wire\InboundClassifier and routes it to the dispatcher that owns it, so a single URL answers a modern client and a handshake-era one alike. Server::builder()->build() now carries both dispatchers; Builder::withoutModernEra() opts out and Builder::setModernVersions() narrows what the modern leg answers for. Mcp\Server\InputRequiredShim lets a handler written for multi round-trip requests also serve a handshake-era client, by turning each ask into the request/response exchange that era has.
• Carry W3C trace context through a request (SEP-414): traceparent, tracestate and baggage in a request's _meta are exposed to handlers as RequestContext::getTraceContext() and echoed onto the notifications that request causes, so a span stays joined across the response stream. Values pass through exactly as they arrived, and no OpenTelemetry dependency is added.
• Deliver notifications on a subscriptions/listen stream (SEP-2575), which previously acknowledged and then carried nothing for the rest of its life. New Mcp\Server\Subscription\NotificationBusInterface with two implementations — InMemoryNotificationBus for stdio and persistent runtimes, Psr16NotificationBus for PHP-FPM, where the worker holding the stream open and the worker publishing are different processes — set with Builder::setNotificationBus(). Registry changes are published automatically through a PublishingEventDispatcher that wraps whatever PSR-14 dispatcher was configured. Builder::setSubscriptionLifetime() replaces the hard-coded 30-second ceiling, where 0 means "until the client or the runtime ends it".
• Add Mcp\Server\Wire\CachePolicy, set with Builder::setCachePolicy(), to configure the SEP-2549 caching hints the 2026-07-28 lifecycle stamps on a cacheable result. The conservative ttlMs: 0, cacheScope: private stays the default, since public lets a shared proxy serve one caller's answer to another and only the operator can make that call. A ReadResourceResult may also carry its own ttlMs/cacheScope, which win over the policy.
• Add typed readers to Mcp\Server\Stateless\InputContext: elicitResult(), samplingResult() and rootsResult() deserialize a multi round-trip answer instead of handing back the raw array response() returns. A malformed answer reads as absent rather than throwing, so a handler asks again — which is what the spec says a server SHOULD do when the information it needs is still missing.
• Answer a request over a response stream under the 2026-07-28 lifecycle: StatelessProtocol runs handlers in a fiber, so $gateway->progress() and $gateway->log() work there as they do in the handshake era. The stream opens only if the handler actually emits something and the client's Accept admits text/event-stream, and the choice is made after the handler's first suspension, so a request that turns out to need -32021 or -32602 is still answered with the status the spec fixes for it.
• Honour io.modelcontextprotocol/logLevel (SEP-2575), which replaced the logging/setLevel RPC: a request naming no level receives no notifications/message at all, one naming a level receives the messages at or above it. Adds LoggingLevel::severity() and LoggingLevel::isAtLeast().
• [BC Break] Answer a not-found subject with -32602 (Invalid params) instead of -32002, which the 2026-07-28 revision reserves and forbids emitting (SEP-2164). resources/read picks the code from the revision serving the request — -32602 with the uri in error.data from 2026-07-28 on, -32002 below. prompts/get for an unknown prompt, completion/complete for an unknown reference and tools/call for an unknown tool switch to -32602 in every revision: -32002 was never the code for those. Adds ProtocolVersion::usesInvalidParamsForResourceNotFound().
• Add the multi round-trip requests pattern for the 2026-07-28 lifecycle (SEP-2322): a tools/call or prompts/get handler returning Mcp\Schema\Result\InputRequiredResult comes back as resultType: "input_required" carrying the inputRequests it needs answered and an opaque requestState; the client retries the same request with inputResponses, which the handler reads through RequestContext::getInputContext(). Mcp\Server\Stateless\RequestStateCodec signs and time-bounds the state — set the key with Builder::setRequestStateKey().
• Validate the standard MCP request headers under the 2026-07-28 lifecycle (SEP-2243): Mcp\Server\Stateless\StandardHeaderValidator, set with Builder::setHeaderValidator(), checks that Mcp-Method and Mcp-Name agree with the body they travel with and that a Mcp-Param-* mirrors the argument its tool marked x-mcp-header, answering -32020 when they disagree. Intermediaries route on these headers, so a value contradicting the body has to be refused rather than ignored.
