d95f3a6922
fix: remove scope registration check from authorize handler
...
The check in validate_scope rejected any requested scope not in the
client's registered metadata. This broke the MCP spec's step-up
authorization flow: when a server returns 403 insufficient_scope with
a WWW-Authenticate challenge containing expanded scopes, the client
(see client/auth/oauth2.py) re-authorizes with those scopes and the
server would reject them.
RFC 7591 Section 2 defines the scope field as scopes the client "can
use", with no language restricting requests to that set. Scope policy
enforcement belongs in OAuthAuthorizationServerProvider.authorize(),
which can already raise AuthorizeError(error="invalid_scope", ...).
The TypeScript SDK removed this check in #983 for the same reason.
InvalidScopeError is removed as it was only raised from this path.
Reported-by: nik1097
Github-Issue: #2216
2026-03-17 11:51:31 +00:00
75a80b6f07
refactor: connect-first stream lifecycle for sse and streamable_http ( #2292 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-03-16 23:30:20 +00:00
abfb482246
refactor(examples): migrate all HTTP examples to streamable_http_app() ( #2291 )
2026-03-16 11:37:01 +00:00
e1fd62e0f3
fix: close all memory stream ends in client transport cleanup ( #2266 )
2026-03-13 14:43:54 +00:00
2c73a2a881
chore(deps): bump black from 25.1.0 to 26.3.1 in the uv group across 1 directory ( #2290 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-13 10:39:56 +00:00
dd52713517
Rewrite TestChildProcessCleanup with socket-based deterministic liveness probe ( #2265 )
2026-03-12 12:52:32 +00:00
62eb08e5b2
fix: don't send log notification on transport error ( #2257 )
2026-03-09 17:47:27 +00:00
31a38b5078
fix: correct Context type parameters across examples and tests ( #2256 )
2026-03-09 16:52:56 +00:00
51c53f2c18
fix: accept wildcard media types in Accept header per RFC 7231 ( #2152 )
...
Co-authored-by: Shivam <shivam@Shivams-MacBook-Air-2.local >
2026-03-09 16:30:02 +00:00
7ba41dcfae
fix: make local coverage runs reliable ( #2236 )
2026-03-06 17:24:18 +00:00
eaf971cf25
Add warning log when rejecting request with unknown/expired session ID ( #2212 )
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-06 16:55:37 +00:00
92f1b1500d
fix: remove MIME type validation from MCPServer Resource ( #2235 )
2026-03-06 14:50:58 +00:00
b33c811675
perf: use deque for InMemoryTaskMessageQueue FIFO operations ( #2165 )
2026-03-05 15:44:33 +00:00
7c0224828b
fix(oauth): include client_id in token request body for client_secret_post ( #2185 )
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-03-05 14:57:33 +00:00
528abfab86
tests: remove lax-no-cover pragmas by moving assertions before cancellation ( #2206 )
2026-03-04 16:11:34 +00:00
b3149d2f33
fix: clean up SSE session on client disconnect ( #2200 )
...
Co-authored-by: Varun Sharma <sharmava@microsoft.com >
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-04 14:45:11 +00:00
cc22bf5464
refactor: remove request_ctx ContextVar, thread Context explicitly ( #2203 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-03-04 13:23:02 +00:00
62575edabd
ci: sign weekly lockfile commits as github-actions[bot] ( #2148 )
2026-02-26 15:36:46 +00:00
0fe16dd5fd
fix: silence mkdocs social plugin warnings in strict mode ( #2109 )
2026-02-19 23:12:51 +01:00
cb07adeca3
docs: add code fences to Example: docstring blocks ( #2104 )
2026-02-19 21:06:11 +01:00
c0328540c9
docs: fix docstrings across public API surface ( #2095 )
2026-02-19 06:45:59 +01:00
688c6e3ade
Update SECURITY.md to use GitHub Security Advisories ( #2092 )
2026-02-18 21:19:25 -08:00
43d709c976
ci: pin all GitHub Actions to commit SHAs ( #2088 )
2026-02-18 19:42:00 +00:00
0e96aecd1d
fix: use exact match for loopback hosts in issuer URL validation ( #2089 )
2026-02-18 19:40:52 +00:00
b9431d483f
fix: prevent command injection in example URL opening ( #2082 )
2026-02-18 15:16:44 +00:00
e82203bfc4
refactor: remove unused mcp.shared.progress module ( #2080 )
2026-02-18 13:10:02 +00:00
fc57c2c4c5
test: fix progress notification assertions for related_request_id ( #2038 )
...
