github-featured/modelcontextprotocol--python-sdk
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity
1,021 Commits 166 Branches 73 Tags
fix/authorize-scope-policy
Commit Graph

1021 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Max Isbey b863e4caa6 Document scope policy as the provider's responsibility in authorize() 
Spell out on OAuthAuthorizationServerProvider.authorize() that the
requested scopes have only been checked against the server-wide
valid_scopes and that per-client scope policy is enforced here, so the
contract lives on the interface operators implement rather than only
in the migration guide.

No-Verification-Needed: docstring-only change
 2026-07-29 15:41:56 +00:00
Max Isbey 7d398a03c7 Delegate authorize-time scope policy to the provider 
The SDK-hosted authorization server rejected any /authorize request
whose scope was not in the client's registered `scope` metadata, and
treated a client registered without a scope as allowed to request
nothing at all. That broke the spec's step-up flow, in which a client
answers a 403 insufficient_scope challenge by re-authorizing for the
union of its previous and challenged scopes without re-registering, and
it rejected every scoped request from scope-less registrations (#2216)
as well as an empty `scope=` parameter (#977).

The authorize handler now enforces only the server-wide scope set,
`ClientRegistrationOptions.valid_scopes` (the list already advertised
as `scopes_supported` and enforced at registration). A requested scope
outside it redirects back with `invalid_scope`; when it is unset, every
requested scope reaches `provider.authorize()`, which can reject a
client's request by raising `AuthorizeError(error="invalid_scope")`.
An empty scope parameter is treated as omitted.

`OAuthClientInformationFull.validate_scope()` and `InvalidScopeError`
are removed; both existed only to implement the deleted check.

