6b0166f3d1
Split the registration request model from the registered-client record
...
OAuthClientInformationFull, the client's parse of the authorization server's
Dynamic Client Registration response, inherited from OAuthClientMetadata, the
request the client sends. That typed the response as though it had to be a
request this SDK would send. RFC 7591 3.2.1 says otherwise: the server may
reject or replace any requested metadata value, and real servers echo an
application_type outside OIDC Registration's web/native, an explicit null,
an auth method the SDK does not implement, or an empty redirect_uris. Each
raised ValidationError on a 2xx response, after the server had already
provisioned the client, so the registration was discarded and orphaned.
Make the two models siblings over a shared OAuthClientMetadataBase. The
request keeps its strict types, so the SDK still refuses to send an
unregistered application_type. The record accepts what a server may echo:
application_type and token_endpoint_auth_method are str | None (with an
echoed "" read as absent, as the optional URL fields already were),
grant_types is list[str], and redirect_uris may be absent or empty.
client_id is now required, as RFC 7591 3.2.1 makes it in the response.
Whether a substituted value is usable is judged where it matters, not at
parse: an auth method the client cannot apply is reported as an
OAuthRegistrationError when the registration completes, before the record
is stored or any interactive authorization begins, and prepare_token_auth
reports the same for a stored record. The recognized set is derived from
the one TokenEndpointAuthMethod type so the two cannot drift.
The bundled registration endpoint now returns all registered metadata in
its 201 response, building the record from the validated request's dump so
a field can no longer be silently dropped from the echo; it previously
omitted application_type, reporting the default in place of a client's
"web".
2026-07-26 11:03:23 +00:00
814072c94d
Narrow message_handler's parameter to notifications and exceptions ( #3168 )
2026-07-26 00:24:48 +01:00
837ef904f8
Align with spec #3002 : optional clientInfo, serverInfo in result _meta ( #3143 )
Deploy Docs / deploy-docs (push) Has been cancelled
CI / checks (push) Failing after 24m23s
CI / all-green (push) Has been cancelled
Conformance Tests / server-conformance (push) Has been cancelled
Conformance Tests / client-conformance (push) Has been cancelled
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
2026-07-23 12:00:36 +01:00
2713b53b12
Replace httpx and httpx-sse with httpx2 ( #2972 )
...
CI / checks (push) Failing after 1s
CI / all-green (push) Has been cancelled
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-07-14 17:05:08 +01:00
1216c53693
fix: reject trailing newline in tool-name and URI-template varname validation ( #3076 )
...
Python's $ with re.match also matches just before a single trailing newline, so tool-name validation accepted "name\n" and UriTemplate.parse accepted varnames like "foo\n". Switch both checks to re.fullmatch.
Closes #3084
2026-07-10 12:56:54 +00:00
9bdc03d54e
Add the client-side subscriptions/listen driver ( #3047 )
2026-07-07 14:26:09 +01:00
867bba6263
Share one event loop per test module to stop Windows socketpair churn ( #3070 )
2026-07-07 13:19:04 +01:00
d287c9868f
Extend resolver DI to sampling and roots requests ( #3049 )
2026-07-06 18:25:57 +01:00
53117cb3a9
Make client-side cancellation work over the 2026 transports ( #3046 )
2026-07-02 19:21:04 +01:00
080f2a869d
Harden the dual-era stream loop's era-lock and rejection semantics ( #3040 )
2026-07-01 17:07:12 +01:00
48ef569f7e
Validate Mcp-Param-* headers server-side on the 2026-07-28 HTTP path (SEP-2243) ( #3033 )
2026-06-30 21:39:32 +01:00
4df609119f
Add a client extension API ( #3034 )
2026-06-30 21:31:02 +01:00
24717cc8eb
feat: RFC 6570 URI templates with operator-aware security ( #2356 )
2026-06-26 20:29:17 +02:00
b31d95a429
Make OpenTelemetry tracing the single default middleware ( #2995 )
2026-06-26 15:47:37 +02:00
5b2713d40c
Mirror x-mcp-header tool arguments into Mcp-Param-* request headers (SEP-2243) ( #2990 )
2026-06-26 14:36:56 +02:00
3a8da8c0c3
Fix docs/release follow-ups from the mcp-types package split ( #2977 )
2026-06-26 13:16:09 +02:00
9dc8c5f02d