Co-authored-by: Lee Hubbard <hubbard.zlee@unknowncyber.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-02-18 11:53:03 +00:00
92140e5086
Add idle session timeout to StreamableHTTPSessionManager ( #2022 )
2026-02-18 10:47:02 +00:00
be5bb7c4f2
fix: normalize trailing slashes before length check in check_resource_allowed ( #2074 )
2026-02-17 14:34:59 +00:00
705497a593
fix: allow null id in JSONRPCError per JSON-RPC 2.0 spec ( #2056 )
2026-02-17 10:30:34 +00:00
3b53fb9a00
fix: add HTTP readiness check to wait_for_server and remove dead code in SSE tests ( #2073 )
2026-02-17 08:34:47 +01:00
2fe56e56de
fix: handle HTTP error status codes in streamable HTTP client ( #2047 )
2026-02-14 09:49:42 +01:00
8f669a77e3
fix: explicitly load required pytest plugins in addopts ( #2055 )
2026-02-13 18:25:10 +00:00
a287a40184
docs: add coverage verification instruction to CLAUDE.md ( #2050 )
2026-02-13 13:10:00 +00:00
29a14ab9e5
fix: skip readme-v1-frozen in CI and add diff-based README.md check ( #2048 )
2026-02-13 10:30:30 +00:00
1e0b5c0479
fix: revert README.md to v1 documentation ( #2045 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-02-12 16:22:07 +00:00
0a22a9dc33
refactor: replace lowlevel Server decorators with on_* constructor kwargs ( #1985 )
2026-02-12 15:55:54 +00:00
d6d3ad9a7c
chore(deps-dev): bump pillow from 12.1.0 to 12.1.1 in the uv group across 1 directory ( #2036 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-11 14:57:37 +00:00
f049c8e5c6
Fix leaked anyio streams in streamable_http ( #1991 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-02-11 14:52:07 +00:00
99edde1125
feat: add /review-pr Claude Code command for PR reviews ( #2035 )
2026-02-11 15:26:43 +01:00
e39038d879
chore(deps): bump cryptography from 45.0.5 to 46.0.5 in the uv group across 1 directory ( #2031 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-11 14:26:16 +01:00
239d682b6f
fix: pass conformance auth scenarios, add RFC 8707 resource validation ( #2010 )
2026-02-09 11:41:03 +00:00
7c7c13b648
fix: send JSONRPCError instead of bare exceptions in streamable HTTP client ( #2005 )
2026-02-09 10:38:46 +00:00
dda845aa12
docs: clarify test file structure convention in CLAUDE.md ( #2006 )
2026-02-07 14:12:54 +01:00
4598ad9361
ci: disable conformance tests ( #2007 )
2026-02-07 14:12:19 +01:00
1a943ad085
chore(deps): bump the uv group across 1 directory with 2 updates ( #1961 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-06 09:07:49 +00:00
d3133ae6ce
chore: update author metadata to LF Projects ( #1992 )
2026-02-04 11:01:33 +00:00
1a8c14a5b8
refactor: replace mcp.types as types to from mcp import types ( #1986 )
2026-02-03 16:42:29 +00:00
4fc49c62bd
feat: add ClientRequestContext type alias for client-side handlers ( #1989 )
2026-02-03 17:37:38 +01:00
74f41ff1ae
Add more maintainers to the PyPI metadata ( #1976 )
2026-02-03 16:19:56 +00:00
Max Isbey