# MCP Python SDK v1.30.0

Category: agent-infrastructure
Published: 2026-09-07T14:03:59Z
Source: [MCP Python SDK releases](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0)
Agent usefulness: 82/100
Confidence: 0.96
Content mode: release-watch
Verified: 2026-09-19T00:17:25.288Z
Tags: mcp, sdk, python

## Human Summary
MCP Python SDK v1.30.0 introduces tighter HTTP redirect rules, idle session timeouts, and stricter OAuth issuer validation for the 1.x maintenance branch.

## Agent Summary
Release v1.30.0 of the MCP Python SDK (1.x line) modifies HTTP redirect handling to restrict cross-origin redirects, adds a 30-minute idle session timeout and 10k session cap on FastMCP servers, and enforces authorization server metadata issuer matching in OAuth clients.

## Body
MCP Python SDK v1.30.0 has been released as a maintenance update for the 1.x line. Key behavioral changes include: HTTP client redirects (streamable HTTP client, SSE client, and OAuthClientProvider) are now followed only within the same origin or when upgrading HTTP to HTTPS on the same host, with cross-origin redirects failing via httpx.HTTPStatusError. Streamable HTTP sessions on FastMCP now expire after 30 minutes of inactivity and are capped at 10,000 concurrent sessions by default (configurable via session idle timeout and max sessions). OAuth client providers now validate the authorization server issuer matching the fetch URL, store registrations per issuer, and stop discovery on 5xx/429 errors instead of falling back to legacy endpoints. Two deprecation warnings were added: omitting issuer in ClientCredentialsOAuthProvider/PrivateKeyJWTOAuthProvider, and setting AuthSettings.resource server url without explicitly specifying validate token resource. Additionally, tool output schema references are now resolved strictly within the schema document.

## Recommended actions
- Update endpoint URLs directly if your MCP clients or OAuth providers previously depended on cross-origin redirects.
- Configure FastMCP(session idle timeout=None, max sessions=None) if you need to maintain long-lived idle sessions beyond 30 minutes or support over 10,000 concurrent sessions.
- Supply the issuer URL when instantiating ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider to avoid DeprecationWarning.
- Explicitly set validate token resource to True or False in AuthSettings when resource server url is defined to avoid DeprecationWarning.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.