Review-feedback round on the conformance burn-down:
- Cancelled requests no longer leave the legacy streamable-HTTP POST
hanging. The dispatcher emits a RequestSettled marker when a handler is
cancelled without producing a response; the transport consumes it by
closing the per-request stream, so the POST's SSE stream terminates
without a response frame and JSON-response mode completes with 204 No
Content (the client treats 202/204 alike). Per-request streams are
released instead of leaking until session teardown, and a handler that
survives the cancellation still delivers its normal response. The
marker is type-visible on the dispatcher write stream and is stripped
by every serializing transport, so it can never appear on a wire.
- A bearer token whose audience cannot be canonicalized (out-of-range or
non-numeric port) is now rejected with the standard 401 invalid_token
instead of raising through the auth middleware as a 500.
- The bundled authorization server's /register now accepts only https
redirect URIs or http on a loopback host; other schemes on loopback
hosts (ftp, ws, javascript, custom) are rejected.
- OAuth client scope selection falls back to the caller-configured
OAuthClientMetadata.scope when neither the WWW-Authenticate challenge
nor protected-resource metadata names scopes, matching the TypeScript
SDK, so the documented migration path works as written.
- The cross-dispatcher contract that handler-raised MCPError subclasses
surface to callers as plain MCPError is now pinned by an explicit test
and documented; rehydrate with from_error when the subclass matters.
- Docs: migration notes for the bearer-challenge wire-shape changes and
the cancellation wire spellings; story READMEs updated to the landed
error contract; strict-capabilities doc corrected to state that
resources/unsubscribe is gated by the base resources capability only.
Max Isbey
c53aefd293