Roadmap - ChristianPresley/zig-sdk GitHub Wiki
Roadmap
This page lists the milestones of the SDK and their state. The plan follows the approved implementation plan of the project. The plan gives no dates. The sections Items of release 0.4.0, Items of release 0.5.0 and Items of release 0.5.1 list the work after the milestones.
Applies to: zig-sdk 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0 and 0.5.1.
Milestones
| Milestone | Scope | State |
|---|---|---|
| M0 Skeleton and process | Build system, CI, policies, dictionary, linter, fixtures, wiki skeleton | Done |
| M1 Core and stdio server | Protocol types, JSON-RPC layer, server engine, stdio server | Done |
| M2 Streamable HTTP server and schema | HTTP server, header mirroring, SSE, JSON Schema validator, conformance server | Done |
| M3 TLS server | TLS 1.3 server, HTTPS, PEM and DER, interop tests | Done |
| M4 Client | Client core, multi round-trip driver, stdio and HTTP clients, conformance client | Done |
| M5 Authorization | OAuth 2.1 client and resource server helpers | Done |
| M6 Templates, hardening, v0.1.0 | Threat model page, nightly workflow, release workflow, consumer example, wiki pages, benchmarks, fuzz targets | Done. M11 added the requirement matrix. |
| M7 Tasks extension | The Tasks extension in the server (tasks option, task_support per tool) and in the client (awaitTask) |
Done |
| M8 TLS client | TLS 1.3 client with ALPN and client certificates, certificate chain verification, the HTTP client on the SDK connection | Done |
| M9 gRPC | Protobuf, HTTP/2, HPACK, the gRPC binding | Done |
| M10 Documentation and STE completion | Full dictionary, strict linter, all wiki pages | Done |
| M11 Open and later items | The items in the next table | Done |
| M12 The later items of the plan | The items of the table Items of milestone M12 | Done, except the external review of the TLS code |
Items of milestone M11
| Item | State | Page |
|---|---|---|
| Icon rules in the client | Done | Client Guide |
| RSA certificates and RSA-PSS signatures in the TLS server | Done. The TLS client can also use an RSA client certificate. | TLS and Certificates |
Post-quantum key exchange (X25519MLKEM768) in the TLS client and server |
Done. It is the first group of the default order. | TLS and Certificates |
A regular expression engine for the pattern keyword |
Done. The validator also supports all other keywords of JSON Schema 2020-12. | JSON Schema Support |
| A Unix socket transport with the stdio framing | Done | Transport Unix Socket |
| Other extensions of the specification | Done: OAuth client credentials, enterprise-managed authorization, Skills and MCP Apps | Authorization, Skills Extension, Apps Extension |
| A requirement matrix that maps every normative sentence of the specification to a test | Done. Each of the 733 sentences has tests or a reason. No sentence has the state "gap". | Conformance |
| A GitHub Pages deployment of the API documentation | Done. The workflow docs.yml deploys the site from main. |
API Reference |
Open items
| Item | State |
|---|---|
| A release of the work of milestones M10 to M12 | Done. Release 0.2.0 has it. See Release Notes. |
The fuzz job of the nightly workflow |
Done in pull request 7. On Zig 0.16.0 the fuzz path of the test runner of the toolchain does not compile, and the self-hosted backend emits no coverage table. The option -Dfuzz corrects both, and the job fuzzes with coverage. The first fuzz runs found a use of freed memory in the HPACK decoder and integer overflows in two TLS parsers. The same pull request corrects these defects. |
| The protection of the Unix socket on Windows | Done in pull request 8. The socket file has an access control list that allows access only to the user of the process. |
| The directory check and the protected move of the Unix socket | Done in pull request 9. The server refuses a directory where other accounts can add, delete or rename entries. It moves the socket to its path after it applies the protection. |
The limits that release 0.2.0 declares but does not apply: http.head_timeout, http.idle_timeout, http.listen_ack_timeout, json_max_depth, max_filter_bytes, cancel_notify_timeout and max_step_up_attempts |
Done in pull request 21, release 0.3.0. The HTTP server has time limits for the head, the body and an idle connection. The servers check the JSON depth. The client has a time limit for the acknowledgment of a listen stream. The release removes cancel_notify_timeout and max_step_up_attempts. See Limits and Security. |
Items of milestone M12
Milestone M12 has the items that the plan of the project calls "later", and the two draft authorization extensions that were not in scope before.
