chore(deps): Update Rust crate rmcp to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
rmcp	dependencies	major	1.2.0 → 2.0.0

---

Release Notes

modelcontextprotocol/rust-sdk (rmcp)

v2.1.0

Compare Source

Added

• add SEP-414 trace context meta accessors (#​910)
• add SEP-2575 meta helpers (#​942)

Fixed

• (transport) make AsyncRwTransport::receive cancel-safe (#​941) (#​947)
• (auth) preserve refresh_token when refresh response omits it (#​949)
• block redirect header leaks (#​936)
• don't respond to unparsable messages (#​940)
• negotiate protocol version in handler (#​930)

v2.0.0

Compare Source

Migration guide: https://redirect.github.com/modelcontextprotocol/rust-sdk/discussions/926

Added

• [breaking] (rmcp) add Audio variant to PromptMessageContent (#​865)
• [breaking] align model types with MCP 2025-11-25 spec (#​927)
• deprecate roots/sampling/logging types (#​923)

Fixed

• prevent OAuth resource spoofing (#​937)
• block oauth metadata ssrf (#​935)
• prevent streamable HTTP session leak (#​934)
• fill missing fully qualified syntax in prompt_handler macros (#​866)

Other

• consolidate repeated rmcp tests (#​931)
• align README examples with v2 model API (#​928)

v1.8.0

Compare Source

[!WARNING]

⚠️ Breaking Changes

Despite being a minor version bump, this release contains a source-breaking API change (it should have been 2.0.0). If you depend on rmcp = "1.7", Cargo will resolve to 1.8.0 automatically and your build may fail. Pin to =1.7.x if you are not ready to migrate.

Peer::peer_info() return type changed (#​862):

- pub fn peer_info(&self) -> Option<&R::PeerInfo>
+ pub fn peer_info(&self) -> Option<Arc<R::PeerInfo>>

This was needed so peer info can be re-set on a duplicate initialize (it now lives behind an RwLock), which is why a borrow can no longer be returned.

Migration: field access still works through Arc's Deref. If you need the old &InitializeResult (e.g. you bound the type explicitly), use .as_deref():

// Before (1.7.x): info is &InitializeResult
let info: Option<&InitializeResult> = client.peer_info();

// After (1.8.0): info is Arc<InitializeResult>
let info: Option<Arc<InitializeResult>> = client.peer_info();

// To recover the old reference type:
let info: Option<&InitializeResult> = client.peer_info().as_deref();

Added

• standardize resource-not-found error code (SEP-2164) (#​899)
• validate OAuth authorization response issuer (#​896)
• specify OIDC application_type during dynamic client registration (SEP-837) (#​883)
• deprecate roots, sampling, and logging (SEP-2577) (#​884)

Fixed

• (auth) preserve configured reqwest client (#​917)
• (auth) align OAuth metadata discovery ordering (#​887)
• align progress timeout token (#​909)
• (elicitation) preserve enumNames through ElicitationSchema serde round-trip (#​905)
• return tool errors for invalid arguments (#​894)
• (auth) apply offline_access to reauth paths (#​897)
• update peer info on duplicate initialize (#​862) — ⚠️ breaking: changes the Peer::peer_info() signature, see Breaking Changes above
• strip and validate tool outputSchema and inputSchema (#​860)
• remove unnecessary fields from tools' inputSchema (#​856)
• reject init header/body version mismatch (#​853)
• align protocol version negotiation (#​855)
• accept 200 with empty body in response to notifications in addition to 202 (#​849)

Other

• Allow custom HTTP clients for OAuth (#​908)
• Add progress-aware request timeout reset (#​858)
• (server) document Err vs Ok(CallToolResult::error) visibility contract on ServerHandler::call_tool (#​854)
• refine mcpmate listing copy (#​885)
• added jilebi-mcp to the list of built with rmcp (#​861)

v1.7.0

Compare Source

Added

• add task-based stdio examples (#​839)

Fixed

• (rmcp) flatten Resource variant of PromptMessageContent (#​843)
• reply -32700 on stdio parse errors instead of closing (#​833)

Other

• (rmcp) remove dependency on chrono default features (#​829)
• Fix/issue 817 idle timeout log level (#​824)

v1.6.0

Compare Source

Added

• (http) log Host/Origin rejections (#​826)
• (http) add Origin header validation (#​823)
• (router) support runtime disabling of tools (#​809)
• optional session store (resumabillity support) (#​775)

Fixed

• add init_timeout for streamable-http sessions (#​811)
• (http) fall back to :authority for HTTP/2 (#​827)
• (docs) use correct Parameters syntax in tool examples (#​814)

Other

• add systemprompt-template to Built with rmcp (#​820)

v1.5.0

Compare Source

Added

• (transport) add constructors for non_exhaustive error types (#​806)
• add 2025-11-25 protocol version support (#​802)

Fixed

• treat resource metadata JSON parse failure as soft error (#​810)
• include http_request_id in request-wise priming event IDs (#​799)
• (http) drain SSE stream for connection reuse (#​790)

Other

• (deps) update which requirement from 7 to 8 (#​807)

v1.4.0

Compare Source

Added

• add Default and constructors to ServerSseMessage (#​794)
• add meta to elicitation results (#​792)
• (macros) auto-generate get_info and default router (#​785)
• (transport) add which_command for cross-platform executable resolution (#​774)
• (auth) add StoredCredentials::new() constructor (#​778)

Fixed

• (server) remove initialized notification gate to support Streamable HTTP (#​788)
• default session keep_alive to 5 minutes (#​780)
• (http) add host check (#​764)
• exclude local feature from docs.rs build (#​782)

Other

• update Rust toolchain to 1.92 (#​797)
• unify IntoCallToolResult Result impls (#​787)

v1.3.0

Compare Source

Added

• (transport) add Unix domain socket client for streamable HTTP (#​749)
• (auth) implement SEP-2207 OIDC-flavored refresh token guidance (#​676)
• add configuration for transparent session re-init (#​760)
• add local feature for !Send tool handler support (#​740)

Fixed

• prevent CallToolResult and GetTaskPayloadResult from shadowing CustomResult in untagged enums (#​771)
• drain in-flight responses on stdin EOF (#​759)
• remove default type param from StreamableHttpService (#​758)
• use cfg-gated Send+Sync supertraits to avoid semver break (#​757)
• (rmcp) surface JSON-RPC error bodies on HTTP 4xx responses (#​748)
• default CallToolResult content to empty vec on missing field (#​752)
• (auth) redact secrets in Debug output for StoredCredentials and StoredAuthorizationState (#​744)

Other

• fix all clippy warnings across workspace (#​746)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
gflow	Ignored	Preview	Jul 2, 2026 5:31pm