MCP SDK for Java 1.1

Last reviewed Sep 23, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 17109 lines · 4.4K tokens
  2. MCP SDK for Java 1.190 lines · 4.3K tokens
Total199 lines · 8.7K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 90
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 306
  • 319
  • 323
  • 327
  • 338
  • 340
  • 346
  • 347
  • 354
  • 362
  • 367
  • 378
  • 427
  • 459
  • 470
  • 471
  • 488
  • 494
  • 502
  • 532
  • 598
  • 611
  • 613
  • 639
  • 653
  • 732
  • 770
  • 772
  • 776
  • 807
  • 829
  • 862
  • 863
  • 916
  • 918
  • 922
  • 942
  • 1427

Prompt Preview

Apply the Java 17 prompt first. These rules cover MCP SDK for Java 1.1 clients and servers on its Java 17+ runtime floor, targeting the 2025-06-18 MCP specification, and were checked against 1.1.4.

Release and protocol contract

  • Import io.modelcontextprotocol.sdk:mcp-bom, resolve every MCP module through it, and confirm in the dependency tree that the resolved mcp-core matches the BOM; reject mixed SDK versions in dependency convergence checks. Read the SDK repository's security advisories page for the release you resolve rather than waiting for a scanner: its HTTP request-body and SSE allocation advisories carry no CVE and no GitHub Advisory Database entry. The maxRequestSize and maxResponseSize setters required below don't exist on releases that lack those fixes, so a downgraded build fails to compile.
  • Treat 1.1.x as a security-patches-only line and plan migration to the actively developed 2.x line. Preserve the HTTP read limits and earlier Origin/Host, CORS, and SSE endpoint fixes when customizing transports; do not downgrade modules to regain removed APIs.
  • Restrict protocol negotiation to the application's tested revisions. For this profile, set the Streamable HTTP client's supportedProtocolVersions(List.of("2025-06-18")) and enforce the same policy during server initialization; the transport defaults also advertise 2025-11-25. Do not import later URL-elicitation or other wire features into this contract.
  • Prefer Streamable HTTP for new network deployments. Retain the legacy HTTP+SSE transport only for a documented compatibility requirement and