• [BC Break] Mcp\Schema\JsonRpc\Error accepts null as its $id, and getId() may return it. An error response whose id could not be read now omits the member instead of sending "id": "" — which claimed the peer had issued a request with an empty-string id. All the for*() factories default to null, fromArray() accepts a missing or explicitly-null id, and MessageFactory decodes both as an id-less error rather than rejecting them.
• Preserve the original request id on an invalid-but-parseable message (-32600) instead of answering it id-less: InvalidInputMessageException now carries the recoverable id via getRequestId()/setRequestId(), threaded from MessageFactory through to the error response.
• [BC Break] Add the extensions framework SEP-2133 defines, which MCP Apps sits on. ExtensionInterface::getId() now returns the new Mcp\Schema\Extension\ExtensionIdentifier value object instead of a string, which validates the identifier against the _meta key naming rules at construction time. ExtensionInterface also gains getMessages()/getRequestHandlers(), so an extension can contribute the message classes its methods decode into — without which its methods cannot be decoded at all — and the handlers serving them; extensions that only announce a capability can extend the new Mcp\Schema\Extension\AbstractExtension and skip both. MessageFactory::make() takes an $additional list of message classes, and RequestHandlerInterface's result template is now covariant.
• [BC Break] Drop the SDK-only name pattern on ResourceDefinition/ResourceTemplate $name — the spec allows any string (its own examples use main.rs and Project Files). URI/URI-template validation is unchanged.
• Add ClientGateway::supportsExtension(), Client\Builder::enableExtension(), and ClientCapabilities::withExtensions() so clients can negotiate and check protocol extensions (e.g. MCP Apps) the same way servers already do. [BC Break] ServerExtensionInterface is replaced by the side-agnostic Mcp\Schema\Extension\ExtensionInterface.
• Deprecate Roots, Sampling and Logging per SEP-2577 (protocol revision 2026-07-28, earliest removal 2027-07-28). They keep working but using them now triggers a deprecation notice — migrate to tool arguments/resource URIs, a direct LLM provider API, and stderr/OpenTelemetry respectively.
• [BC Break] Gate structuredContent on the negotiated protocol revision: a tool result that's a PHP list (or an object serializing to a JSON array) is now only sent as structuredContent on protocol revisions 2026-07-28+; older revisions omit it and keep the JSON-encoded value in content.
• Add protocol revision negotiation during initialize: the server counter-offers a revision it supports, and the client now fails the handshake instead of continuing on an unagreed revision. Adds Client::getProtocolVersion() and the 2026-07-28 revision.
• Add sampling-with-tools support: sampling requests can include tools and tool-choice preferences, messages support tool-use/tool-result content blocks, and clients advertise sampling.context/sampling.tools via ClientGateway::supportsSamplingTools()/supportsSamplingContext(). A request that violates the spec's tool-flow rules is now rejected with a proper JSON-RPC error instead of being left unanswered.
• [BC Break] SamplingMessage::$content and CreateSamplingMessageResult::$content may now be a list of content blocks instead of just one — use the new getContentBlocks() to always get a list.
• [BC Break] CreateSamplingMessageResult now rejects any role other than assistant, and rejects empty content, per spec.
• Close the remaining schema gaps for 2025-06-18/2025-11-25 and add the 2026-07-28 surface (SEP-2106): url-mode elicitation (ClientGateway::elicitUrl()/supportsElicitationUrl()), Implementation::title, and outputSchema/structuredContent accepting any JSON value rather than only objects.
• Add Mcp\Schema\Content\ResourceLink — reference a resource by URI/name in tool results and prompt messages without embedding its contents.
• Add client-side Roots support: RootsCallbackInterface, Client::sendRootsListChanged(), and server-side ClientGateway::listRoots()/supportsRoots().
• Add ClientGateway::supportsSampling() to check the client's advertised capabilities before sending a sampling request, matching supportsRoots()/supportsElicitation().
• Fix empty tool/resource schemas serializing as [] instead of {} in inputSchema/outputSchema.
• Fix PromptResultFormatter dropping annotations, _meta, and mimeType when a prompt generator returns content as a plain array.
• Add annotations support to ImageContent, matching TextContent/AudioContent.

Commits

• 785fc3b Fix 'notifcation' typo in docs (#410)
• 9a6d24c Fix codestyle pipeline for 0.7.1 (#402)
• 9aa18f3 Merge commit from fork
• 529099f Merge commit from fork
• 055593f Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.