d95f3a6922
fix: remove scope registration check from authorize handler
...
The check in validate_scope rejected any requested scope not in the
client's registered metadata. This broke the MCP spec's step-up
authorization flow: when a server returns 403 insufficient_scope with
a WWW-Authenticate challenge containing expanded scopes, the client
(see client/auth/oauth2.py) re-authorizes with those scopes and the
server would reject them.
RFC 7591 Section 2 defines the scope field as scopes the client "can
use", with no language restricting requests to that set. Scope policy
enforcement belongs in OAuthAuthorizationServerProvider.authorize(),
which can already raise AuthorizeError(error="invalid_scope", ...).
The TypeScript SDK removed this check in #983 for the same reason.
InvalidScopeError is removed as it was only raised from this path.
Reported-by: nik1097
Github-Issue: #2216
2026-03-17 11:51:31 +00:00
e1fd62e0f3
fix: close all memory stream ends in client transport cleanup ( #2266 )
2026-03-13 14:43:54 +00:00
51c53f2c18
fix: accept wildcard media types in Accept header per RFC 7231 ( #2152 )
...
Co-authored-by: Shivam <shivam@Shivams-MacBook-Air-2.local >
2026-03-09 16:30:02 +00:00
528abfab86
tests: remove lax-no-cover pragmas by moving assertions before cancellation ( #2206 )
2026-03-04 16:11:34 +00:00
b3149d2f33
fix: clean up SSE session on client disconnect ( #2200 )
...
Co-authored-by: Varun Sharma <sharmava@microsoft.com >
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-04 14:45:11 +00:00
e82203bfc4
refactor: remove unused mcp.shared.progress module ( #2080 )
2026-02-18 13:10:02 +00:00
be5bb7c4f2
fix: normalize trailing slashes before length check in check_resource_allowed ( #2074 )
2026-02-17 14:34:59 +00:00
705497a593
fix: allow null id in JSONRPCError per JSON-RPC 2.0 spec ( #2056 )
2026-02-17 10:30:34 +00:00
3b53fb9a00
fix: add HTTP readiness check to wait_for_server and remove dead code in SSE tests ( #2073 )
2026-02-17 08:34:47 +01:00
0a22a9dc33
refactor: replace lowlevel Server decorators with on_* constructor kwargs ( #1985 )
2026-02-12 15:55:54 +00:00
f049c8e5c6
Fix leaked anyio streams in streamable_http ( #1991 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-02-11 14:52:07 +00:00
1a8c14a5b8
refactor: replace mcp.types as types to from mcp import types ( #1986 )
2026-02-03 16:42:29 +00:00
4fc49c62bd
feat: add ClientRequestContext type alias for client-side handlers ( #1989 )
2026-02-03 17:37:38 +01:00
b1f7eec3cd
refactor: split RequestContext between server and client ( #1987 )
2026-02-03 14:35:07 +01:00
21822053df
Support different transports in Client ( #1972 )
2026-01-30 12:11:27 +00:00
acba5478a9
refactor: McpError renamed to MCPError and flatten parameters ( #1956 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-01-26 14:37:44 +01:00
a7ddfdae07
ci: add strict-no-cover to detect unnecessary coverage pragmas ( #1897 )
2026-01-23 21:00:20 +01:00
f0ab53e194
Add meta to Client methods ( #1923 )
2026-01-22 14:50:39 +01:00
d77292fb06
refactor: drop test classes ( #1924 )
2026-01-22 12:37:52 +01:00
5fdd48a0d3
Completely drop RootModel from types module ( #1910 )
2026-01-19 14:29:15 +01:00
f4672c5084
Drop RootModel from JSONRPCMessage ( #1908 )
2026-01-19 14:04:15 +01:00
dcc9b4f8e0
refactor: use Client class in tests ( #1900 )
2026-01-17 09:46:58 +01:00
d41d0c0128
chore: add D212 lint rule to enforce Google-style docstrings ( #1892 )
2026-01-16 16:10:52 +00:00
df039bf97c
Add ergonomic Client class for testing MCP servers ( #1870 )
2026-01-16 15:49:26 +00:00
5d80f4efc8
refactor: move inline imports to module level ( #1893 )
2026-01-16 14:54:08 +00:00
e94b386a13
refactor: use snake case instead of camel case in types ( #1894 )
2026-01-16 15:51:27 +01:00
cfb2909631
fix: change Resource URI fields from AnyUrl to str ( #1863 )
2026-01-16 09:58:57 +01:00
8893b022e8
Drop deprecated streamablehttp_client ( #1836 )
2026-01-15 11:02:24 +01:00
3ffe142e9a
Support Python 3.14 ( #1834 )
2026-01-07 16:28:23 +00:00
6149b63a44
tests: add missing init files ( #1831 )
2026-01-06 19:52:09 +01:00
2aa1ad2a69
feat: standardize timeout values to floats in seconds ( #1766 )
2025-12-19 12:22:56 +00:00
a3a4b8d11a
Add streamable_http_client which accepts httpx.AsyncClient instead of httpx_client_factory ( #1177 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-12-10 16:39:00 +00:00
cc8382ce3e
Fix JSON-RPC error response ID matching ( #1720 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-12-10 16:15:21 +00:00
2bf9b10f63
Skip empty SSE data to avoid parsing errors ( #1753 )
...
Co-authored-by: ARJUN-TS1 <arjun.ts1@ibm.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-12-09 15:14:23 +00:00
89ff338174
fix: skip priming events and close_sse_stream for old protocol versions ( #1719 )
Main branch checks / checks (push) Failing after 0s
2025-12-04 14:44:08 +00:00
fa851d93a2
feat: backwards-compatible create_message overloads for SEP-1577 ( #1713 )
2025-12-02 13:17:45 +00:00
281fd4765e
Add SSE polling support (SEP-1699) ( #1654 )
2025-12-02 11:44:49 +00:00
2cd178a962
Add on_session_created callback option ( #1710 )
2025-12-01 17:48:33 +00:00
5983a650cc
Skip empty SSE data to avoid parsing errors ( #1670 )
2025-11-26 18:09:39 +00:00
02b7889929
Implement SEP-1036: URL mode elicitation for secure out-of-band interactions ( #1580 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-11-25 11:00:21 +00:00
091afb82dc
Implement SEP-986: Tool name validation ( #1655 )
2025-11-24 16:46:57 +00:00
71c475588f
Implement SEP-1577 - Sampling With Tools ( #1594 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Claude <noreply@anthropic.com >
2025-11-22 23:58:14 -05:00
89e9c43acf
Get baseline 100% clean coverage ( #1553 )
2025-11-11 14:09:32 +01:00
db9e451551
fix: Replace remaining manual server polling with wait_for_server helper ( #1529 )
2025-10-29 11:27:57 +00:00
3e86edfb2f
fix: Replace arbitrary sleeps with active server readiness checks in tests ( #1527 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2025-10-28 21:42:33 +00:00
31ae5f4dc4
Relax Accept header requirement for JSON-only responses ( #1500 )
2025-10-27 17:46:04 +00:00
d648a31359
fix: improve misleading warning for progress callback exceptions ( #775 )
2025-09-30 14:39:52 +01:00
07ae8c0d4e
types: Setting default value for method: Literal ( #1292 )
2025-08-26 16:22:56 +01:00
0926613714
Update dependencies and fix type issues ( #1268 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2025-08-14 10:40:47 +01:00
c7671e470c
Add pyright strict mode on the whole project ( #1254 )
2025-08-11 18:56:37 +01:00
Max Isbey