Skip to content

[Server] SEP-2663 Tasks: TaskStoreInterface with InMemory default and DoS limits #347

@chr-hertel

Description

@chr-hertel

Implements the task persistence layer for SEP-2663 for the MCP Spec 2026-07-28 release.

Tracked by umbrella #335.

PHP SDK changes

  • New TaskStoreInterface for persisting task state across requests, mirroring the SessionStoreInterface pattern.
  • Default InMemoryTaskStore with eviction limits (mirror InMemorySessionStore's maxSessions: 1000 DoS protection — see CLAUDE.md session security notes).
  • FileTaskStore and Psr16TaskStore (PSR-16 cache-backed) following the existing session store ergonomics.
  • Wire into Server::builder()->setTaskStore(...).
  • Garbage-collection hooks (deterministic GC every N requests, configurable threshold like sessions).

Notes

  • Single store interface should cover both server-side task state and the queued server→client requests destined for tasks/update responses.

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    2026-07-28All issues and PRs related to the spec release 2026-07-28P0Broken core functionality, security issues, critical missing featureServerIssues & PRs related to the Server componentenhancementRequest for a new feature that's not currently supportedimproves spec complianceImproves consistency with other SDKs such as TyepScriptneeds designValid issue but needs maintainer alignment on design or approach

    Type

    No type
    No fields configured for issues without a type.

    Projects

    Status
    Todo

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions