6b0166f3d1
Split the registration request model from the registered-client record
...
OAuthClientInformationFull, the client's parse of the authorization server's
Dynamic Client Registration response, inherited from OAuthClientMetadata, the
request the client sends. That typed the response as though it had to be a
request this SDK would send. RFC 7591 3.2.1 says otherwise: the server may
reject or replace any requested metadata value, and real servers echo an
application_type outside OIDC Registration's web/native, an explicit null,
an auth method the SDK does not implement, or an empty redirect_uris. Each
raised ValidationError on a 2xx response, after the server had already
provisioned the client, so the registration was discarded and orphaned.
Make the two models siblings over a shared OAuthClientMetadataBase. The
request keeps its strict types, so the SDK still refuses to send an
unregistered application_type. The record accepts what a server may echo:
application_type and token_endpoint_auth_method are str | None (with an
echoed "" read as absent, as the optional URL fields already were),
grant_types is list[str], and redirect_uris may be absent or empty.
client_id is now required, as RFC 7591 3.2.1 makes it in the response.
Whether a substituted value is usable is judged where it matters, not at
parse: an auth method the client cannot apply is reported as an
OAuthRegistrationError when the registration completes, before the record
is stored or any interactive authorization begins, and prepare_token_auth
reports the same for a stored record. The recognized set is derived from
the one TokenEndpointAuthMethod type so the two cannot drift.
The bundled registration endpoint now returns all registered metadata in
its 201 response, building the record from the validated request's dump so
a field can no longer be silently dropped from the echo; it previously
omitted application_type, reporting the default in place of a client's
"web".
2026-07-26 11:03:23 +00:00
11934c90ae
Replace FileResource.is_binary with an encoding field ( #3171 )
2026-07-26 00:58:06 +01:00
814072c94d
Narrow message_handler's parameter to notifications and exceptions ( #3168 )
2026-07-26 00:24:48 +01:00
47bfa85e83
Remove the unused timeout parameter from OAuthClientProvider ( #3165 )
2026-07-26 00:22:15 +01:00
3212591946
Stop advertising MCP_* env vars for MCPServer settings; drop pydantic-settings ( #3170 )
2026-07-25 23:22:27 +01:00
7163d8263f
Remove the deprecated RFC7523OAuthClientProvider ( #3169 )
2026-07-25 22:50:57 +01:00
e90a66b554
Rename scopes= to scope= on the client-credentials OAuth providers ( #3166 )
2026-07-25 20:23:36 +01:00
5dd062d077
Remove Context.client_id ( #3167 )
2026-07-25 19:11:51 +01:00
0cb920f126
Make CacheConfig() the Client cache default and None the off switch ( #3164 )
2026-07-25 17:50:53 +01:00
629ca297d2
Isolate the stdio server's stdin and stdout from handler subprocesses ( #3117 )
2026-07-25 13:05:51 +01:00
00a70148bc
Serve the 2026-07-28 protocol over stdio: decide the era from the opening request ( #3152 )
CI / checks (push) Failing after 1s
Deploy Docs / deploy-docs (push) Has been cancelled
Conformance Tests / server-conformance (push) Has been cancelled
Conformance Tests / client-conformance (push) Has been cancelled
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
CI / all-green (push) Has been cancelled
2026-07-24 13:46:37 +01:00
837ef904f8
Align with spec #3002 : optional clientInfo, serverInfo in result _meta ( #3143 )
Deploy Docs / deploy-docs (push) Has been cancelled
CI / checks (push) Failing after 24m23s
CI / all-green (push) Has been cancelled
Conformance Tests / server-conformance (push) Has been cancelled
Conformance Tests / client-conformance (push) Has been cancelled
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
2026-07-23 12:00:36 +01:00
3a6f2996cd
docs: load media examples from disk instead of inline base64 ( #3108 )
2026-07-16 20:41:05 +01:00
e464f72c12
docs: document Windows stdio subprocess stdin handling ( #3079 )
2026-07-16 11:25:47 +01:00
03aaebd3aa
Add Streamable HTTP request body limits ( #3095 )
2026-07-16 08:33:32 +02:00
2713b53b12
Replace httpx and httpx-sse with httpx2 ( #2972 )
...
