Max Isbey
c53aefd293
Review-feedback round on the conformance burn-down: - Cancelled requests no longer leave the legacy streamable-HTTP POST hanging. The dispatcher emits a RequestSettled marker when a handler is cancelled without producing a response; the transport consumes it by closing the per-request stream, so the POST's SSE stream terminates without a response frame and JSON-response mode completes with 204 No Content (the client treats 202/204 alike). Per-request streams are released instead of leaking until session teardown, and a handler that survives the cancellation still delivers its normal response. The marker is type-visible on the dispatcher write stream and is stripped by every serializing transport, so it can never appear on a wire. - A bearer token whose audience cannot be canonicalized (out-of-range or non-numeric port) is now rejected with the standard 401 invalid_token instead of raising through the auth middleware as a 500. - The bundled authorization server's /register now accepts only https redirect URIs or http on a loopback host; other schemes on loopback hosts (ftp, ws, javascript, custom) are rejected. - OAuth client scope selection falls back to the caller-configured OAuthClientMetadata.scope when neither the WWW-Authenticate challenge nor protected-resource metadata names scopes, matching the TypeScript SDK, so the documented migration path works as written. - The cross-dispatcher contract that handler-raised MCPError subclasses surface to callers as plain MCPError is now pinned by an explicit test and documented; rehydrate with from_error when the subclass matters. - Docs: migration notes for the bearer-challenge wire-shape changes and the cancellation wire spellings; story READMEs updated to the landed error contract; strict-capabilities doc corrected to state that resources/unsubscribe is gated by the base resources capability only.
Python SDK examples
stories/— the canonical reference. One self-verifying example per protocol feature, each with its own README. Start withstories/tools/; the stories README has the full table and how to run them.snippets/— short extracts embedded intoREADME.v2.md. Kept minimal and in sync with the top-level README; not intended to be run standalone.servers/everything-server/— the conformance target for the cross-SDK conformance suite. Exercises every server capability in one process.mcpserver/— single-file v1-era examples retained for the migration guide; superseded bystories/and slated for removal.clients/and the remainingservers/directories (simple-*,sse-polling-demo,structured-output-lowlevel) — standalone v1-era projects still linked fromREADME.v2.md; retained pending consolidation intostories/.
For real-world servers see the servers repository.