Epistates/TurboMCP

[3.1.5] - 2026-05-11

Patch release: Streamable HTTP interoperability hardening for RMCP/Codex
clients, plus dogfood coverage for two-way Rust SDK compatibility.

Added

• AI-friendly server visibility policy — VisibilityLayer now supports
  exact allowed/disabled/hidden rules for tools, resources, resource templates,
  and prompts, plus a strict read-only tool profile. Consumers can load a
  VisibilityConfig from application config to reduce tools/list context
  load, keep niche tools callable but unlisted, and block disabled calls,
  including unlisted dynamic calls, as not found.
• Registry-backed visibility dispatch — visibility authorization now uses a
  cached component registry populated by list responses or lazily on first
  direct use, with explicit refresh/clear hooks for dynamic servers whose
  advertised components change at runtime.
• TurboMCP <-> RMCP Streamable HTTP dogfood interop checks — the dogfood
  benchmark suite now validates RMCP client to TurboMCP HTTP server and TurboMCP
  client to RMCP HTTP server flows, including initialization, tools, resources,
  prompts, and Codex-compatible standalone SSE startup framing.
• RMCP comparison diligence notes — added a focused comparison of
  TurboMCP against the official Rust MCP SDK covering implementation strengths,
  feature gaps, compliance risks, and SOTA follow-ups.

Changed

• Visibility config APIs now use explicit replacement semantics —
  VisibilityConfig and VisibilityLayer expose with_allowed_*,
  with_disabled_*, and with_hidden_* builders for exact-name policy.
  Disabled components are rejected on direct use, hidden components are omitted
  from list responses but remain directly usable, and disabled rules win over
  hidden or allowed rules.
• HTTP clients open SSE only after session establishment — Streamable HTTP
  clients now defer the GET SSE connection until the server has issued an
  Mcp-Session-Id, matching RMCP server expectations for session-scoped
  streams.
• Release-facing metadata now targets 3.1.5 — workspace manifests, internal
  crate dependency pins, lockfile entries, and Cargo-facing demo snippets
  identify the patch release consistently.

Fixed

• Standalone Streamable HTTP SSE startup no longer emits an empty data
  event — TurboMCP server now opens GET streams with an SSE comment and
  reserves data: events for real JSON-RPC messages, avoiding rmcp/Codex
  startup failures on clients that parse empty primers as payloads.
• POST SSE primer events no longer break the TurboMCP HTTP client — empty or
  whitespace-only POST-SSE events are ignored instead of being parsed as
  JSON-RPC payloads.
• Post-initialize Streamable HTTP requests tolerate missing protocol-version
  headers — once a session has negotiated a protocol version, TurboMCP keeps
  using that session version for later requests that omit
  MCP-Protocol-Version, matching tolerant rmcp/Codex startup behavior.
• Hidden-only visibility profiles still advertise operation capabilities —
  hidden-but-callable tools, resources, and prompts no longer disappear from the
  initialize capability surface just because they are omitted from list
  responses, including when visibility layers are wrapped by middleware or
  mounted into composite handlers.
• Visibility clone/build patterns no longer share tag filter mutations —
  cloning a VisibilityLayer before applying global tag filters now behaves
  like exact-name rules: builder mutations on the clone do not mutate the
  original layer's visibility profile.
• Registry-backed dispatch preserves first-listed duplicate metadata —
  malformed handlers that advertise duplicate component identifiers keep the
  previous first-match authorization behavior instead of letting the registry's
  map representation silently prefer the last duplicate.

What's Changed Summary

• Fix/windows unix cfg guards by @ForrestThump in https://github.com/Epistates/turbomcp/pull/13

New Contributors

• @ForrestThump made their first contribution in https://github.com/Epistates/turbomcp/pull/13

Full Changelog: https://github.com/Epistates/turbomcp/compare/v3.1.4...v3.1.5