Update dependency io.modelcontextprotocol:kotlin-sdk to v0.14.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.modelcontextprotocol:kotlin-sdk	0.11.0 → 0.14.0

---

Release Notes

modelcontextprotocol/kotlin-sdk (io.modelcontextprotocol:kotlin-sdk)

v0.14.0

Compare Source

Description

Adds wire-level support for SEP-1686 Tasks and SEP-1036 URL Mode Elicitation.

Breaking Changes

These changes are source-compatible (existing Kotlin code compiles unchanged thanks to default values) but binary-incompatible — recompile against 0.14.0, and update any Java or fully-positional call sites.

SseServerTransport constructor and the mcp { } Ktor server extensions gained a request-body-size limit by @​devcrocod in #​839

A new maxRequestBodySize parameter (default applied) was added, changing the binary signatures.

- SseServerTransport(endpoint, session)
+ SseServerTransport(endpoint, session, maxRequestBodySize = DEFAULT_MAX_REQUEST_BODY_SIZE)

StreamableHttpClientTransport constructor gained an inline SSE event-size limit by @​devcrocod in #​841

A new maxInlineSseEventSize parameter was inserted before requestBuilder. Trailing-lambda Kotlin calls are unaffected; positional callers must adjust.

CallToolRequestParams and CreateMessageRequestParams gained a task field by @​devcrocod in #​844

Added as part of SEP-1686 Tasks; the generated copy()/componentN() signatures shifted, so dependents must recompile.

Features

• Add SEP-1686 Tasks wire-level types (TaskMetadata, task on tool-call and sampling params) by @​devcrocod in #​844
• Add SEP-1036 URL Mode Elicitation, including UrlElicitationRequiredException, UrlElicitationRequiredData, and the Elicitation.supportsUrl capability flag by @​devcrocod in #​843

Fixed

• Bound incoming HTTP POST body size in the SSE and Streamable HTTP server transports to prevent memory exhaustion from oversized requests by @​devcrocod in #​839
• Bound the size of a single inline SSE event parsed from a POST response in StreamableHttpClientTransport by @​devcrocod in #​841
• Validate Origin against localhost by default in DNS rebinding protection, rejecting requests with a valid Host but hostile or null Origin by @​devcrocod in #​840
• Gate completion/complete on the server's completions capability instead of prompts by @​rea9r in #​846
• Close stdio read sources during shutdown so StdioClientTransport.close() no longer hangs on a blocked read by @​jstar0 in #​798
• Polish SEP-1577 sampling handling — reject empty sampling content and emit an explicit error when tool_use is not followed by tool_result by @​MukundaKatta in #​765

Dependencies

• kotlinx-io-core to v0.9.1 in #​855
• kotlinx-collections-immutable to v0.5.0 in #​833
• Gradle wrapper to v9.6.1 in #​851, #​856
• gradle-maven-publish-plugin to v0.37.0 in #​848
• actions/checkout to v7 in #​852
• Kotest group updates in #​847
• MockK to v1.14.11 in #​792
• Logback to v1.5.37 in #​794, #​857
• Infrastructure group updates in #​797
• Sample and integration-test dependency bumps (mcp-kotlin/kotlin-sdk-client to 0.13.0, anthropic-java to 2.40.1, hono, esbuild, tsx, @​types/node) in #​795, #​799, #​818, #​820, #​821, #​823, #​824, #​826, #​828, #​831, #​837, #​853, #​854, #​864, #​865

New Contributors

• @​MukundaKatta made their first contribution in #​765
• @​rea9r made their first contribution in #​846
• @​jstar0 made their first contribution in #​798

Full Changelog: modelcontextprotocol/kotlin-sdk@0.13.0...0.14.0

v0.13.0

Compare Source

Description

Adds a tasks capability and a typed elicitation capability, hardens transport lifecycle, dispatchers, and back-pressure, and enables DNS rebinding protection by default.

Breaking Changes

Typed elicitation capability and new tasks capability by @​devcrocod in #​732

ClientCapabilities.elicitation is now a typed ClientCapabilities.Elicitation (form, url) instead of a raw JsonObject?, and both ClientCapabilities and ServerCapabilities gained a typed tasks capability. The constructors of both types changed and are binary-incompatible; recompilation is required.

Transport handlers now run on Dispatchers.Default by @​devcrocod in #​778

Handlers moved from Dispatchers.IO to Dispatchers.Default (override via handlerDispatcher), send() now suspends under back-pressure instead of buffering unbounded, and the two-argument StdioServerTransport(input, output) constructor is deprecated in favor of the builder-lambda form. Also fixes a start()/close() race, consistent CancellationException propagation, and an input-Source leak (closes #​573, #​574, #​708).

DNS rebinding protection enabled by default by @​devcrocod in #​659

enableDnsRebindingProtection now defaults to true on mcpStreamableHttp/mcpStatelessStreamableHttp, and the Route.mcp() / Application.mcp() overloads gained enableDnsRebindingProtection, allowedHosts, and allowedOrigins parameters (binary-incompatible on JVM). Only localhost, 127.0.0.1, and [::1] are allowed by default; opt out with enableDnsRebindingProtection = false. The Configuration.enableDnsRebindingProtection, .allowedHosts, and .allowedOrigins properties are deprecated in favor of the new DnsRebindingProtection plugin.

