[dependabot]

Bumps mcp from 1.8.2 to 1.9.0.

Release notes

Sourced from mcp's releases.

v1.9.0

This release adds the Skills extension (SEP-2640): a server publishes Agent Skills from a directory or a handler, and the client lists, reads and verifies them against the manifest digests. It also keeps a tool's _meta and other members on the client, stops the output schema default from overriding a root $dynamicRef, and answers request headers and _meta values the server could not read with a client error instead of failing. The Changed entry alters an answer on the wire under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md.

Added

• Add the Skills extension (SEP-2640) (#635)

Changed

• Refuse a _meta that is not an object as invalid params (#651)

Fixed

• Skip the reaper join when close runs on the reaper thread (#637)
• Parse request headers as bytes so invalid UTF-8 cannot raise (#639)
• Keep a tool's _meta, title, icons, and execution on the client (#641)
• Refuse a skill URI that is not valid UTF-8 and escape the echoed strings (#646)
• Recognize a root $dynamicRef when defaulting an output schema to an object (#649)
• Handle a _meta that is not an object without raising (#650)

Changelog

Sourced from mcp's changelog.

[1.9.0] - 2026-11-03

This release adds the Skills extension (SEP-2640): a server publishes Agent Skills from a directory or a handler, and the client lists, reads and verifies them against the manifest digests. It also keeps a tool's _meta and other members on the client, stops the output schema default from overriding a root $dynamicRef, and answers request headers and _meta values the server could not read with a client error instead of failing. The Changed entry alters an answer on the wire under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md.

Added

• Add the Skills extension (SEP-2640) (#635)

Changed

• Refuse a _meta that is not an object as invalid params (#651)

Fixed

• Skip the reaper join when close runs on the reaper thread (#637)
• Parse request headers as bytes so invalid UTF-8 cannot raise (#639)
• Keep a tool's _meta, title, icons, and execution on the client (#641)
• Refuse a skill URI that is not valid UTF-8 and escape the echoed strings (#646)
• Recognize a root $dynamicRef when defaulting an output schema to an object (#649)
• Handle a _meta that is not an object without raising (#650)

Commits

• 2cd02af Merge pull request #653 from koic/release_1_9_0
• 8115b37 Release 1.9.0
• 69c08b6 Merge pull request #652 from koic/run_every_referee_scenario_in_the_server_co...
• aeb871e Merge pull request #651 from koic/refuse_a_meta_that_is_not_an_object_as_inva...
• 1ab5242 Run every referee scenario in the server conformance leg
• 7b00aec Refuse a _meta that is not an object as invalid params
• 51db52a Merge pull request #650 from emirn/fix-non-object-meta
• 35a8df2 Merge pull request #646 from koic/refuse_a_skill_uri_that_is_not_valid_utf_8_...
• 8f6a206 Merge pull request #649 from koic/recognize_a_root_dynamic_ref_when_defaultin...
• 96b50f2 Handle a _meta that is not an object without raising
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Updates mcp (Ruby SDK) from 1.8.2 to 1.9.0 in the docs. This release adds the Skills extension and several fixes for _meta handling, header parsing, and output schema defaults.

^{Written for commit 8b4cfa2. Summary will update on new commits.}