da19abc3d6
Align scope selection with the spec chain and stop mutating caller metadata
...
Drop the authorization-server scopes_supported tier from scope selection.
That list is the server's catalog rather than what the resource needs,
so falling back to it could request every scope the server supports
when the protected resource metadata published an empty list. The
chain is now WWW-Authenticate scope, then PRM scopes_supported, then the
caller-configured scope, then omit; an empty published list falls
through instead of pinning an empty scope. AS metadata is still consulted
for whether offline_access may be added.
The provider now works on a copy of the caller's OAuthClientMetadata, so
the flow's scope selection no longer rewrites the caller's model and the
configured-scope snapshot cannot pick up another provider's discovered
scopes when metadata is reused across providers.
2026-07-27 19:46:08 +00:00
218510ee1c
Fall back to the caller-configured scope when the server advertises none
...
The OAuth client's scope-selection step overwrote the scope a caller
set on the provider on every 401, and when the server advertised no
scopes at all it left the token request with no scope. The configured
scope is now the last-resort tier after the WWW-Authenticate challenge
and the server's scopes_supported, matching the TypeScript SDK.
A source that yields no scopes (absent, null, or an empty list) now
falls through to the next tier instead of pinning an empty scope.
2026-07-25 20:47:59 +00:00
e90a66b554
Rename scopes= to scope= on the client-credentials OAuth providers ( #3166 )
2026-07-25 20:23:36 +01:00
0cb920f126
Make CacheConfig() the Client cache default and None the off switch ( #3164 )
2026-07-25 17:50:53 +01:00
837ef904f8
Align with spec #3002 : optional clientInfo, serverInfo in result _meta ( #3143 )
Deploy Docs / deploy-docs (push) Has been cancelled
CI / checks (push) Failing after 24m23s
CI / all-green (push) Has been cancelled
Conformance Tests / server-conformance (push) Has been cancelled
Conformance Tests / client-conformance (push) Has been cancelled
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
2026-07-23 12:00:36 +01:00
2713b53b12
Replace httpx and httpx-sse with httpx2 ( #2972 )
...
CI / checks (push) Failing after 1s
CI / all-green (push) Has been cancelled
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-07-14 17:05:08 +01:00
9bdc03d54e
Add the client-side subscriptions/listen driver ( #3047 )
2026-07-07 14:26:09 +01:00
867bba6263
Share one event loop per test module to stop Windows socketpair churn ( #3070 )
2026-07-07 13:19:04 +01:00
53117cb3a9
Make client-side cancellation work over the 2026 transports ( #3046 )
2026-07-02 19:21:04 +01:00
220d362112
docs: restructure into topical sections and add the four most-asked-for pages ( #3044 )
2026-07-01 21:06:04 +01:00
080f2a869d
Harden the dual-era stream loop's era-lock and rejection semantics ( #3040 )
2026-07-01 17:07:12 +01:00
e50fb5be19
Serve the 2026-07-28 era over stdio and other stream-pair transports ( #3038 )
2026-07-01 00:11:56 +01:00
4df609119f
Add a client extension API ( #3034 )
2026-06-30 21:31:02 +01:00
b15b1d5f07
Add a client-side response cache honoring SEP-2549 caching hints ( #3023 )
2026-06-30 11:31:06 +01:00
c0ecb70e24
Support RFC 8693 token exchange for enterprise IdP flows (SEP-990) ( #2988 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-26 17:57:10 +02:00
ecdf09d44f
Deprecate Server.__init__ handlers for removed capabilities ( #3002 )
2026-06-26 17:51:13 +02:00
08b62308d4
Client auto-resolves InputRequiredResult via existing callbacks (SEP-2322) ( #2998 )
2026-06-26 17:35:23 +02:00
cc596195bb
Switch RFC7523OAuthClientProvider warning to MCPDeprecationWarning ( #2996 )
2026-06-26 15:27:57 +02:00
411a6d3980
Rebuild the docs around tested examples; shrink README.v2.md to a pitch ( #2978 )
2026-06-26 12:49:19 +02:00
587340279e