find_invalid_x_mcp_header: never repr a non-string annotation value ( #2989 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-06-26 09:54:28 +00:00
587340279e
Conformance burn-down: server-side InputRequiredResult, Mcp-Method/Name validation, x-mcp-header filter (14 scenarios → green) ( #2974 )
CI / checks (push) Failing after 0s
CI / all-green (push) Has been cancelled
2026-06-26 09:51:59 +02:00
0ee7f1b293
Split protocol types into a standalone mcp-types package ( #2973 )
2026-06-25 19:18:38 +02:00
f226d00d0a
Client-side 2026-07-28 support: .discover()/.adopt() + Client(mode=); request-metadata green ( #2950 )
2026-06-25 16:09:23 +02:00
a527142312
Buffer per-request StreamableHTTP streams to avoid serial-router head-of-line block ( #2934 )
2026-06-22 16:20:45 +01:00
ad81ca234a
Slim ServerMiddleware to (ctx, call_next) and add OpenTelemetryMiddleware ( #2941 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-22 14:46:30 +01:00
2397319a68
Server-side 2026-07-28 stateless support: classifier, driver split, server/discover ( #2928 )
2026-06-21 19:34:17 +01:00
4573e4ac33
Deprecate roots, sampling, and logging methods per SEP-2577 ( #2926 )
2026-06-20 18:25:41 +02:00
734746a3d9
Resolve protocol version per request and expose it as ctx.protocol_version ( #2886 )
2026-06-17 08:46:42 +01:00
1012d60004
[v2] ClientSession runs on JSONRPCDispatcher; BaseSession removed ( #2838 )
2026-06-15 14:46:34 +01:00
7267818e44
Fix unknown-method error code and add a protocol version registry ( #2836 )
2026-06-11 16:47:22 +01:00
5d826490b6
[v2] Dispatcher/ServerRunner receive-path swap — replaces BaseSession ( #2710 )
2026-06-09 12:58:47 +01:00
b478bff56d
Remove the unsupported WebSocket transport ( #2785 )
2026-06-08 12:05:27 +01:00
bdc48e98b1
Fix stdio client shutdown bugs and rebuild the stdio test suite ( #2773 )
2026-06-05 16:15:43 +01:00
19fe9faec8
Run StreamableHTTP transport tests in process instead of over sockets ( #2767 )
2026-06-03 12:45:00 +01:00
ed39e73c0b
Run SSE and Unicode transport tests in process instead of over sockets ( #2765 )
2026-06-02 21:46:53 +01:00
2dfb51a4d1
fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata ( #2404 )
2026-04-13 15:42:35 +01:00
37891f42a4
Add basic OpenTelemetry tracing for client and server requests ( #2381 )
2026-03-31 20:33:33 +00:00
e6235d1667
Propagate contextvars.Context through anyio streams without modifying SessionMessage ( #2298 )
2026-03-31 12:49:38 -04:00
67201a9bbd
test: fix WS test port race; narrow to single smoke test covering both transport ends ( #2267 )
2026-03-18 15:48:30 +00:00
e1fd62e0f3
fix: close all memory stream ends in client transport cleanup ( #2266 )
2026-03-13 14:43:54 +00:00
51c53f2c18
fix: accept wildcard media types in Accept header per RFC 7231 ( #2152 )
...
Co-authored-by: Shivam <shivam@Shivams-MacBook-Air-2.local >
2026-03-09 16:30:02 +00:00
528abfab86
tests: remove lax-no-cover pragmas by moving assertions before cancellation ( #2206 )
2026-03-04 16:11:34 +00:00
b3149d2f33
fix: clean up SSE session on client disconnect ( #2200 )
...
Co-authored-by: Varun Sharma <sharmava@microsoft.com >
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-04 14:45:11 +00:00
e82203bfc4
refactor: remove unused mcp.shared.progress module ( #2080 )
2026-02-18 13:10:02 +00:00
be5bb7c4f2
fix: normalize trailing slashes before length check in check_resource_allowed ( #2074 )
2026-02-17 14:34:59 +00:00
705497a593
fix: allow null id in JSONRPCError per JSON-RPC 2.0 spec ( #2056 )
2026-02-17 10:30:34 +00:00
3b53fb9a00
fix: add HTTP readiness check to wait_for_server and remove dead code in SSE tests ( #2073 )
2026-02-17 08:34:47 +01:00
0a22a9dc33
refactor: replace lowlevel Server decorators with on_* constructor kwargs ( #1985 )
2026-02-12 15:55:54 +00:00
f049c8e5c6
Fix leaked anyio streams in streamable_http ( #1991 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-02-11 14:52:07 +00:00
1a8c14a5b8
refactor: replace mcp.types as types to from mcp import types ( #1986 )
2026-02-03 16:42:29 +00:00
4fc49c62bd
feat: add ClientRequestContext type alias for client-side handlers ( #1989 )
2026-02-03 17:37:38 +01:00
b1f7eec3cd
refactor: split RequestContext between server and client ( #1987 )
2026-02-03 14:35:07 +01:00
21822053df
Support different transports in Client ( #1972 )
2026-01-30 12:11:27 +00:00
Max Isbey