d95f3a6922
fix: remove scope registration check from authorize handler
...
The check in validate_scope rejected any requested scope not in the
client's registered metadata. This broke the MCP spec's step-up
authorization flow: when a server returns 403 insufficient_scope with
a WWW-Authenticate challenge containing expanded scopes, the client
(see client/auth/oauth2.py) re-authorizes with those scopes and the
server would reject them.
RFC 7591 Section 2 defines the scope field as scopes the client "can
use", with no language restricting requests to that set. Scope policy
enforcement belongs in OAuthAuthorizationServerProvider.authorize(),
which can already raise AuthorizeError(error="invalid_scope", ...).
The TypeScript SDK removed this check in #983 for the same reason.
InvalidScopeError is removed as it was only raised from this path.
Reported-by: nik1097
Github-Issue: #2216
2026-03-17 11:51:31 +00:00
75a80b6f07
refactor: connect-first stream lifecycle for sse and streamable_http ( #2292 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-03-16 23:30:20 +00:00
e1fd62e0f3
fix: close all memory stream ends in client transport cleanup ( #2266 )
2026-03-13 14:43:54 +00:00
dd52713517
Rewrite TestChildProcessCleanup with socket-based deterministic liveness probe ( #2265 )
2026-03-12 12:52:32 +00:00
62eb08e5b2
fix: don't send log notification on transport error ( #2257 )
2026-03-09 17:47:27 +00:00
31a38b5078
fix: correct Context type parameters across examples and tests ( #2256 )
2026-03-09 16:52:56 +00:00
51c53f2c18
fix: accept wildcard media types in Accept header per RFC 7231 ( #2152 )
...
Co-authored-by: Shivam <shivam@Shivams-MacBook-Air-2.local >
2026-03-09 16:30:02 +00:00
7ba41dcfae
fix: make local coverage runs reliable ( #2236 )
2026-03-06 17:24:18 +00:00
eaf971cf25
Add warning log when rejecting request with unknown/expired session ID ( #2212 )
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-06 16:55:37 +00:00
92f1b1500d
fix: remove MIME type validation from MCPServer Resource ( #2235 )
2026-03-06 14:50:58 +00:00
b33c811675
perf: use deque for InMemoryTaskMessageQueue FIFO operations ( #2165 )
2026-03-05 15:44:33 +00:00
7c0224828b
fix(oauth): include client_id in token request body for client_secret_post ( #2185 )
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-03-05 14:57:33 +00:00
528abfab86
tests: remove lax-no-cover pragmas by moving assertions before cancellation ( #2206 )
2026-03-04 16:11:34 +00:00
b3149d2f33
fix: clean up SSE session on client disconnect ( #2200 )
...
Co-authored-by: Varun Sharma <sharmava@microsoft.com >
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-04 14:45:11 +00:00
cc22bf5464
refactor: remove request_ctx ContextVar, thread Context explicitly ( #2203 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-03-04 13:23:02 +00:00
cb07adeca3
docs: add code fences to Example: docstring blocks ( #2104 )
2026-02-19 21:06:11 +01:00
0e96aecd1d
fix: use exact match for loopback hosts in issuer URL validation ( #2089 )
2026-02-18 19:40:52 +00:00
e82203bfc4
refactor: remove unused mcp.shared.progress module ( #2080 )
2026-02-18 13:10:02 +00:00
fc57c2c4c5
test: fix progress notification assertions for related_request_id ( #2038 )
...
Co-authored-by: Lee Hubbard <hubbard.zlee@unknowncyber.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-02-18 11:53:03 +00:00
92140e5086
Add idle session timeout to StreamableHTTPSessionManager ( #2022 )
2026-02-18 10:47:02 +00:00
be5bb7c4f2
fix: normalize trailing slashes before length check in check_resource_allowed ( #2074 )
2026-02-17 14:34:59 +00:00
705497a593
fix: allow null id in JSONRPCError per JSON-RPC 2.0 spec ( #2056 )
2026-02-17 10:30:34 +00:00
3b53fb9a00
fix: add HTTP readiness check to wait_for_server and remove dead code in SSE tests ( #2073 )
2026-02-17 08:34:47 +01:00
2fe56e56de
fix: handle HTTP error status codes in streamable HTTP client ( #2047 )
2026-02-14 09:49:42 +01:00
0a22a9dc33
refactor: replace lowlevel Server decorators with on_* constructor kwargs ( #1985 )
2026-02-12 15:55:54 +00:00
f049c8e5c6
Fix leaked anyio streams in streamable_http ( #1991 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-02-11 14:52:07 +00:00
239d682b6f
fix: pass conformance auth scenarios, add RFC 8707 resource validation ( #2010 )
2026-02-09 11:41:03 +00:00
7c7c13b648
fix: send JSONRPCError instead of bare exceptions in streamable HTTP client ( #2005 )
2026-02-09 10:38:46 +00:00
1a8c14a5b8
refactor: replace mcp.types as types to from mcp import types ( #1986 )
2026-02-03 16:42:29 +00:00
4fc49c62bd
feat: add ClientRequestContext type alias for client-side handlers ( #1989 )
2026-02-03 17:37:38 +01:00
b1f7eec3cd
refactor: split RequestContext between server and client ( #1987 )
2026-02-03 14:35:07 +01:00
21822053df
Support different transports in Client ( #1972 )
2026-01-30 12:11:27 +00:00
2137c8fbdb
fix: revert README to v1.x documentation on main ( #1971 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-01-29 20:03:01 +00:00
14744c66c5
Add tests for MCPServer.read_resource exception handling ( #1957 )
2026-01-27 13:49:06 +01:00
acba5478a9
refactor: McpError renamed to MCPError and flatten parameters ( #1956 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-01-26 14:37:44 +01:00
65c614e48e
Rename FastMCP to MCPServer ( #1951 )
2026-01-25 14:45:52 +01:00
a7ddfdae07
ci: add strict-no-cover to detect unnecessary coverage pragmas ( #1897 )
2026-01-23 21:00:20 +01:00
f0ab53e194
Add meta to Client methods ( #1923 )
2026-01-22 14:50:39 +01:00
d77292fb06
refactor: drop test classes ( #1924 )
2026-01-22 12:37:52 +01:00
7b728a243e
refactor: drop unused logger/logging ( #1926 )
2026-01-22 11:56:41 +01:00
bcb07c2b25
refactor: flatten the methods in Client ( #1914 )
2026-01-20 13:12:07 +01:00
5fdd48a0d3
Completely drop RootModel from types module ( #1910 )
2026-01-19 14:29:15 +01:00
f4672c5084
Drop RootModel from JSONRPCMessage ( #1908 )
2026-01-19 14:04:15 +01:00
dcc9b4f8e0
refactor: use Client class in tests ( #1900 )
2026-01-17 09:46:58 +01:00
d41d0c0128
chore: add D212 lint rule to enforce Google-style docstrings ( #1892 )
2026-01-16 16:10:52 +00:00
df039bf97c
Add ergonomic Client class for testing MCP servers ( #1870 )
2026-01-16 15:49:26 +00:00
8adb5bdce8
refactor: move transport-specific parameters from FastMCP constructor to run() ( #1898 )
...
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-16 15:16:20 +00:00
5d80f4efc8
refactor: move inline imports to module level ( #1893 )
2026-01-16 14:54:08 +00:00
e94b386a13
refactor: use snake case instead of camel case in types ( #1894 )
2026-01-16 15:51:27 +01:00
0622babbd9
fix: URL-decode parameters extracted from resource templates ( #1864 )
2026-01-16 13:47:21 +00:00
Max Isbey