Github-Issue: #2216
 2026-07-29 15:39:04 +00:00
Max fe47969fb9 Ask which release line a bug report is on (#3213) 2026-07-29 14:55:15 +01:00
Max d82ed88eb5 Describe the maintenance line without hardcoding 1.28 (#3212) 2026-07-29 14:54:45 +01:00
Max b31ddf37ed Retire wording tied to pre-2.0 milestones (#3211) 2026-07-29 14:54:23 +01:00
Max 6f69a3758e Present v2 as the stable release across the README, docs, and policies (#3178)
Conformance Tests / server-conformance (push) Has been cancelled
Conformance Tests / client-conformance (push) Has been cancelled
Deploy Docs / deploy-docs (push) Has been cancelled
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
CI / checks (push) Failing after 1s
CI / all-green (push) Has been cancelled
v2.0.0 		2026-07-28 14:31:36 +01:00
Max 78e6fbb7e4 Serve v2 docs at the site root, with permanent per-major paths (#3176) 2026-07-28 13:57:21 +01:00
Max af06330a31 Remove unused StreamableHTTPTransport.get_session_id() (#3205) 2026-07-28 13:55:02 +01:00
Max 68ca87e20b Document the two-line release process for stable v2 (#3179) 2026-07-28 13:51:31 +01:00
Max c9c431b71a Expose the middleware chain on MCPServer and stop sending unrequested change notifications (#3201) 2026-07-28 12:24:23 +01:00
Max 528e366558 Fail fast on server-to-client requests in JSON-response mode instead of hanging (#3195) 2026-07-28 11:04:51 +01:00
Max 27f5cc7a46 Remove unused mcpserver.exceptions.ValidationError (#3199) 2026-07-28 10:25:51 +01:00
Max 89c5e700f2 Gate log notifications on the per-request log-level opt-in at 2026-07-28 (#3198) 2026-07-28 02:20:33 +01:00
Max b61ce388dd docs: fix off-by-one hl_lines in apps.md (#3196) 2026-07-28 00:04:57 +01:00
Max b7c9a916d6 Add mcp.types as a permanent alias for mcp_types (#3190) 2026-07-27 23:47:04 +01:00
Max 923341c98a Stop answering cancelled requests (#3188) 2026-07-27 23:26:00 +01:00
Max e8ef138153 docs: fill migration-guide gaps found by automated v1-to-v2 migration runs (#3187) 2026-07-27 23:17:17 +01:00
Max d3ffe87960 Split the registration request model from the registered-client record (#3181) 2026-07-27 23:11:01 +01:00
Max b9422f1c9b Make the per-version wire packages private (mcp_types._v*) (#3191) 2026-07-27 22:16:48 +01:00
Max 45f2a88a9a Point pre-release install pins at 2.0.0rc1 (#3186)
CI / checks (push) Failing after 1s
CI / all-green (push) Has been cancelled
v2.0.0rc1 		2026-07-27 14:23:57 +01:00
Max 333aca7ac8 Repin conformance harness to the published 0.2.0-alpha.10 (#3184) 2026-07-27 14:03:06 +01:00
Max dcd9c1ee9f Lengthen the demo signing keys in the identity-assertion examples (#3180)
Conformance Tests / server-conformance (push) Has been cancelled
Conformance Tests / client-conformance (push) Has been cancelled
Deploy Docs / deploy-docs (push) Has been cancelled
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
CI / all-green (push) Has been cancelled
CI / checks (push) Failing after 0s
 2026-07-26 11:45:26 +01:00
Jeremiah Lowin f599cdfcf9 Cache compiled output-schema validators on ClientSession (#3134) 
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com>
 2026-07-26 11:29:10 +01:00
Max 11934c90ae Replace FileResource.is_binary with an encoding field (#3171) 2026-07-26 00:58:06 +01:00
Max 814072c94d Narrow message_handler's parameter to notifications and exceptions (#3168) 2026-07-26 00:24:48 +01:00
Max 47bfa85e83 Remove the unused timeout parameter from OAuthClientProvider (#3165) 2026-07-26 00:22:15 +01:00
Max 3212591946 Stop advertising MCP_* env vars for MCPServer settings; drop pydantic-settings (#3170) 2026-07-25 23:22:27 +01:00
Max 7163d8263f Remove the deprecated RFC7523OAuthClientProvider (#3169) 2026-07-25 22:50:57 +01:00
Max 1963af52cc Correct stable v2 target date to 2026-07-28 (#3105)
CI / checks (push) Failing after 0s
Details
Deploy Docs / deploy-docs (push) Has been cancelled
Details
Conformance Tests / server-conformance (push) Has been cancelled
Details
Conformance Tests / client-conformance (push) Has been cancelled
Details
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
Details
CI / all-green (push) Has been cancelled
Details
2026-07-25 20:36:08 +01:00
Max e90a66b554 Rename scopes= to scope= on the client-credentials OAuth providers (#3166) 2026-07-25 20:23:36 +01:00
Max 5dd062d077 Remove Context.client_id (#3167) 2026-07-25 19:11:51 +01:00
Max 0cb920f126 Make CacheConfig() the Client cache default and None the off switch (#3164) 2026-07-25 17:50:53 +01:00
Max 629ca297d2 Isolate the stdio server's stdin and stdout from handler subprocesses (#3117) 2026-07-25 13:05:51 +01:00
Max 00a70148bc Serve the 2026-07-28 protocol over stdio: decide the era from the opening request (#3152)
CI / checks (push) Failing after 1s
Details
Deploy Docs / deploy-docs (push) Has been cancelled
Details
Conformance Tests / server-conformance (push) Has been cancelled
Details
Conformance Tests / client-conformance (push) Has been cancelled
Details
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
Details
CI / all-green (push) Has been cancelled
Details
2026-07-24 13:46:37 +01:00
Max 837ef904f8 Align with spec #3002: optional clientInfo, serverInfo in result _meta (#3143)
Deploy Docs / deploy-docs (push) Has been cancelled
Details
CI / checks (push) Failing after 24m23s
Details
CI / all-green (push) Has been cancelled
Details
Conformance Tests / server-conformance (push) Has been cancelled
Details
Conformance Tests / client-conformance (push) Has been cancelled
Details
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
Details
2026-07-23 12:00:36 +01:00
Max 3a6f2996cd docs: load media examples from disk instead of inline base64 (#3108) 2026-07-16 20:41:05 +01:00
Max ebcc4dc3fb Pin pymdown-extensions back to 11.0 (#3106) 2026-07-16 20:25:33 +01:00
Max 497f7afa61 docs: make API reference rendering independent of page order (#3107) 2026-07-16 18:29:44 +01:00
Andre.Kalberer e464f72c12 docs: document Windows stdio subprocess stdin handling (#3079) 2026-07-16 11:25:47 +01:00
Marcelo Trylesinski 03aaebd3aa Add Streamable HTTP request body limits (#3095) 2026-07-16 08:33:32 +02:00
Marcelo Trylesinski 2713b53b12 Replace httpx and httpx-sse with httpx2 (#2972)
CI / checks (push) Failing after 1s
Details
CI / all-green (push) Has been cancelled
Details 
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com>
v2.0.0b2 		2026-07-14 17:05:08 +01:00
Otis Cui 1216c53693 fix: reject trailing newline in tool-name and URI-template varname validation (#3076) 
Python's $ with re.match also matches just before a single trailing newline, so tool-name validation accepted "name\n" and UriTemplate.parse accepted varnames like "foo\n". Switch both checks to re.fullmatch.

Closes #3084
 2026-07-10 12:56:54 +00:00
Marcelo Trylesinski 4fc8882c02 docs: replace MkDocs with Zensical (#3073) 
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com>
 2026-07-10 12:48:46 +01:00
Max 74a242ae7f ci: pick the docs-preview toolchain from the PR checkout (#3081) 2026-07-09 13:57:14 +01:00
Max 148278e07f Gate the test matrix and retry setup-uv's flaky manifest fetch (#3080) 2026-07-09 12:32:53 +01:00
Max 9bdc03d54e Add the client-side subscriptions/listen driver (#3047) 2026-07-07 14:26:09 +01:00
Max 6d2e908f2b docs: pin mkdocs<2 and silence the mkdocs-material advisory banner in CI (#3072) 2026-07-07 13:45:30 +01:00
Max 867bba6263 Share one event loop per test module to stop Windows socketpair churn (#3070) 2026-07-07 13:19:04 +01:00
Max d287c9868f Extend resolver DI to sampling and roots requests (#3049) 2026-07-06 18:25:57 +01:00
Max 53117cb3a9 Make client-side cancellation work over the 2026 transports (#3046) 2026-07-02 19:21:04 +01:00