MCP Python SDK v1.30.0
MCP Python SDK v1.30.0 introduces tighter security defaults for HTTP redirects, adds idle session timeouts and session caps, and tightens OAuth issuer validation.
Why this signal matters
MCP Python SDK v1.30.0 is a maintenance release for the 1.x line introducing several default behavior changes. HTTP and SSE clients now only follow redirects within the endpoint's origin (or upgrade to HTTPS on the same host), failing out-of-origin redirects with httpx.HTTPStatusError. Streamable HTTP sessions on FastMCP now expire after 30 minutes of inactivity and are capped at 10,000 concurrent sessions by default (configurable via session idle timeout and max sessions). OAuth client flows now enforce that authorization server metadata matches the requested issuer, cache registrations per issuer, and halt instead of falling back on 5xx/429 responses. Deprecation warnings were added for ClientCredentialsOAuthProvider/PrivateKeyJWTOAuthProvider when missing the issuer parameter, and for AuthSettings when resource server url is defined without explicitly setting validate token resource.
Actionable summary
Maintenance release v1.30.0 for the MCP Python 1.x line enforces strict origin validation for HTTP redirects, sets a 30-minute idle session timeout and 10,000 session limit in FastMCP, validates OAuth authorization server issuers, and adds deprecation warnings for missing issuer and token resource validation settings.
- Agent usefulness
- 77/100
- Confidence
- 96%
- Canonical data
- JSON + Markdown
What builders should check
- Verify endpoint URLs if relying on cross-origin redirects, as clients will now raise httpx.HTTPStatusError instead of following them.
- Adjust FastMCP(session idle timeout=..., max sessions=...) if your server environment requires keeping idle sessions alive longer than 30 minutes or serving over 10,000 concurrent sessions.
- Add explicit issuer= parameters to ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider instances to avoid deprecation warnings.
- Explicitly set validate token resource to True or False in AuthSettings when resource server url is configured.