Published on September 15, 2026, Laravel MCP 1.0 is the first stable version of Laravel's package for creating Model Context Protocol servers. These servers allow AI applications to use tools and data from Laravel applications.

<?php
use App\Mcp\Tools\CurrentWeatherTool;
use App\Mcp\Tools\HistoricalWeatherTool;
use App\Mcp\Tools\WeatherAlertsTool;
use Laravel\Mcp\Server;
use Laravel\Mcp\Server\Tools\ToolSearch;

class WeatherServer extends Server
{
    protected array $tools = [
        CurrentWeatherTool::class,
        ToolSearch::class => [
            HistoricalWeatherTool::class,
            WeatherAlertsTool::class,
        ],
    ];
}

The release targets MCP 2026-07-28. Discovery now uses server/discover, and the protocol adds searchable tool catalogs, cache hints, stateless request handling, OAuth changes, and MCP Apps in the extensions capability. Clients that still use initialize remain compatible. The server answers with protocol version 2025-11-25 or 2025-06-18 according to the version requested by the client.

ToolSearch keeps selected tools outside the default catalog. The search_tools tool accepts a query and a result limit, then returns matching tool names, descriptions, and expected inputs. execute_tools runs one or more tools by name. Agents can therefore find and call tools without loading the complete catalog. This work is tracked in pull request #324.

The Cacheable attribute defines default cache instructions, while cacheHints() can set them for individual methods. The release includes examples with ttlMs values of 60_000 and 30_000, plus the public CacheScope::Public scope. Laravel's MCP client follows these instructions when caching is enabled through withCache(). Responses with a missing or zero ttlMs are not cached. Tool calls cannot be cached. The related pull requests are #301 and #326.

Servers are stateless under the new protocol. Each HTTP request and standard input/output message carries the protocol version and supported features in params._meta. MCP-Session-Id, Request::sessionId(), Request::setSessionId(), and the SessionInitialized event have been removed. Applications that need to connect related calls must provide their own identifier in request arguments or _meta. The change is covered by pull request #285.

OAuth authorization now requires PKCE. OAuthClient::redirect() throws OAuthException when the authorization server omits code_challenge_methods_supported from its metadata. Earlier behavior rejected servers when that field was present without S256 support. Laravel MCP also supports Client ID Metadata Documents, where client_id is an HTTPS URL pointing to a JSON description of the client. Mcp::oAuthRoutesFor() serves that document at GET /mcp/oauth/{client}/client-metadata.json.

When no client ID is supplied, Laravel uses the metadata document when the authorization server supports it. Dynamic Client Registration remains the fallback, although MCP 2026-07-28 deprecates that mechanism. A metadata document leaves $token->clientSecret null, so the corresponding database column must allow null values. The change also prevents redirect() from registering a new client on every call. Pull requests #323 and #342 cover this work.

Upgrading from 0.9 requires checking client connections and request construction. ValidateMcpHeaders now runs on every route registered through Mcp::web(). POST requests using the new protocol must include MCP-Protocol-Version and Mcp-Method headers that agree with the body. tools/call, prompts/get, and resources/read also require Mcp-Name, which must match the tool name, prompt name, or resource URI.

Tests using postJson() need the same headers and params._meta fields. A mismatch produces HTTP 400 with JSON-RPC error code -32020. Older initialize clients without protocol metadata in _meta are exempt from this validation. The 1.0 upgrade guide also lists error code changes, the removed Server::CAPABILITY_UI constant, and the custom transport contract. Release notes and the full changelog accompany the package release.