refactor: accept plain set for ResourceSecurity.exempt_params

Changes the type from frozenset[str] to collections.abc.Set[str] so
users can write exempt_params={"range"} instead of
exempt_params=frozenset({"range"}). The default factory stays
frozenset for immutability.

docs/migration.md

@@ -579,7 +579,7 @@ mcp = MCPServer()
 
 @mcp.resource(
     "git://diff/{+range}",
-    security=ResourceSecurity(exempt_params=frozenset({"range"})),
+    security=ResourceSecurity(exempt_params={"range"}),
 )
 def git_diff(range: str) -> str:
     ...

src/mcp/server/mcpserver/resources/templates.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import inspect
-from collections.abc import Callable, Mapping
+from collections.abc import Callable, Mapping, Set
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Any
 
@@ -36,7 +36,7 @@ class ResourceSecurity:
         # Opt out for a parameter that legitimately contains ..
         @mcp.resource(
             "git://diff/{+range}",
-            security=ResourceSecurity(exempt_params=frozenset({"range"})),
+            security=ResourceSecurity(exempt_params={"range"}),
         )
         def git_diff(range: str) -> str: ...
     """
@@ -47,7 +47,7 @@ class ResourceSecurity:
     reject_absolute_paths: bool = True
     """Reject values that look like absolute filesystem paths."""
 
-    exempt_params: frozenset[str] = field(default_factory=frozenset[str])
+    exempt_params: Set[str] = field(default_factory=frozenset[str])
     """Parameter names to skip all checks for."""
 
     def validate(self, params: Mapping[str, str | list[str]]) -> bool:

tests/server/mcpserver/resources/test_resource_template.py

@@ -55,7 +55,7 @@ def test_matches_allows_dotdot_as_substring():
 
 
 def test_matches_exempt_params_skip_security():
-    policy = ResourceSecurity(exempt_params=frozenset({"range"}))
+    policy = ResourceSecurity(exempt_params={"range"})
     t = _make("git://diff/{+range}", security=policy)
     assert t.matches("git://diff/../foo") == {"range": "../foo"}
 

tests/server/mcpserver/test_server.py

@@ -176,7 +176,7 @@ class TestServer:
 
         @mcp.resource(
             "git://diff/{+range}",
-            security=ResourceSecurity(exempt_params=frozenset({"range"})),
+            security=ResourceSecurity(exempt_params={"range"}),
         )
         def git_diff(range: str) -> str:
             return f"diff:{range}"