MCP SDK for Java 0.18

Last reviewed Oct 28, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 17109 lines · 4.4K tokens
  2. MCP SDK for Java 0.1882 lines · 4.3K tokens
Total191 lines · 8.7K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 90
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 306
  • 319
  • 323
  • 327
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 378
  • 427
  • 459
  • 470
  • 471
  • 488
  • 494
  • 502
  • 532
  • 598
  • 611
  • 613
  • 639
  • 653
  • 732
  • 770
  • 772
  • 776
  • 807
  • 829
  • 862
  • 863
  • 916
  • 918
  • 922
  • 942
  • 1427

Prompt Preview

Apply the Java 17 prompt first. These rules cover the stdio, JDK HTTP, Servlet, Spring WebFlux, and Spring WebMVC transports of MCP SDK for Java 0.18, the legacy release line associated with MCP 2025-06-18, and were checked against 0.18.4, which requires Java 17 or later.

Fix the version and protocol scope

  • Import io.modelcontextprotocol.sdk:mcp-bom and resolve every MCP artifact through it; all SDK modules share one version and ship together. Fail the build on mixed MCP modules, including an accidental 1.x or 2.x transitive artifact.
  • Select the JSON integration deliberately: the 0.18.4 mcp convenience artifact pulls in Jackson 2. When using mcp-core with mcp-json-jackson3, set the latter's version explicitly to match mcp-core, because this BOM omits it; do not copy later-version dependency examples unchanged.
  • Treat 0.18.x as a security-patches-only compatibility line and plan migration to a maintained stable SDK; fixes for it ship only as new 0.18 patch releases. Don't wait for a dependency scanner to tell you a 0.18 release needs one: the SDK has published advisories only on its repository's security page, with no CVE and no GitHub Advisory Database entry, so read that page and the release notes for the release you resolve. Keep the request-size, response-size, and CORS rules below on every release, and recheck transport and JSON behavior during migration.
  • Limit negotiation to implemented, tested revisions. For a June 2025 JDK Streamable HTTP client, set supportedProtocolVersions(List.of(ProtocolVersions.MCP_2025_06_18)) and enforce the same