Features

• Add a tasks capability (list, cancel, and per-request augmentation for sampling and elicitation) on ClientCapabilities and ServerCapabilities, with assertions for tasks/* and notifications/tasks/status enforced by Client and ServerSession by @​devcrocod in #​732
• Configurable handlerDispatcher and ioDispatcher, plus an optional caller-supplied CoroutineScope, on transports by @​devcrocod in #​778

Fixed

• Fire onClose callbacks on SseClientTransport when the SSE session ends — whether closed gracefully or terminated by an error — matching the other client transports by @​jskjw157 in #​738

Security

• Enable DNS rebinding protection by default across all HTTP transports, including the SSE endpoints that previously had none (see Breaking Changes for migration) by @​devcrocod in #​659
• Cap a single stdio JSON-RPC frame at 16 MiB, throwing the new TooLongFrameException instead of buffering unbounded when a peer never sends a newline terminator by @​devcrocod in 6e6f805

Maintenance

• Remove the test-only dev.mokksy:mokksy dependency in favor of MockEngine and embeddedServer by @​devcrocod in #​754

Dependencies

• Ktor to v3.4.3 in #​785
• kotlinx.coroutines to v1.11.0 in #​760
• kotlin-logging to v8.0.03 in #​752, #​783
• 24 further Dependabot updates across sample projects, TypeScript conformance-test fixtures, and build/test tooling (JUnit, slf4j-simple, Gradle wrapper, anthropic-java)

Full Changelog: modelcontextprotocol/kotlin-sdk@0.12.0...0.13.0

v0.12.0

Compare Source

Description

Adds sampling-with-tools per SEP-1577, JSON Schema dialect declaration on tool schemas, server-side tool name validation, and capability extensions; fixes SSE reconnect on the same session and stops swallowing CancellationException.

Breaking Changes

Sampling messages can carry tool calls and results (SEP-1577) by @​devcrocod in #​718

SamplingMessage.content is now typed as a new SamplingMessageContent supertype, with MediaContent (text/image/audio), ToolUseContent, and ToolResultContent as variants. MediaContent still exists and now extends SamplingMessageContent, so most source code that constructs sampling messages compiles unchanged — but the binary signatures of SamplingMessage, CreateMessageResult, and related types have changed. ClientCapabilities.sampling is also now a typed Sampling object instead of a raw JsonObject. Recompilation is required; consumers reading sampling as JsonObject must migrate to the typed accessors.

watchosX64 and tvosX64 Kotlin/Native targets removed by @​devcrocod in #​727

These targets have been deprecated upstream. Migrate to the corresponding ARM/simulator targets (watchosArm64, watchosSimulatorArm64, tvosArm64, tvosSimulatorArm64).

Features

• Add $schema field to ToolSchema, declaring JSON Schema 2020-12 as the default dialect (SEP-1613) by @​devcrocod in #​696
• Validate tool names at registration time on the server, following the MCP tool naming standard (SEP-986) by @​devcrocod in #​695
• Add extensions field to ClientCapabilities and ServerCapabilities for advertising supported MCP extensions during the initialize handshake by @​eritscher in #​678

Fixed

• Validate the mcp-protocol-version HTTP header on initialization requests and correct DEFAULT_NEGOTIATED_PROTOCOL_VERSION to match the spec by @​devcrocod in #​697
• Propagate CancellationException instead of logging it as an error by @​devcrocod in #​706
• Evict stale GET SSE stream mapping on reconnect so a new GET on the same session is no longer silently rejected by the leftover entry from the previous stream by @​amr in #​716

Maintenance

• Add kotlinlang MCP server sample with search and get_page tools by @​devcrocod in #​713
• Migrate detekt to a buildSrc convention plugin with a fully explicit, version-locked YAML config by @​devcrocod in #​729
• Add Streamable HTTP integration tests for pagination, bad-request handling, and logging by @​jskjw157 in #​613
• Remove unused OpenAPI Generator plugin and configuration by @​devcrocod in #​683
• Remove Codecov configuration in favor of kover by @​devcrocod in #​691
• Remove redundant JUnit XML report configuration by @​devcrocod in #​728
• Remove IDEA files tied to the incompatible detekt IDE plugin by @​devcrocod in #​714
• Add Node.js setup to the release workflow so TypeScript integration tests run on macOS runners by @​devcrocod in #​684

Dependencies

• Kotlin to v2.3.21 in #​704, #​723
• kotlinx.serialization-json to v1.11.0 in #​687

New Contributors

• @​eritscher made their first contribution in #​678
• @​amr made their first contribution in #​716

Full Changelog: modelcontextprotocol/kotlin-sdk@0.11.1...0.12.0

v0.11.1

Compare Source

Description

Fixes an SSE stream crash on Netty when clients connect to the Streamable HTTP GET endpoint.

Fixed

• Fixed GET SSE stream crash on Netty in Streamable HTTP where appendSseHeaders() was called after response headers were already committed, causing UnsupportedOperationException and client retry loops by @​devcrocod in #​681

Dependencies

• mcp-kotlin to v0.11.0 in #​672, #​673, #​675, #​676
• Ktor BOM to v3.3.3 in #​650, #​653, #​656
• Kotest assertions to v6.1.11 in #​674
• anthropic-java to v2.19.0 in #​671
• @​modelcontextprotocol/sdk to v1.29.0, @​types/node update in #​677
• hono to v4.12.12 in #​680
• @​hono/node-server to v1.19.13 in #​679

Full Changelog: modelcontextprotocol/kotlin-sdk@0.11.0...0.11.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.