b8a107d16c
Scope HTTP client redirect following to the request's origin
...
create_mcp_http_client followed every redirect, so everything configured
on a client (headers, auth, request bodies) was re-sent to whatever host
a Location header named. Clients built by the factory now follow
redirects within the same origin (scheme, host, and port), plus
http-to-https upgrades of the same host on default ports, and raise the
new RedirectError for anything else - before the next request is sent.
- transports resolve a refused redirect in-band: requests get a JSON-RPC
error naming the target and the remedy, notifications are delivered to
the session's message handler; the standalone GET stream stops
retrying an endpoint that keeps redirecting
- caller-supplied clients that follow no redirects get the same clear
error on POST, GET stream, and SSE connect instead of an opaque
content-type error
- OAuth discovery, registration, token, refresh, and the
identity-assertion token exchange fail loudly on redirect responses
instead of silently trying the next URL or abandoning the discovery
chain
- RedirectError and create_mcp_http_client are exported from the
top-level mcp package; migration.md documents the behavior change;
docs and examples configure clients through the factory, and the
general-purpose fetch example uses a browser-like client of its own
2026-07-07 19:41:45 +00:00
9bdc03d54e
Add the client-side subscriptions/listen driver ( #3047 )
2026-07-07 14:26:09 +01:00
d287c9868f
Extend resolver DI to sampling and roots requests ( #3049 )
2026-07-06 18:25:57 +01:00
bf4402725d
docs: restructure the migration guide around topical groups with a navigation layer ( #3058 )
2026-07-02 18:54:21 +01:00
2359b40285
docs: modernize the site theme ( #3057 )
2026-07-02 16:17:33 +01:00
e4d95e0d44
docs: add a "What's new in v2" page ( #3054 )
2026-07-02 15:01:30 +01:00
220d362112
docs: restructure into topical sections and add the four most-asked-for pages ( #3044 )
2026-07-01 21:06:04 +01:00
080f2a869d
Harden the dual-era stream loop's era-lock and rejection semantics ( #3040 )
2026-07-01 17:07:12 +01:00
0da9092037
Point pre-release install pins at 2.0.0b1 ( #3039 )
CI / checks (push) Failing after 0s
CI / all-green (push) Has been cancelled
2026-07-01 00:14:52 +01:00
410cc0db31
Add v2 feedback issue template ( #3037 )
2026-07-01 00:03:11 +01:00
ca10dade2c
Serve subscriptions/listen with a pluggable event bus (SEP-2575) ( #3035 )
2026-06-30 23:01:04 +01:00
48ef569f7e
Validate Mcp-Param-* headers server-side on the 2026-07-28 HTTP path (SEP-2243) ( #3033 )
2026-06-30 21:39:32 +01:00
4df609119f
Add a client extension API ( #3034 )
2026-06-30 21:31:02 +01:00
7322ca56f4
Require integrity protection for MRTR requestState ( #3032 )
2026-06-30 21:30:32 +01:00
b15b1d5f07
Add a client-side response cache honoring SEP-2549 caching hints ( #3023 )
2026-06-30 11:31:06 +01:00
67d7593df1
docs: publish llms.txt and markdown renditions of the docs ( #3024 )
2026-06-30 11:30:55 +01:00
8d0f928e40
Pass InputRequiredResult through the MCPServer prompt and resource pipelines ( #3020 )
2026-06-29 16:50:58 +01:00
8f2c97b769
Consult request_state only for the question a resolver is asking ( #3019 )
2026-06-29 16:44:05 +01:00
533c6a8226
Add cache_hints constructor map for SEP-2549 caching hints ( #3015 )
2026-06-29 14:11:15 +00:00
c85836a081
Drive resolver elicitation over the 2026-07-28 input_required flow ( #2986 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-29 14:39:43 +01:00
24fdd909ac
docs: convert bold cross-references into links, link SEP and RFC mentions ( #3017 )
2026-06-29 11:07:26 +00:00
f664db8952
