Bump mcp from 1.3.0 to 1.5.0

[dependabot]

Bumps mcp from 1.3.0 to 1.5.0.

Release notes

Sourced from mcp's releases.

v1.5.0

This release makes the client answer a server's ping with the empty result the specification requires. Earlier clients replied with Method not found over Streamable HTTP and stayed silent over stdio, so a server that checks liveness dropped their long-lived sessions. On the OAuth side, the embedding application can refuse an authorization request through authorization_request_validator, and stored tokens are refreshed only against the authorization server that issued them: when the server named for a session differs, the client reauthorizes instead of refreshing, and the validator sees the newly named server. Tokens stored by earlier releases carry no issuer and keep refreshing.

Added

• Add authorization_request_validator to let the embedding application refuse an authorization request (#539)

Fixed

• Answer server-to-client pings in the client (#541)

v1.4.0

This release repairs the subscriptions/listen stream. A host that buffers its responses, the documented Rails controller pattern among them, can decline the method with serve_subscriptions_listen: false instead of answering a modern client with a streaming body it cannot render, and the stream's ordering guarantees are enforced: no notification reaches a client before the acknowledgement, and none follows the graceful closing result.

Added

• Add serve_subscriptions_listen: for hosts that cannot hold an SSE stream open (#533)

Fixed

• Deliver subscriptions/listen notifications only after the acknowledgement (#532)
• Serialize subscriptions/listen writes so the graceful result is the final message (#535)

Changelog

Sourced from mcp's changelog.

[1.5.0] - 2026-09-05

This release makes the client answer a server's ping with the empty result the specification requires. Earlier clients replied with Method not found over Streamable HTTP and stayed silent over stdio, so a server that checks liveness dropped their long-lived sessions. On the OAuth side, the embedding application can refuse an authorization request through authorization_request_validator, and stored tokens are refreshed only against the authorization server that issued them: when the server named for a session differs, the client reauthorizes instead of refreshing, and the validator sees the newly named server. Tokens stored by earlier releases carry no issuer and keep refreshing.

Added

• Add authorization_request_validator to let the embedding application refuse an authorization request (#539)

Fixed

• Answer server-to-client pings in the client (#541)

[1.4.0] - 2026-08-28

This release repairs the subscriptions/listen stream. A host that buffers its responses, the documented Rails controller pattern among them, can decline the method with serve_subscriptions_listen: false instead of answering a modern client with a streaming body it cannot render, and the stream's ordering guarantees are enforced: no notification reaches a client before the acknowledgement, and none follows the graceful closing result.

Added

• Add serve_subscriptions_listen: for hosts that cannot hold an SSE stream open (#533)

Fixed

• Deliver subscriptions/listen notifications only after the acknowledgement (#532)
• Serialize subscriptions/listen writes so the graceful result is the final message (#535)

Commits

• 8a24e50 Merge pull request #543 from koic/release_1_5_0
• 33525d6 Release 1.5.0
• f706cc8 Merge pull request #542 from koic/fix_flaky_listen_keepalive_thread_assertion
• 6d272df Merge pull request #541 from koic/respond_to_server_pings_in_the_client
• eeab784 Merge pull request #539 from koic/add_authorization_request_validator
• 09c3103 Fix the flaky thread count assertion in the listen keepalive test
• 088f4b9 Answer server-to-client pings in the client
• 6b1704f Merge pull request #540 from koic/mark_deprecated_features_on_the_server_over...
• 6f0b854 [Doc] Mark the deprecated features on the server overview
• 09d4bf4 Let the embedding application refuse an authorization request
• Additional commits viewable in compare view

[dependabot]

Superseded by #433.