CI / checks (push) Failing after 1s
CI / all-green (push) Has been cancelled
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-07-14 17:05:08 +01:00
4fc8882c02
docs: replace MkDocs with Zensical ( #3073 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-07-10 12:48:46 +01:00
9bdc03d54e
Add the client-side subscriptions/listen driver ( #3047 )
2026-07-07 14:26:09 +01:00
d287c9868f
Extend resolver DI to sampling and roots requests ( #3049 )
2026-07-06 18:25:57 +01:00
bf4402725d
docs: restructure the migration guide around topical groups with a navigation layer ( #3058 )
2026-07-02 18:54:21 +01:00
2359b40285
docs: modernize the site theme ( #3057 )
2026-07-02 16:17:33 +01:00
e4d95e0d44
docs: add a "What's new in v2" page ( #3054 )
2026-07-02 15:01:30 +01:00
220d362112
docs: restructure into topical sections and add the four most-asked-for pages ( #3044 )
2026-07-01 21:06:04 +01:00
080f2a869d
Harden the dual-era stream loop's era-lock and rejection semantics ( #3040 )
2026-07-01 17:07:12 +01:00
0da9092037
Point pre-release install pins at 2.0.0b1 ( #3039 )
CI / checks (push) Failing after 0s
CI / all-green (push) Has been cancelled
2026-07-01 00:14:52 +01:00
410cc0db31
Add v2 feedback issue template ( #3037 )
2026-07-01 00:03:11 +01:00
ca10dade2c
Serve subscriptions/listen with a pluggable event bus (SEP-2575) ( #3035 )
2026-06-30 23:01:04 +01:00
48ef569f7e
Validate Mcp-Param-* headers server-side on the 2026-07-28 HTTP path (SEP-2243) ( #3033 )
2026-06-30 21:39:32 +01:00
4df609119f
Add a client extension API ( #3034 )
2026-06-30 21:31:02 +01:00
7322ca56f4
Require integrity protection for MRTR requestState ( #3032 )
2026-06-30 21:30:32 +01:00
b15b1d5f07
Add a client-side response cache honoring SEP-2549 caching hints ( #3023 )
2026-06-30 11:31:06 +01:00
67d7593df1
docs: publish llms.txt and markdown renditions of the docs ( #3024 )
2026-06-30 11:30:55 +01:00
8d0f928e40
Pass InputRequiredResult through the MCPServer prompt and resource pipelines ( #3020 )
2026-06-29 16:50:58 +01:00
8f2c97b769
Consult request_state only for the question a resolver is asking ( #3019 )
2026-06-29 16:44:05 +01:00
533c6a8226
Add cache_hints constructor map for SEP-2549 caching hints ( #3015 )
2026-06-29 14:11:15 +00:00
c85836a081
Drive resolver elicitation over the 2026-07-28 input_required flow ( #2986 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-29 14:39:43 +01:00
24fdd909ac
docs: convert bold cross-references into links, link SEP and RFC mentions ( #3017 )
2026-06-29 11:07:26 +00:00
f664db8952
Add resolver dependency injection for MCPServer tools ( #2969 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-29 11:51:46 +01:00
4b519782f1
Add a pluggable server extension API with MCP Apps ( #3003 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-29 10:58:05 +01:00
3b78f86886
Add docs, tested examples, and a story for SEP-990 identity assertion ( #3004 )
2026-06-26 21:01:46 +02:00
24717cc8eb
feat: RFC 6570 URI templates with operator-aware security ( #2356 )
2026-06-26 20:29:17 +02:00
c0ecb70e24
Support RFC 8693 token exchange for enterprise IdP flows (SEP-990) ( #2988 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-26 17:57:10 +02:00
ecdf09d44f
Deprecate Server.__init__ handlers for removed capabilities ( #3002 )
2026-06-26 17:51:13 +02:00
08b62308d4
Client auto-resolves InputRequiredResult via existing callbacks (SEP-2322) ( #2998 )
2026-06-26 17:35:23 +02:00
b31d95a429
Make OpenTelemetry tracing the single default middleware ( #2995 )
2026-06-26 15:47:37 +02:00
5b2713d40c
Mirror x-mcp-header tool arguments into Mcp-Param-* request headers (SEP-2243) ( #2990 )
2026-06-26 14:36:56 +02:00
3a8da8c0c3
Fix docs/release follow-ups from the mcp-types package split ( #2977 )
2026-06-26 13:16:09 +02:00
411a6d3980
Rebuild the docs around tested examples; shrink README.v2.md to a pitch ( #2978 )
2026-06-26 12:49:19 +02:00
f41a5193f3
Preserve empty issuer/resource paths on AuthSettings ( #2987 )
2026-06-26 11:41:41 +02:00
587340279e
Conformance burn-down: server-side InputRequiredResult, Mcp-Method/Name validation, x-mcp-header filter (14 scenarios → green) ( #2974 )
CI / checks (push) Failing after 0s
CI / all-green (push) Has been cancelled
2026-06-26 09:51:59 +02:00
Max Isbey