| Item | State | Page |
|---|---|---|
| DPoP-bound tokens (RFC 9449) in the clients and the resource server | Done in pull request 10. The conformance scenarios auth/dpop and auth/dpop-nonce pass. |
Authorization |
| Workload identity federation in the client, and the validation of workload JWTs | Done in pull request 10. The conformance scenario auth/wif-jwt-bearer passes. |
Authorization |
| The CI runs each scenario that the conformance suite does not score, with a baseline for each check | Done in pull request 10 | Conformance |
The cipher suites TLS_AEGIS_128L_SHA256 and TLS_AEGIS_256_SHA512 as an option in the TLS client and server |
Done in pull request 12. The suites are off by default. | TLS and Certificates |
| Record padding in the TLS client and server | Done in pull request 12 | TLS and Certificates |
The certificate_authorities extension in the TLS client and server |
Done in pull request 13 | TLS and Certificates |
| Certificate revocation and name constraints in the TLS client | Done in pull request 13. The SDK checks CRLs from the application and OCSP staples. It does not fetch revocation data from the network. The server also checks client certificates. | TLS and Certificates |
Signatures with RSA-PSS keys (id-RSASSA-PSS) |
Done in pull request 13 | TLS and Certificates |
| A security review of the TLS code | The project did the internal review in pull request 17. The file docs/security/tls-review.md has its findings and their fixes. An external review is open: it needs an independent third party, and the project cannot do it itself. |
Threat Model |
| A gRPC binding with the typed messages of the Google Cloud proto files | Done in pull request 18. The server serves the typed service next to the tunnel. The messages cannot carry some parts of MCP, see the gaps on the page. | Transport gRPC |
A custom transport on RFC 6455 connections (WebSocket) |
Done in pull request 14 | Transport WebSocket |
| Rate limits per principal for tools and logging | Done in pull request 11. The limits are off by default. | Limits and Security |
| An authorization server | Done in pull request 15. The conformance scenarios authorization-server-metadata-endpoint and authorization-code-grant pass. |
Authorization Server |
| Token storage in the keychain of the host | Done in pull request 16. The OAuth client also refreshes its tokens. The keychain is the Credential Manager on Windows, Keychain Services on macOS and the Secret Service on Linux. | Authorization |
Items of release 0.4.0
Most items of pull requests 23 to 25 come from the plan of the vscode bridge of zig-bridge-sdk, which uses mcp.Client for a 2025-11-25 client. Pull requests 27 to 30 add fixes for the HTTP/2 connection of the gRPC transport and for the tests.
| Item | State | Page |
|---|---|---|
The log level and more _meta entries for one request (RequestOptions.log_level and RequestOptions.meta) |
Done in pull request 23 | Client Guide |
| The parameters of a notification in scratch memory for one frame | Done in pull request 23. A long listen stream does not make the request arena larger. The parameters are valid only during the callback. | Client Guide |
Notifications in the order of arrival (RequestOptions.inline_notifications) |
Done in pull request 23, for the stdio, Unix socket and WebSocket transports | Client Guide |
| The notification callback of the stdio client as a spawn option | Done in pull request 23 | Transport stdio |
| The acknowledgment of a listen stream before the first event | Done in pull request 24, on all transports | Server Guide |
| A size limit for each SSE event, and not for the whole stream | Done in pull request 24 | Transport Streamable HTTP |
| Failure reports: a frame that the router cannot read, the HTTP status of a response and the exit status of a stdio server | Done in pull request 24. Diagnostics.http_status and stdio.Client.exitStatus give the status. |
Client Guide |
| A CA bundle for the OAuth client, and the reload of the stored token record | Done in pull request 25 | Authorization |
| HTTP proxies for the HTTP client transport and the OAuth client | Done in pull request 25. The module transport.proxy reads the proxy from the environment that the application gives. |
Client Guide |
| The response that a gRPC server sends before it reads the request | Done in pull request 25 | Transport gRPC |
| HTTP/2 stream waits that a lost cancel cannot block, the lock order of a reset, and no headers after a cancel | Done in pull request 27 | Transport gRPC |
| Refused peer streams that the connection frees, and the HPACK table after a size error | Done in pull request 28 | Transport gRPC |
Loopback connect and listen with more tries, for the tests on Windows (util.loopback) |
Done in pull request 29 | Release Notes |
| A header block on a peer stream that the connection reset | Done in pull request 30. The connection ignores the block for the last 64 streams that it reset. | Transport gRPC |
| Release 0.4.0 | Done. Pull request 26 has the release commit. Pull request 31 moves the items of pull requests 27 to 30 into the release. The tag v0.4.0 is on commit 8334b15. |
Release Notes |
Items of release 0.5.0
Pull requests 32 to 34 add time limits for the keychain storage on Linux and fixes for Unix sockets on Windows.
| Item | State | Page |
|---|---|---|
Time limits for each wait of the D-Bus client and the Secret Service backend (timeout and prompt_timeout) |
Done in pull request 33 | Authorization |
| A connect to an abstract D-Bus address that does not block | Done in pull request 33 | Authorization |
| The close of the peer on a Unix socket of Windows, also when the driver loses it | Done in pull request 34. Each read first waits in a poll of the socket. | Transport Unix Socket |
| The fake D-Bus server of the keychain tests on Windows | Done in pull request 32 | Release Notes |
| Release 0.5.0 | Done. Pull request 35 has the release commit. The tag v0.5.0 is on commit 38c8143. |
Release Notes |
Items of release 0.5.1
Pull requests 36 and 37 fix the stop of the servers after a cancel, and the connect of the wake connection on POSIX systems.
| Item | State | Page |
|---|---|---|
A cancel of serve sets the stop flag of shutdown on the HTTP, gRPC and Unix socket servers |
Done in pull request 37 | Release Notes |
| The accept loops stop before the wake connection on Windows | Done in pull request 37 | Release Notes |
The wake connect of util.wake.wakeIp does not block on POSIX systems |
Done in pull request 36 | Release Notes |
| Release 0.5.1 | Done. Pull request 38 has the release commit 52fc1b8. The tag v0.5.1 is on that commit. |
Release Notes |
Known limits
These limits are not on the roadmap. Each page tells the reason.
- The regular expression engine rejects backreferences, lookaround and most Unicode property escapes. See JSON Schema Support.
- The JSON Schema validator does not fetch remote schemas. See JSON Schema Support.
- The Unix socket server does not check the credentials of the peer. The file mode and the directory control access. See Transport Unix Socket.