modelcontextprotocol/python-sdk v1.30.0 on GitHub

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
Clients that keep the GET stream open (the SDK's client does) are not affected.
A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
session_idle_timeout= and max_sessions= on FastMCP (#3426).

[v1.x] Resolve tool output-schema references within the schema document only by @maxisbey in #3396
[v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @maxisbey in #3426
[v1.x] Validate the authorization server metadata issuer on every discovery path by @maxisbey in #3431
[v1.x] Follow redirects only within the MCP endpoint's origin by @maxisbey in #3448
[v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @maxisbey in #3451

Full Changelog: v1.29.1...v1.30.0