Conformance burn-down: server-side InputRequiredResult, Mcp-Method/Name validation, x-mcp-header filter (14 scenarios → green) ( #2974 )
CI / checks (push) Failing after 0s
CI / all-green (push) Has been cancelled
2026-06-26 09:51:59 +02:00
0ee7f1b293
Split protocol types into a standalone mcp-types package ( #2973 )
2026-06-25 19:18:38 +02:00
03681ed55e
Client call_tool: input_responses/request_state retry params; InputRequiredResult via allow_input_required ( #2968 )
2026-06-25 17:37:00 +02:00
f226d00d0a
Client-side 2026-07-28 support: .discover()/.adopt() + Client(mode=); request-metadata green ( #2950 )
2026-06-25 16:09:23 +02:00
44ce901ce3
OAuth client: keep refresh_token on non-rotating refresh; restore same-origin issuer binding ( #2946 )
2026-06-22 15:21:52 +01:00
5e013d9c54
OAuth client: harden SEP-2352/SEP-2350 edge cases; fix conformance comment ( #2936 )
2026-06-22 14:45:20 +01:00
2397319a68
Server-side 2026-07-28 stateless support: classifier, driver split, server/discover ( #2928 )
2026-06-21 19:34:17 +01:00
44724284b3
Bind client credentials to their authorization server (SEP-2352) ( #2933 )
2026-06-20 18:47:22 +01:00
3169922492
Move scope step-up test to top-level function ( #2932 )
2026-06-20 18:45:10 +01:00
1331131650
Union previously requested scopes on step-up re-authorization (SEP-2350) ( #2931 )
2026-06-20 18:45:04 +02:00
4573e4ac33
Deprecate roots, sampling, and logging methods per SEP-2577 ( #2926 )
2026-06-20 18:25:41 +02:00
cf41441e44
Send application_type during Dynamic Client Registration (SEP-837) ( #2930 )
2026-06-20 18:19:12 +02:00
48cf4950dc
Validate the iss authorization-response parameter (RFC 9207 / SEP-2468) ( #2921 )
2026-06-20 17:54:18 +02:00
b7a5bffed0
Preserve empty URL paths on OAuth metadata models ( #2925 )
2026-06-20 15:32:03 +00:00
5a3412ddc1
Ignore pre-2026 protocol_version pins at the StreamableHTTP transport ( #2923 )
2026-06-20 17:29:57 +02:00
84bf9bde05
First end-to-end 2026-07-28 stateless tools/call (experimental entry + ClientSession pin) ( #2917 )
2026-06-20 14:55:59 +01:00
65be5a7147
Protocol types for 2026-07-28: superset monolith, committed per-version packages, and wire-method maps ( #2849 )
2026-06-16 17:40:14 +01:00
1012d60004
[v2] ClientSession runs on JSONRPCDispatcher; BaseSession removed ( #2838 )
2026-06-15 14:46:34 +01:00
7267818e44
Fix unknown-method error code and add a protocol version registry ( #2836 )
2026-06-11 16:47:22 +01:00
5d826490b6
[v2] Dispatcher/ServerRunner receive-path swap — replaces BaseSession ( #2710 )
2026-06-09 12:58:47 +01:00
b478bff56d
Remove the unsupported WebSocket transport ( #2785 )
2026-06-08 12:05:27 +01:00
bdc48e98b1
Fix stdio client shutdown bugs and rebuild the stdio test suite ( #2773 )
2026-06-05 16:15:43 +01:00
ed39e73c0b
Run SSE and Unicode transport tests in process instead of over sockets ( #2765 )
2026-06-02 21:46:53 +01:00
3d7b311de0
fix: align Context logging methods with MCP spec data type ( #2366 )
...
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-04-14 21:41:51 +00:00
437d15aa71
SEP-2207: Refresh token guidance ( #2039 )
2026-04-14 11:48:07 +01:00
e6235d1667
Propagate contextvars.Context through anyio streams without modifying SessionMessage ( #2298 )
2026-03-31 12:49:38 -04:00
883d893097
test: rewrite cli.claude config tests to assert JSON output directly ( #2311 )
...
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Felix Weinberger <felixweinberger@users.noreply.github.com >
2026-03-19 15:16:34 +00:00
20dd94632e
feat(client): store InitializeResult as initialize_result ( #2300 )
2026-03-18 17:31:26 +00:00
67201a9bbd
test: fix WS test port race; narrow to single smoke test covering both transport ends ( #2267 )
2026-03-18 15:48:30 +00:00
75a80b6f07
refactor: connect-first stream lifecycle for sse and streamable_http ( #2292 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-03-16 23:30:20 +00:00
e1fd62e0f3
fix: close all memory stream ends in client transport cleanup ( #2266 )
2026-03-13 14:43:54 +00:00
Max Isbey