Commit Graph

169 Commits

Author SHA1 Message Date
Claude b4edbd4bb7 fix(client): harden the resumption GET and SSE POST error paths per review
Address the review findings on the previous revision:

- Dispatch resumption on message type as well as metadata: a notification
  stamped with a resumption token is POSTed as usual instead of tripping
  the resumption path's request-only assertion and killing the write loop.
- Treat any non-2xx as a failure (response.is_success), restoring the
  raise_for_status() semantics the checks replaced: an unfollowed redirect
  resolves the caller instead of being logged as success.
- Map a 404 on the resumption GET while a session id is held to
  INVALID_REQUEST / "Session terminated", the POST path's session-expiry
  signal, so reconnect logic keyed on it works across both.
- Contain the resumption read loop like _handle_sse_response: a stream
  dying mid-read or ending cleanly without a response resolves the waiter
  (CONNECTION_CLOSED) instead of tearing down the transport or hanging.
- Resolve the resumption GET's status errors via _resolve_abandoned_request
  for its closed-stream containment instead of hand-building the error.
- Surface network-level errors (httpx.HTTPError) on the SSE message POST
  through the same correlated path: on this transport nothing escapes
  loudly, so the caller previously hung forever.
- Deduplicate the SSE test app wiring behind make_app(wrap_post=...).

Seven new regression tests pin the above; each fails against the previous
revision (hang into fail_after, transport teardown, or wrong error).

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AuJi8kEB3bhikW2pzbmhUL
2026-08-11 05:56:37 +00:00
Claude 15b394c438 fix(client): surface HTTP errors on resumption GET and SSE message POST
Two client-side paths still swallowed non-2xx HTTP responses, leaving the
caller hanging with no way to tell an auth failure from a slow server
(#2110):

- streamable HTTP: a non-2xx on the resumption GET (Last-Event-ID) hit a
  bare raise_for_status() inside the request's background task; the
  escaping HTTPStatusError tore down the transport's task group and every
  stream with it.
- SSE transport: a non-2xx on the message POST raised into post_writer's
  catch-all, which logged and dropped it; the waiting caller hung forever
  and the write loop died.

Both paths now resolve the waiting request with a JSON-RPC error
correlated to its id, mirroring _handle_post_request's existing non-2xx
handling: the caller gets a prompt INTERNAL_ERROR and the
transport/session stays usable. A non-2xx on a notification POST has no
waiter to resolve, so it is logged and contained.

