This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryAdded draft extensions capability, handler-driven initialize response, and icons plural migration.
Full changelog
[3.0.12] - 2026-04-13
Added
-
Draft
extensionscapability — BothClientCapabilitiesandServerCapabilitiesnow carry an optionalextensions: HashMap<String, Value>map for opt-in key/value capability settings, available acrossturbomcp-types,turbomcp-core, andturbomcp-protocol. New builder helpers (with_extensions,add_extension) plus acompletionsserver capability round out the stable 2025-11-25 shape.CapabilityMatchertreats extensions as mutually opt-in: negotiation requires both sides to declare an extension and silently disables mismatches rather than failing the session. -
Handler-driven
initializeresponse — NewMcpHandler::server_capabilities()trait method with a default that derives tools/resources/prompts from existing listings, letting handlers override to advertise tasks, logging, completions, or draft extensions without forking the router.build_initialize_resultnow serializes the handler's fullServerCapabilitiesandServerInfoviaserde_json::to_value, sodescription,title,websiteUrl, andiconssurvive the initialize response instead of being silently dropped. -
Client::initialize_with_request()— New entry point that accepts a caller-builtInitializeRequest, giving applications a stable way to opt into draft protocol versions or explicit capability shapes. The ergonomicClient::initialize()default path and auto-connect logic now share the same implementation. -
RequiredCapabilities/ClientCapabilitiesextensions field (turbomcp-server::config) — Newextensions: HashSet<String>field with builder, validation, andfrom_paramsparsing, letting deployments require specific draft extensions from clients. -
MCP 2025-11-25 icons plural migration in
turbomcp-core(SEP-973) — Replacesicon: Option<Icon>withicons: Option<Vec<Icon>>onImplementation,Tool,Resource,ResourceTemplate, andPrompt. Addsdescriptionandwebsite_urltoImplementationwith builder helpers.turbomcp-typesandturbomcp-protocolalready carried the plural shape; this catchesturbomcp-core's parallel types and every literal constructor acrossturbomcp-grpcandturbomcp-wasmup to the spec. -
gRPC capability + metadata parity —
mcp.protogainsEmptyCapability, elicitation, client/server task capability trees,CompletionCapability, andExtensionsCapabilitiesmessages, wired intoClientCapabilitiesandServerCapabilities.repeated Icon iconsreplaces singularicononImplementation,Tool,Resource,ResourceTemplate, andPrompt, with newtitle,description,website_url, andsizefields per spec.convert.rsbidirectional conversions preserve extensions, elicitation, tasks, completions, and experimental capabilities via newencode_json_map/decode_json_map/empty_capability_from_maphelpers, covered by round-trip tests forImplementationmetadata and extensions + task tools.
Changed
- Version adapters strip draft
extensions—V2025_11_25AdapterandV2025_06_18Adapternow strip the draftextensionsfield fromfilter_capabilitiesand frominitializeresults;DraftAdapterpasses it through. Regression tests cover both stripping and draft passthrough.
Fixed
-
wasm-serverfeature compiles again — Thewasm-server-gated filesturbomcp-wasm/src/wasm_server/server.rsandcomposite.rscarried two latent build breaks introduced during the icons + extensions work (they are skipped by defaultcargo check --workspace --all-targets). Removes spuriouswebsite_url: Nonefrom eightTool/Resource/ResourceTemplate/Promptliterals (onlyImplementationcarrieswebsite_url), and addscompletions: None+extensions: Noneto the twoServerCapabilitiesconstructors to match the new core shape. Verified withcargo check,cargo clippy -- -D warnings, andcargo test --lib -p turbomcp-wasm --features wasm-server(119 tests passing). -
Stdio backend spawn tests no longer depend on Python (
turbomcp-proxy) — Tests hardcodedpython server.py/python -c '...', which fail on systems where onlypython3is onPATH(current macOS default) and race becausepython -cexits beforewait_for_readycan observe a running child. Replaced with/bin/cat, gated#[cfg(unix)]since Windows handles subprocess spawning differently. -
Workspace internal dep versions unified at 3.0.11 —
turbomcp-macros,turbomcp-proxy,turbomcp-server, andturbomcp-telemetrystill pinned internal deps to the stale 3.0.7 version while the rest of the tree had moved on. Switched toworkspace = trueso they inherit the workspace-declared version in one place;turbomcp's remaining explicit path deps (which must keepdefault-features = false) bumped to match.
Full Changelog: https://github.com/Epistates/turbomcp/compare/v3.0.11...v3.0.12
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]