Laravel MCP 1.0 enforces headers and removes session state
Laravel MCP 1.0 can reject unchanged 0.9 clients with HTTP 400 and JSON-RPC -32020 when required protocol headers do not match.
The migration removes session APIs, moves context into request data, and makes PKCE mandatory for OAuth. Legacy protocol negotiation remains available, while searchable tool catalogs and cache hints require deliberate server design.
An unchanged laravel/mcp 0.9 setup can begin returning HTTP 400 after a Composer update. In 1.0, every POST must carry matching `MCP-Protocol-Version` and `Mcp-Method` headers. Requests such as `tools/call` also require `Mcp-Name`. Failures use JSON-RPC code `-32020`, even when the application code and tool classes have not changed.
grep -rn "sessionId()\|setSessionId(\|SessionInitialized" app/The release adopts MCP revision 2026-07-28 and replaces the `initialize` handshake with `server/discover`. Requests no longer use server-side sessions. Each HTTP request and stdio message carries the protocol version and client capabilities through `params._meta`. The `sessionId()`, `setSessionId($id)`, and `SessionInitialized` APIs are gone. Applications must pass context explicitly through tool arguments or `_meta`, for example with a `correlation_id`. This supports horizontal scaling without sticky sessions or a shared session store.
Older clients still have a compatibility path. An `initialize` request using protocol revisions `2025-06-18` or `2025-11-25` can negotiate as before, so servers consumed by external agents need tests for both protocol eras.
Tool discovery also changes. Agents can use `search_tools` and `execute_tools` instead of receiving every tool schema at connection time. A server can still declare tools such as `SearchOrders` and `GetCustomer` in its `tools` array. The Statamic MCP server now exposes three tools on connection and keeps eight behind search. Cache hints can mark responses as reusable, provide a lifetime, and define their privacy scope. The Laravel MCP client honors these hints when consuming another server.
OAuth integration now requires PKCE. When an authorization server does not advertise `code_challenge_methods_supported`, `redirect()` fails before sending the user to the authorization endpoint. Client ID Metadata Documents are the preferred registration mechanism. Dynamic Client Registration remains available but is deprecated under MCP 2026-07-28.
The upgrade guide should be read before changing the package. Teams need to locate removed session symbols, move context into explicit identifiers, audit third-party OAuth metadata, choose which tools belong in the connection-time catalog, and test both protocol eras. Treating the change as a routine Composer update can leave every `tools/call` request failing with `-32020`.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.