Issues

• [Server] Bind Streamable HTTP sessions to the authenticated principal

  modelcontextprotocol/php-sdk#529 · opened on Oct 5, 2026
  1

• [Server] Validate Host and Origin independently in DnsRebindingProtectionMiddleware

  modelcontextprotocol/php-sdk#522 · opened on Sep 30, 2026
  1

• [Server] Allow tools to return structured content without text content

  modelcontextprotocol/php-sdk#521 · opened on Sep 30, 2026

• [Client] Support cancellation and per-call deadlines in Client::callTool()

  modelcontextprotocol/php-sdk#517 · opened on Sep 28, 2026

• [Server] Allow a RequestEvent listener to reject a request with a JSON-RPC error

  modelcontextprotocol/php-sdk#513 · opened on Sep 23, 2026
  2

• [Server] Decode JSON-RPC objects as stdClass, not associative arrays

  modelcontextprotocol/php-sdk#510 · opened on Sep 14, 2026
  1

• [Client] HttpTransport resumes an Amp-suspended Fiber with a JSON-RPC error

  modelcontextprotocol/php-sdk#504 · opened on Sep 9, 2026

• [Server][Capability] Element sources should return values, and RegistryInterface should be sliced by role

  modelcontextprotocol/php-sdk#495 · opened on Sep 3, 2026

• Slicing the SDK into Multiple Packages

  modelcontextprotocol/php-sdk#489 · opened on Aug 29, 2026 · 1.0
  3

• One placeholder-less resource template makes the whole server unserviceable

  modelcontextprotocol/php-sdk#476 · opened on Aug 23, 2026
  3

• [Server] McpResourceTemplate throws 500 error when uriTemplate variable is undefined

  modelcontextprotocol/php-sdk#469 · opened on Aug 21, 2026
  2

• [Server] Handler type uses bare Closure, hard to decorate RegistryInterface under strict PHPStan

  modelcontextprotocol/php-sdk#468 · opened on Aug 20, 2026
  2

• StreamableHttpTransport returns a JSON array in the response body when parallel POST requests arrive concurrently (PHP-FPM)

  modelcontextprotocol/php-sdk#467 · opened on Aug 20, 2026
  1

• Builder::build() silently skips configured file-based discovery when symfony/finder is missing — should fail loudly

  modelcontextprotocol/php-sdk#398 · opened on Jul 17, 2026

• [Client][Auth] SEP-2351: Use RFC 8414 well-known URI suffix for AS metadata discovery

  modelcontextprotocol/php-sdk#377 · opened on Jun 6, 2026

• [Client][Auth] SEP-837: Specify OIDC application_type during Dynamic Client Registration

  modelcontextprotocol/php-sdk#376 · opened on Jun 6, 2026

• [Schema] No support for additonalProperties in tool input schema

  modelcontextprotocol/php-sdk#370 · opened on May 31, 2026

• [Conformance] SEP-2484: Wire SEP traceability files into conformance test runner; surface per-SEP pass rates

  modelcontextprotocol/php-sdk#367 · opened on May 26, 2026
  2

• [Client][Auth] SEP-2207: Request offline_access scope against OIDC-flavored AS for refresh tokens

  modelcontextprotocol/php-sdk#363 · opened on May 26, 2026

• [Client][Auth] SEP-2352: Key DCR registrations and tokens by AS issuer; reject cross-AS credential reuse

  modelcontextprotocol/php-sdk#361 · opened on May 26, 2026

• [Client][Auth] SEP-2468: Validate iss parameter in authorization response (RFC 9207)

  modelcontextprotocol/php-sdk#360 · opened on May 26, 2026

• [Schema] SEP-2106: Harden SchemaValidator against external $ref SSRF and composition DoS

  modelcontextprotocol/php-sdk#358 · opened on May 26, 2026

• [Schema] SEP-2106: Support JSON Schema 2020-12 vocabulary in SchemaGenerator (oneOf/anyOf/allOf/if-then-else/$ref)

  modelcontextprotocol/php-sdk#356 · opened on May 26, 2026

• [Client] SEP-2663 Tasks: Poll task handles and answer inputRequests

  modelcontextprotocol/php-sdk#349 · opened on May 26, 2026

• [Server] SEP-2663 Tasks: Handlers return task handles; the application advances the task

  modelcontextprotocol/php-sdk#348 · opened on May 26, 2026