MCP SDK for Java 2.0

Last reviewed Oct 28, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 25113 lines · 2.8K tokens
  2. MCP SDK for Java 2.067 lines · 3.6K tokens
Total180 lines · 6.4K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 295
  • 297
  • 306
  • 323
  • 327
  • 338
  • 346
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 488
  • 494
  • 502
  • 532
  • 598
  • 611
  • 613
  • 639
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 838
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333
  • 1426
  • 1427

Prompt Preview

Apply the Java 25 prompt first. These rules cover MCP Java SDK 2.0 on Java 25 and were checked against 2.0.1; the SDK itself targets Java 17 or later.

Version and components

  • Import io.modelcontextprotocol.sdk:mcp-bom and resolve every SDK module through it, then confirm in the dependency tree that the resolved mcp-core matches the BOM; all SDK modules share one version and ship together. Review dependency overrides instead of copying older BOM versions from examples. Read the SDK repository's security advisories page and release notes for the release you resolve rather than waiting for a scanner: the SDK has published advisories only there, with no CVE and no GitHub Advisory Database entry.
  • Choose mcp for the Jackson 3 bundle, or mcp-core with mcp-json-jackson2 for Jackson 2. Configure the intended mapper and schema validator explicitly when multiple providers are present; McpJsonDefaults otherwise caches the first discovered provider. Spring WebMVC/WebFlux transports and security integrations belong to Spring AI 2.0+, whose configuration requires separate review.
  • Negotiate only versions supported by the selected transport, through 2025-11-25 in this SDK. Legacy HTTP SSE supports 2024-11-05; prefer Streamable HTTP for new deployments. Check negotiated capabilities before using sampling, elicitation, roots, or subscriptions.

Authentication and OAuth

  • Authenticate every protected HTTP request before body processing and MCP dispatch, including GET event streams, POST messages, DELETE session termination, and both legacy SSE endpoints. Install