8f065c059b
Merge branch 'main' into localden/tasks-session
2026-03-09 08:51:56 +00:00
113f35c726
Make session_id optional in TaskStore; reject stateless mode instead
...
Previously, session_id was required (str) throughout the task store
interface, which forced sessionless transports like stdio and memory
to fabricate UUIDs before running tasks. This was awkward because
those transports are single-client by architecture and have no session
concept.
The policy is now enforced at the handler layer instead of the store
layer: default task handlers reject requests when the server is in
stateless mode (where tasks cannot survive across requests), and pass
session_id through as-is otherwise. A None session_id simply means no
session-scoped isolation, which is correct for single-client transports.
Isolation in InMemoryTaskStore uses strict equality: None only matches
None, so tasks created by a sessionless transport are not visible to
session-scoped transports and vice versa, preventing cross-transport
leaks when a process serves multiple transports from one store.
Changes:
- TaskStore, InMemoryTaskStore, TaskContext, helpers: session_id is
now str | None
- ServerSession: expose stateless property
- Default task handlers: reject stateless mode, pass session_id as-is
- run_task() / ServerTaskContext: accept None session_id, reject
stateless mode
- Memory transport: revert fabricated UUID session_id
- New tests for None-session isolation (strict equality, no
cross-transport leaks)
🏠 Remote-Dev: homespace
2026-03-09 07:52:57 +00:00
7ba41dcfae
fix: make local coverage runs reliable ( #2236 )
2026-03-06 17:24:18 +00:00
eaf971cf25
Add warning log when rejecting request with unknown/expired session ID ( #2212 )
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-06 16:55:37 +00:00
92f1b1500d
fix: remove MIME type validation from MCPServer Resource ( #2235 )
2026-03-06 14:50:58 +00:00
b33c811675
perf: use deque for InMemoryTaskMessageQueue FIFO operations ( #2165 )
2026-03-05 15:44:33 +00:00
7c0224828b
fix(oauth): include client_id in token request body for client_secret_post ( #2185 )
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-03-05 14:57:33 +00:00
528abfab86
tests: remove lax-no-cover pragmas by moving assertions before cancellation ( #2206 )
2026-03-04 16:11:34 +00:00
b3149d2f33
fix: clean up SSE session on client disconnect ( #2200 )
...
Co-authored-by: Varun Sharma <sharmava@microsoft.com >
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-04 14:45:11 +00:00
cc22bf5464
refactor: remove request_ctx ContextVar, thread Context explicitly ( #2203 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-03-04 13:23:02 +00:00
62575edabd
ci: sign weekly lockfile commits as github-actions[bot] ( #2148 )
2026-02-26 15:36:46 +00:00
a4f5ade51e
Fix feedback item
...
🏠 Remote-Dev: homespace
2026-02-20 08:38:29 +00:00
e4172291e7
Fix tests
...
🏠 Remote-Dev: homespace
2026-02-20 08:35:58 +00:00
16d1ab7dae
Merge branch 'main' into localden/tasks-session
2026-02-20 00:27:49 -08:00
0e504fa886
Address feedback
...
🏠 Remote-Dev: homespace
2026-02-20 08:25:09 +00:00
0fe16dd5fd
fix: silence mkdocs social plugin warnings in strict mode ( #2109 )
2026-02-19 23:12:51 +01:00
cb07adeca3
docs: add code fences to Example: docstring blocks ( #2104 )
2026-02-19 21:06:11 +01:00
51372a39a8
Pass through the actual session ID
2026-02-19 07:17:53 +00:00
c0328540c9
docs: fix docstrings across public API surface ( #2095 )
2026-02-19 06:45:59 +01:00
688c6e3ade
Update SECURITY.md to use GitHub Security Advisories ( #2092 )
2026-02-18 21:19:25 -08:00
797cca86ac
Fix the session binding logic for tasks.
