create_mcp_http_client followed every redirect, so everything configured
on a client (headers, auth, request bodies) was re-sent to whatever host
a Location header named. Clients built by the factory now follow
redirects within the same origin (scheme, host, and port), plus
http-to-https upgrades of the same host on default ports, and raise the
new RedirectError for anything else - before the next request is sent.
- transports resolve a refused redirect in-band: requests get a JSON-RPC
error naming the target and the remedy, notifications are delivered to
the session's message handler; the standalone GET stream stops
retrying an endpoint that keeps redirecting
- caller-supplied clients that follow no redirects get the same clear
error on POST, GET stream, and SSE connect instead of an opaque
content-type error
- OAuth discovery, registration, token, refresh, and the
identity-assertion token exchange fail loudly on redirect responses
instead of silently trying the next URL or abandoning the discovery
chain
- RedirectError and create_mcp_http_client are exported from the
top-level mcp package; migration.md documents the behavior change;
docs and examples configure clients through the factory, and the
general-purpose fetch example uses a browser-like client of its own
Max Isbey