Bump mcp-core to ≥ 0.18.0 in BOM — STATELESS rejects elicitation form payload from spec 2025-11-25 clients

[nadadi]

Problem

Spring AI 1.1.x BOM pins mcp-core 0.17.0. That version rejects the elicitation: { form: {} } capability payload sent by MCP clients implementing spec 2025-11-25:

Unrecognized field "form" (class io.modelcontextprotocol.spec.McpSchema$ElicitationCapability), not marked as ignorable

This makes STATELESS Streamable HTTP transport unusable in practice when serving any of: Cursor, Claude Code 2.1.74+, Antigravity (Anthropic Browser), VS Code Copilot, Claude Desktop on recent client builds.

Why this matters

The fix is already upstream — modelcontextprotocol/java-sdk PR 731 landed in mcp-core 0.18.0. Spring AI's BOM hasn't picked it up.

We cannot override the transitive pin from the user side because Spring AI 1.1.4/1.1.5 calls API on io.modelcontextprotocol.json.McpJsonMapper.createDefault() that doesn't exist in 0.18.x — so a manual <dependency> override breaks the build. Verified end-to-end with a clean Maven rebuild.

Spring AI 2.0.0-Mx pulls mcp-core 2.0.0-M2 with the fix, but requires Spring Boot 4.x. Our service runs on Spring Boot 3.5 and the 2.x mcp line dropped mcp-spring-webmvc entirely, so 2.0.0-Mx isn't a workable upgrade path either.

This leaves Spring Boot 3.x users stuck on STREAMABLE, which has its own session-loss problem on horizontally scaled deployments (filed separately as #5983 ).

Steps to reproduce

1. New Spring Boot 3.5 project with spring-ai-starter-mcp-server-webmvc, BOM 1.1.x.
2. Set spring.ai.mcp.server.protocol=STATELESS (where supported) or use the WebFlux equivalent.
3. Connect with any of: Cursor, Claude Code 2.1.74+, Antigravity, VS Code Copilot.
4. Observe Unrecognized field "form" on the initial handshake.

Proposed fix

Bump mcp-core in spring-ai-bom to 0.18.0 (or whichever 0.18.x is current) on the next 1.1.x patch release. Update the calls to McpJsonMapper.createDefault() to use whatever the 0.18.x equivalent is.

Acceptance criteria

• spring-ai-bom 1.1.<next> pulls mcp-core >= 0.18.0.
• STATELESS streamable accepts the elicitation: { form: {} } payload from spec 2025-11-25 clients.
• No regression for STREAMABLE / SSE consumers on Spring Boot 3.x.
• Migration note in the upgrade guide.

Environment

• Spring Boot 3.5.11
• Spring AI 1.1.2 / 1.1.5 (both reproduce)
• mcp-core 0.17.0 (BOM transitive)
• Java 17
• Affected clients: Cursor, Claude Code ≥ 2.1.74, Antigravity, VS Code Copilot

Related

• modelcontextprotocol/java-sdk Improve Vector Store documentation #731 — original fix
• spec 2025-11-25 — elicitation form payload requirement
• WebMvcStreamableServerTransportProvider: expose SessionStore SPI for cloud-native deployments #5983 — SessionStore SPI for STREAMABLE

[hyuNukkk]

Hi @nadadi , Can I contribute to this ？

[sdeleuze]

Hi, this should be already fixed in Spring AI 1.1.6 and 1.0.7.