Modern stateless server for MCP 2026-07-28

[chemicL]

A new server in io.modelcontextprotocol.modern, next to the existing
one and independent of the legacy McpSchema. Passes all 37 required
2026-07-28 conformance scenarios.

• Pick a paradigm, not a server: one McpServer, sync or async
  repositories, no Reactor in sync code. The immediateExecution flag
  is gone; the transport decides where blocking code runs, and
  thread-locals from servlet filters just work.
• Primitives are yours: tools, resources, prompts and completions come
  from repositories you implement. Dynamic, per-tenant, filtered and
  paginated catalogs, no SDK registry in the way.
• Stream when it pays: a handler returns a single result
  (application/json) or a streaming body (SSE). No more JSON-only
  stateless vs. SSE-always sessions.
• McpFeature as the one extension point: methods, handler, capabilities.
• MRTR with requestState HMAC-sealed to principal, expiry, method and
  tool or resource.
• server/discover, caching hints, subscriptions/listen fed by
  McpChangeFeed.
• Tool arguments checked against inputSchema, structuredContent against
  outputSchema; prompt arguments and completions validated too.
• McpException goes out as given; other exception messages stay in
  the log.
• HTTP: POST only, keep-alives, disconnect detection, configurable
  error statuses, cross-origin refused by default.
• Stdio: concurrent requests, cancellation, one writer, line size limit.
• Logging dropped, as the revision deprecates it.

Also: modern conformance server and CI job, conformance runs moved to
0.2.0-alpha.12, CONTRIBUTING record rules refined.

Not yet: SEP-2243 custom headers, tasks, a modern client.

Addresses, for users of the modern server

• Sessions gone:
  • McpServerSession lifecycle doesn't support distributed services #274
  • Current implementation of HttpServletStreamableServerTransportProvider or HttpServletSseServerTransportProvider needs strict stickyness #499
  • Simplify error response when accessing MCP without session ID #577
  • I would like to maintain MCP server state persisted (sessionId) #738
  • HttpServletStreamableServerTransportProvider removes session on non-fatal failure #952
  • Expose API to inspect and remove inactive server sessions #1063
• No server-to-client requests:
  • Stateful streamable server calls listRoots() unconditionally on roots/list_changed, blocking a servlet thread until requestTimeout when no roots consumer is registered #1061
• Errors:
  • Add error logging when onErrorResume in McpServerSession #249
  • MCP server to be able to return custom http codes #737
  • Servlet transports serialize McpError exceptions instead of JSON-RPC error envelopes #955
  • McpServerSession never sends a response when a request handler's Mono completes empty — violates JSON-RPC 2.0's one-response-per-request contract #1081
  • ServerCapabilities.logging is added unconditionally, overriding the caller's explicit capabilities #1086
• HTTP:
  • Add X-Accel-Buffering: no Header for SSE Responses #293
  • Resolve message endpoint path using request context path #400
  • Streamable Stateless server should support upgrade to SSE response #539
  • Support application/json responses in Streamable HTTP transport (opt-in JSON response mode) #844
  • Servlet-based server transports read request body with wrong charset encoding #880
  • Streamable HTTP accepts unsupported or malformed MCP-Protocol-Version headers #957
  • HttpServletStreamableServerTransportProvider: GET stream sends no status or headers until the first event #1155
• Stdio:
  • StdioServerTransportProvider uses incorrect Mono.zip operator #303
  • StdioServerTransportProvider should support a stdin-close callback without interrupting shutdown #936
• Repositories:
  • Add Primitive repository APIs (ResourceRepository, ToolsRepository, ... ) #578
  • Allow dynamic generation of tool definition in MCP Server #626
  • Add Bulk Operations for tools #941
  • Server should handle paginated requests #967
• Context and schema:
  • Should McpTransportContextExtractor contain default methods for protocol version, lastEventId and sessionId #492
  • Missing @JsonIgnoreProperties(ignoreUnknown = true) on capability sub-records #766
• 2026-07-28 server side:
  • SEP-2164: Standardize resource not found error code (-32602) #1001
  • SEP-2322: Multi Round-Trip Requests #1004
  • SEP-2549: TTL for List Results #1009
  • SEP-2567: Sessionless MCP via Explicit State Handles #1010
  • SEP-2575: Make MCP Stateless #1011