Regression tests drive both transports in-process (httpx MockTransport /
ASGI) at 401/403/500 and pin that the error is correlated, prompt, and
non-fatal to the session; all fail (hang into fail_after) without the
fix.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AuJi8kEB3bhikW2pzbmhUL
2026-08-11 05:27:29 +00:00
Max 89c5e700f2 Gate log notifications on the per-request log-level opt-in at 2026-07-28 (#3198) 2026-07-28 02:20:33 +01:00
Max d3ffe87960 Split the registration request model from the registered-client record (#3181) 2026-07-27 23:11:01 +01:00
Jeremiah Lowin f599cdfcf9 Cache compiled output-schema validators on ClientSession (#3134)
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com>
2026-07-26 11:29:10 +01:00
Max 814072c94d Narrow message_handler's parameter to notifications and exceptions (#3168) 2026-07-26 00:24:48 +01:00
Max 47bfa85e83 Remove the unused timeout parameter from OAuthClientProvider (#3165) 2026-07-26 00:22:15 +01:00
Max 7163d8263f Remove the deprecated RFC7523OAuthClientProvider (#3169) 2026-07-25 22:50:57 +01:00
Max e90a66b554 Rename scopes= to scope= on the client-credentials OAuth providers (#3166) 2026-07-25 20:23:36 +01:00
Max 0cb920f126 Make CacheConfig() the Client cache default and None the off switch (#3164) 2026-07-25 17:50:53 +01:00
Max 837ef904f8 Align with spec #3002: optional clientInfo, serverInfo in result _meta (#3143)
Deploy Docs / deploy-docs (push) Has been cancelled
CI / checks (push) Failing after 24m23s
CI / all-green (push) Has been cancelled
Conformance Tests / server-conformance (push) Has been cancelled
Conformance Tests / client-conformance (push) Has been cancelled
GitHub Actions Security Analysis / zizmor (push) Has been cancelled
2026-07-23 12:00:36 +01:00
Marcelo Trylesinski 2713b53b12 Replace httpx and httpx-sse with httpx2 (#2972)
CI / checks (push) Failing after 1s
CI / all-green (push) Has been cancelled
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com>
2026-07-14 17:05:08 +01:00
Max 9bdc03d54e Add the client-side subscriptions/listen driver (#3047) 2026-07-07 14:26:09 +01:00
Max 867bba6263 Share one event loop per test module to stop Windows socketpair churn (#3070) 2026-07-07 13:19:04 +01:00
Max 53117cb3a9 Make client-side cancellation work over the 2026 transports (#3046) 2026-07-02 19:21:04 +01:00
Max 220d362112 docs: restructure into topical sections and add the four most-asked-for pages (#3044) 2026-07-01 21:06:04 +01:00
Max 080f2a869d Harden the dual-era stream loop's era-lock and rejection semantics (#3040) 2026-07-01 17:07:12 +01:00
Max e50fb5be19 Serve the 2026-07-28 era over stdio and other stream-pair transports (#3038) 2026-07-01 00:11:56 +01:00
Max 4df609119f Add a client extension API (#3034) 2026-06-30 21:31:02 +01:00
Max b15b1d5f07 Add a client-side response cache honoring SEP-2549 caching hints (#3023) 2026-06-30 11:31:06 +01:00
Marcelo Trylesinski c0ecb70e24 Support RFC 8693 token exchange for enterprise IdP flows (SEP-990) (#2988)
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com>
2026-06-26 17:57:10 +02:00
Marcelo Trylesinski ecdf09d44f Deprecate Server.__init__ handlers for removed capabilities (#3002) 2026-06-26 17:51:13 +02:00
Max 08b62308d4 Client auto-resolves InputRequiredResult via existing callbacks (SEP-2322) (#2998) 2026-06-26 17:35:23 +02:00
Marcelo Trylesinski cc596195bb Switch RFC7523OAuthClientProvider warning to MCPDeprecationWarning (#2996) 2026-06-26 15:27:57 +02:00
Max 411a6d3980 Rebuild the docs around tested examples; shrink README.v2.md to a pitch (#2978) 2026-06-26 12:49:19 +02:00
Max 587340279e Conformance burn-down: server-side InputRequiredResult, Mcp-Method/Name validation, x-mcp-header filter (14 scenarios → green) (#2974)
CI / checks (push) Failing after 0s
CI / all-green (push) Has been cancelled
2026-06-26 09:51:59 +02:00
Marcelo Trylesinski 0ee7f1b293 Split protocol types into a standalone mcp-types package (#2973) 2026-06-25 19:18:38 +02:00
Max 03681ed55e Client call_tool: input_responses/request_state retry params; InputRequiredResult via allow_input_required (#2968) 2026-06-25 17:37:00 +02:00
Max f226d00d0a Client-side 2026-07-28 support: .discover()/.adopt() + Client(mode=); request-metadata green (#2950) 2026-06-25 16:09:23 +02:00
Max 44ce901ce3 OAuth client: keep refresh_token on non-rotating refresh; restore same-origin issuer binding (#2946) 2026-06-22 15:21:52 +01:00
Max 5e013d9c54 OAuth client: harden SEP-2352/SEP-2350 edge cases; fix conformance comment (#2936) 2026-06-22 14:45:20 +01:00
Max 2397319a68 Server-side 2026-07-28 stateless support: classifier, driver split, server/discover (#2928) 2026-06-21 19:34:17 +01:00
Marcelo Trylesinski 44724284b3 Bind client credentials to their authorization server (SEP-2352) (#2933) 2026-06-20 18:47:22 +01:00
Marcelo Trylesinski 3169922492 Move scope step-up test to top-level function (#2932) 2026-06-20 18:45:10 +01:00
Marcelo Trylesinski 1331131650 Union previously requested scopes on step-up re-authorization (SEP-2350) (#2931) 2026-06-20 18:45:04 +02:00
Marcelo Trylesinski 4573e4ac33 Deprecate roots, sampling, and logging methods per SEP-2577 (#2926) 2026-06-20 18:25:41 +02:00
Marcelo Trylesinski cf41441e44 Send application_type during Dynamic Client Registration (SEP-837) (#2930) 2026-06-20 18:19:12 +02:00
Marcelo Trylesinski 48cf4950dc Validate the iss authorization-response parameter (RFC 9207 / SEP-2468) (#2921) 2026-06-20 17:54:18 +02:00
Marcelo Trylesinski b7a5bffed0 Preserve empty URL paths on OAuth metadata models (#2925) 2026-06-20 15:32:03 +00:00
Max 5a3412ddc1 Ignore pre-2026 protocol_version pins at the StreamableHTTP transport (#2923) 2026-06-20 17:29:57 +02:00
Max 84bf9bde05 First end-to-end 2026-07-28 stateless tools/call (experimental entry + ClientSession pin) (#2917) 2026-06-20 14:55:59 +01:00
Max 65be5a7147 Protocol types for 2026-07-28: superset monolith, committed per-version packages, and wire-method maps (#2849) 2026-06-16 17:40:14 +01:00
Max 1012d60004 [v2] ClientSession runs on JSONRPCDispatcher; BaseSession removed (#2838) 2026-06-15 14:46:34 +01:00
Max 7267818e44 Fix unknown-method error code and add a protocol version registry (#2836) 2026-06-11 16:47:22 +01:00
Max 5d826490b6 [v2] Dispatcher/ServerRunner receive-path swap — replaces BaseSession (#2710) 2026-06-09 12:58:47 +01:00
Max b478bff56d Remove the unsupported WebSocket transport (#2785) 2026-06-08 12:05:27 +01:00
Max bdc48e98b1 Fix stdio client shutdown bugs and rebuild the stdio test suite (#2773) 2026-06-05 16:15:43 +01:00
Max ed39e73c0b Run SSE and Unicode transport tests in process instead of over sockets (#2765) 2026-06-02 21:46:53 +01:00
Gyeongjun Paik (Kent) 3d7b311de0 fix: align Context logging methods with MCP spec data type (#2366)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com>
2026-04-14 21:41:51 +00:00
Wils Dawson 437d15aa71 SEP-2207: Refresh token guidance (#2039) 2026-04-14 11:48:07 +01:00