Key Changes

​

Major changes

1. Enhance authorization server discovery with support for OpenID Connect Discovery 1.0. (PR #797)
2. Allow servers to expose icons as additional metadata for tools, resources, resource templates, and prompts (SEP-973).
3. Enhance authorization flows with incremental scope consent via WWW-Authenticate (SEP-835)
4. Provide guidance on tool names (SEP-986)
5. Update ElicitResult and EnumSchema to use a more standards-based approach and support titled, untitled, single-select, and multi-select enums (SEP-1330).
6. Added support for URL mode elicitation(SEP-1036)
7. Add tool calling support to sampling via tools and toolChoice parameters (SEP-1577)
8. Add support for OAuth Client ID Metadata Documents as a recommended client registration mechanism (SEP-991, PR #1296)
9. Add experimental support for tasks to enable tracking durable requests with polling and deferred result retrieval (SEP-1686).

​

Minor changes

1. Add optional description field to Implementation interface to align with MCP registry server.json format and provide human-readable context during initialization.
2. Clarify that servers must respond with HTTP 403 Forbidden for invalid Origin headers in Streamable HTTP transport. (PR #1439)
3. Updated the Security Best Practices guidance.
4. Clarify that input validation errors should be returned as Tool Execution Errors rather than Protocol Errors to enable model self-correction (SEP-1303).
5. Support polling SSE streams by allowing servers to disconnect at will (SEP-1699).

​

Other schema changes

1. Decouple request payloads from RPC method definitions into standalone parameter schemas. (SEP-1319, PR #1284)

​

Full changelog