rmcp 3.3.0 adds enterprise ID-JAG token exchange, and a follow-up PR adds opt-in strict Origin checks

GitHub·medium signalXBlueskyLinkedInCopy link

The MCP Rust SDK's rmcp v3.3.0 (2026-09-10) adds enterprise refresh-token and ID-JAG exchanges, `ServerHandler::negotiate_initialize`, and a macro check that rejects an empty tool_router. PR #1192, merged a day later, adds `enforce_origin_validation()` so servers can reject every present Origin when the allowlist is empty. It also returns the spec-required 403 instead of 400 for malformed or non-UTF-8 Origin headers, tested against the 2025-11-25 and 2026-07-28 conformance suites. Requests without an Origin header still pass.