Add resolver dependency injection for MCPServer tools ( #2969 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-29 11:51:46 +01:00
4b519782f1
Add a pluggable server extension API with MCP Apps ( #3003 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-29 10:58:05 +01:00
3b78f86886
Add docs, tested examples, and a story for SEP-990 identity assertion ( #3004 )
2026-06-26 21:01:46 +02:00
24717cc8eb
feat: RFC 6570 URI templates with operator-aware security ( #2356 )
2026-06-26 20:29:17 +02:00
c0ecb70e24
Support RFC 8693 token exchange for enterprise IdP flows (SEP-990) ( #2988 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-26 17:57:10 +02:00
ecdf09d44f
Deprecate Server.__init__ handlers for removed capabilities ( #3002 )
2026-06-26 17:51:13 +02:00
08b62308d4
Client auto-resolves InputRequiredResult via existing callbacks (SEP-2322) ( #2998 )
2026-06-26 17:35:23 +02:00
b31d95a429
Make OpenTelemetry tracing the single default middleware ( #2995 )
2026-06-26 15:47:37 +02:00
5b2713d40c
Mirror x-mcp-header tool arguments into Mcp-Param-* request headers (SEP-2243) ( #2990 )
2026-06-26 14:36:56 +02:00
3a8da8c0c3
Fix docs/release follow-ups from the mcp-types package split ( #2977 )
2026-06-26 13:16:09 +02:00
411a6d3980
Rebuild the docs around tested examples; shrink README.v2.md to a pitch ( #2978 )
2026-06-26 12:49:19 +02:00
f41a5193f3
Preserve empty issuer/resource paths on AuthSettings ( #2987 )
2026-06-26 11:41:41 +02:00
587340279e
Conformance burn-down: server-side InputRequiredResult, Mcp-Method/Name validation, x-mcp-header filter (14 scenarios → green) ( #2974 )
CI / checks (push) Failing after 0s
CI / all-green (push) Has been cancelled
2026-06-26 09:51:59 +02:00
0ee7f1b293
Split protocol types into a standalone mcp-types package ( #2973 )
2026-06-25 19:18:38 +02:00
03681ed55e
Client call_tool: input_responses/request_state retry params; InputRequiredResult via allow_input_required ( #2968 )
2026-06-25 17:37:00 +02:00
f226d00d0a
Client-side 2026-07-28 support: .discover()/.adopt() + Client(mode=); request-metadata green ( #2950 )
2026-06-25 16:09:23 +02:00
ad81ca234a
Slim ServerMiddleware to (ctx, call_next) and add OpenTelemetryMiddleware ( #2941 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-22 14:46:30 +01:00
2397319a68
Server-side 2026-07-28 stateless support: classifier, driver split, server/discover ( #2928 )
2026-06-21 19:34:17 +01:00
44724284b3
Bind client credentials to their authorization server (SEP-2352) ( #2933 )
2026-06-20 18:47:22 +01:00
1331131650
Union previously requested scopes on step-up re-authorization (SEP-2350) ( #2931 )
2026-06-20 18:45:04 +02:00
4573e4ac33
Deprecate roots, sampling, and logging methods per SEP-2577 ( #2926 )
2026-06-20 18:25:41 +02:00
cf41441e44
Send application_type during Dynamic Client Registration (SEP-837) ( #2930 )
2026-06-20 18:19:12 +02:00
60f37e9d7c
Document redirect_uri wire-format change in OAuth migration note ( #2929 )
2026-06-20 16:14:03 +00:00
48cf4950dc
Validate the iss authorization-response parameter (RFC 9207 / SEP-2468) ( #2921 )
2026-06-20 17:54:18 +02:00
b7a5bffed0
Preserve empty URL paths on OAuth metadata models ( #2925 )
2026-06-20 15:32:03 +00:00
fda4c54362
fix: correct MCPServer call_tool result type ( #2816 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-06-20 16:56:16 +02:00
f253682393
Return -32602 for resource not found (SEP-2164) ( #2920 )
2026-06-20 16:55:23 +02:00
84bf9bde05
First end-to-end 2026-07-28 stateless tools/call (experimental entry + ClientSession pin) ( #2917 )
2026-06-20 14:55:59 +01:00
734746a3d9
Resolve protocol version per request and expose it as ctx.protocol_version ( #2886 )
2026-06-17 08:46:42 +01:00
Max Isbey