fix(mcp): support MCP SDK 0.9 on 4.4 (security advisory on 0.8)

composer.json

@@ -143,7 +143,7 @@
         "jangregor/phpstan-prophecy": "^2.1.11",
         "justinrainbow/json-schema": "^6.5.2",
         "laravel/framework": "^11.0 || ^12.0 || ^13.0",
-        "mcp/sdk": "^0.8",
+        "mcp/sdk": "^0.8 || ^0.9",
         "orchestra/testbench": "^10.9 || ^11.0",
         "phpspec/prophecy-phpunit": "^2.2",
         "phpstan/extension-installer": "^1.1",
@@ -176,7 +176,7 @@
         "symfony/intl": "^7.4 || ^8.0",
         "symfony/json-streamer": "^7.4 || ^8.0",
         "symfony/maker-bundle": "^1.24",
-        "symfony/mcp-bundle": "^0.13",
+        "symfony/mcp-bundle": "^0.13 || ^0.15",
         "symfony/mercure-bundle": "^0.5",
         "symfony/messenger": "^7.4 || ^8.0",
         "symfony/object-mapper": "^7.4 || ^8.0",

src/Laravel/composer.json

@@ -65,7 +65,7 @@
         "phpstan/phpdoc-parser": "^1.29 || ^2.0",
         "phpunit/phpunit": "^11.5 || ^12.2",
         "symfony/http-client": "^7.4 || ^8.0",
-        "symfony/mcp-bundle": "^0.13",
+        "symfony/mcp-bundle": "^0.13 || ^0.15",
         "symfony/object-mapper": "^7.4 || ^8.0"
     },
     "autoload": {

src/Mcp/Capability/Registry/SecureRegistry.php

@@ -103,6 +103,12 @@ public function unregisterPrompt(string $name): void
         $this->inner->unregisterPrompt($name);
     }
 
+    public function publishesListChanges(): bool
+    {
+        // MCP SDK 0.8 does not expose this capability.
+        return method_exists($this->inner, 'publishesListChanges') && $this->inner->publishesListChanges(); // @phpstan-ignore function.alreadyNarrowedType
+    }
+
     public function hasTool(string $name): bool
     {
         $this->load();

src/Mcp/Tests/Capability/Registry/SecureRegistryTest.php

@@ -18,6 +18,7 @@
 use ApiPlatform\Mcp\Capability\Registry\Loader;
 use ApiPlatform\Mcp\Capability\Registry\SecureRegistry;
 use ApiPlatform\Mcp\Security\ElementAccessCheckerInterface;
+use ApiPlatform\Mcp\Tests\Fixtures\ListChangePublishingRegistryInterface;
 use ApiPlatform\Metadata\ApiResource;
 use ApiPlatform\Metadata\McpResource;
 use ApiPlatform\Metadata\McpTool;
@@ -34,6 +35,19 @@
 
 class SecureRegistryTest extends TestCase
 {
+    public function testListChangePublishingCapabilityIsForwarded(): void
+    {
+        $inner = $this->createMock(ListChangePublishingRegistryInterface::class);
+        $inner->expects($this->exactly(2))->method('publishesListChanges')->willReturn(true, false);
+        $loader = $this->createMock(LoaderInterface::class);
+        $loader->expects($this->never())->method('load');
+
+        $registry = new SecureRegistry($inner, $loader);
+
+        $this->assertTrue($registry->publishesListChanges());
+        $this->assertFalse($registry->publishesListChanges());
+    }
+
     public function testToolsAreLoadedIntoTheRegistryOnFirstRead(): void
     {
         $inputSchema = new Schema(Schema::VERSION_JSON_SCHEMA);

src/Mcp/Tests/Fixtures/ListChangePublishingRegistryInterface.php

@@ -0,0 +1,21 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Mcp\Tests\Fixtures;
+
+use Mcp\Capability\RegistryInterface;
+
+interface ListChangePublishingRegistryInterface extends RegistryInterface
+{
+    public function publishesListChanges(): bool;
+}

src/Mcp/composer.json

@@ -31,7 +31,7 @@
         "api-platform/metadata": "^4.4",
         "api-platform/json-schema": "^4.4",
         "api-platform/state": "^4.4",
-        "mcp/sdk": "^0.8",
+        "mcp/sdk": "^0.8 || ^0.9",
         "psr/log": "^1.0 || ^2.0 || ^3.0",
         "symfony/http-foundation": "^7.4 || ^8.0",
         "symfony/object-mapper": "^7.4 || ^8.0",