2026-02-19 05:18:03 +00:00
43d709c976
ci: pin all GitHub Actions to commit SHAs ( #2088 )
2026-02-18 19:42:00 +00:00
0e96aecd1d
fix: use exact match for loopback hosts in issuer URL validation ( #2089 )
2026-02-18 19:40:52 +00:00
b9431d483f
fix: prevent command injection in example URL opening ( #2082 )
2026-02-18 15:16:44 +00:00
e82203bfc4
refactor: remove unused mcp.shared.progress module ( #2080 )
2026-02-18 13:10:02 +00:00
fc57c2c4c5
test: fix progress notification assertions for related_request_id ( #2038 )
...
Co-authored-by: Lee Hubbard <hubbard.zlee@unknowncyber.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-02-18 11:53:03 +00:00
92140e5086
Add idle session timeout to StreamableHTTPSessionManager ( #2022 )
2026-02-18 10:47:02 +00:00
be5bb7c4f2
fix: normalize trailing slashes before length check in check_resource_allowed ( #2074 )
2026-02-17 14:34:59 +00:00
705497a593
fix: allow null id in JSONRPCError per JSON-RPC 2.0 spec ( #2056 )
2026-02-17 10:30:34 +00:00
3b53fb9a00
fix: add HTTP readiness check to wait_for_server and remove dead code in SSE tests ( #2073 )
2026-02-17 08:34:47 +01:00
2fe56e56de
fix: handle HTTP error status codes in streamable HTTP client ( #2047 )
2026-02-14 09:49:42 +01:00
8f669a77e3
fix: explicitly load required pytest plugins in addopts ( #2055 )
2026-02-13 18:25:10 +00:00
a287a40184
docs: add coverage verification instruction to CLAUDE.md ( #2050 )
2026-02-13 13:10:00 +00:00
29a14ab9e5
fix: skip readme-v1-frozen in CI and add diff-based README.md check ( #2048 )
2026-02-13 10:30:30 +00:00
1e0b5c0479
fix: revert README.md to v1 documentation ( #2045 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-02-12 16:22:07 +00:00
0a22a9dc33
refactor: replace lowlevel Server decorators with on_* constructor kwargs ( #1985 )
2026-02-12 15:55:54 +00:00
d6d3ad9a7c
chore(deps-dev): bump pillow from 12.1.0 to 12.1.1 in the uv group across 1 directory ( #2036 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-11 14:57:37 +00:00
f049c8e5c6
Fix leaked anyio streams in streamable_http ( #1991 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-02-11 14:52:07 +00:00
99edde1125
feat: add /review-pr Claude Code command for PR reviews ( #2035 )
2026-02-11 15:26:43 +01:00
e39038d879
chore(deps): bump cryptography from 45.0.5 to 46.0.5 in the uv group across 1 directory ( #2031 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-11 14:26:16 +01:00
239d682b6f
fix: pass conformance auth scenarios, add RFC 8707 resource validation ( #2010 )
2026-02-09 11:41:03 +00:00
7c7c13b648
fix: send JSONRPCError instead of bare exceptions in streamable HTTP client ( #2005 )
2026-02-09 10:38:46 +00:00
dda845aa12
docs: clarify test file structure convention in CLAUDE.md ( #2006 )
2026-02-07 14:12:54 +01:00
4598ad9361
ci: disable conformance tests ( #2007 )
2026-02-07 14:12:19 +01:00
1a943ad085
chore(deps): bump the uv group across 1 directory with 2 updates ( #1961 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-06 09:07:49 +00:00
d3133ae6ce
chore: update author metadata to LF Projects ( #1992 )
2026-02-04 11:01:33 +00:00
1a8c14a5b8
refactor: replace mcp.types as types to from mcp import types ( #1986 )
2026-02-03 16:42:29 +00:00
4fc49c62bd
feat: add ClientRequestContext type alias for client-side handlers ( #1989 )
2026-02-03 17:37:38 +01:00
74f41ff1ae
Add more maintainers to the PyPI metadata ( #1976 )
2026-02-03 16:19:56 +00:00
b1f7eec3cd
refactor: split RequestContext between server and client ( #1987 )
2026-02-03 14:35:07 +01:00
Den Delimarsky