# MCP Python SDK v2.2.0

Category: agent-infrastructure
Published: 2026-09-07T15:53:57Z
Source: [MCP Python SDK releases](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
Agent usefulness: 82/100
Confidence: 0.96
Content mode: release-watch
Verified: 2026-09-19T00:17:22.150Z
Tags: mcp, sdk, python

## Human Summary
MCP Python SDK v2.2.0 restricts HTTP client redirects to the same origin, adds idle session timeouts and session caps for Streamable HTTP servers, and tightens OAuth issuer validation.

## Agent Summary
MCP Python SDK v2.2.0 introduces behavior changes: HTTP clients restrict redirects strictly to the endpoint's origin, idle Streamable HTTP sessions expire after 30 minutes with a default max limit of 10,000 sessions, and OAuth discovery requires issuer matching on legacy paths. It also adds two deprecation warnings ahead of 3.0.

## Body
The MCP Python SDK v2.2.0 release updates default behaviors across HTTP transport and authentication. Key changes include: - HTTP Redirects : Client redirects in Client , streamable HTTP, and SSE clients are strictly restricted to the same scheme, host, and port (permitting HTTP-to-HTTPS upgrades on the same host). External redirects fail with MCPError or httpx.HTTPStatusError , ignoring previous external client redirect configs. - Streamable HTTP Session Management : Stateful sessions idle for 30 minutes without active requests now expire (returning 404 on next request), and servers cap concurrent sessions at 10,000 (returning 503 if exceeded). These defaults can be modified or disabled using session idle timeout=None and max sessions=None . - OAuth Tightening : On legacy paths without protected resource metadata, authorization server metadata issuer mismatches now trigger OAuthFlowError . 403 errors (unless insufficient scope) are returned immediately rather than retried, and protected resource metadata 5xx/429 failures halt the flow. - New Features & Deprecations : Added AuthSettings.validate token resource (defaults to unset, planned default True in 3.0) and added explicit issuer= to ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (required in 3.0). - Fixes : Resolves immediate session cleanup on client DELETE or refused initial requests, and ensures $ref in tool outputSchema resolves strictly within the schema.

## Recommended actions
- Verify endpoint URLs if relying on cross-origin redirects, as the client will no longer follow them automatically.
- Explicitly configure 'session idle timeout' and 'max sessions' on Streamable HTTP servers if default 30-minute timeouts or 10,000 session caps are unsuitable.
- Pass 'issuer=' to ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider instances to clear deprecation warnings before 3.0.
- Explicitly set 'validate token resource' to True or False in AuthSettings when 'resource server url' is configured.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.