MCP Python SDK v1.30.0
MCP Python SDK v1.30.0 introduces tighter HTTP redirect rules, idle session timeouts, and stricter OAuth issuer validation for the 1.x maintenance branch.
原始内容为英文；当前页面提供中文导航与来源说明，具体事实请以原文为准。
为什么值得关注
MCP Python SDK v1.30.0 has been released as a maintenance update for the 1.x line. Key behavioral changes include: HTTP client redirects (streamable HTTP client, SSE client, and OAuthClientProvider) are now followed only within the same origin or when upgrading HTTP to HTTPS on the same host, with cross-origin redirects failing via httpx.HTTPStatusError. Streamable HTTP sessions on FastMCP now expire after 30 minutes of inactivity and are capped at 10,000 concurrent sessions by default (configurable via session idle timeout and max sessions). OAuth client providers now validate the authorization server issuer matching the fetch URL, store registrations per issuer, and stop discovery on 5xx/429 errors instead of falling back to legacy endpoints. Two deprecation warnings were added: omitting issuer in ClientCredentialsOAuthProvider/PrivateKeyJWTOAuthProvider, and setting AuthSettings.resource server url without explicitly specifying validate token resource. Additionally, tool output schema references are now resolved strictly within the schema document.
可执行摘要
Release v1.30.0 of the MCP Python SDK (1.x line) modifies HTTP redirect handling to restrict cross-origin redirects, adds a 30-minute idle session timeout and 10k session cap on FastMCP servers, and enforces authorization server metadata issuer matching in OAuth clients.
- Agent 实用度
- 82/100
- 可信度
- 96%
- 机器格式
- JSON + Markdown
开发者应核对什么
- Update endpoint URLs directly if your MCP clients or OAuth providers previously depended on cross-origin redirects.
- Configure FastMCP(session idle timeout=None, max sessions=None) if you need to maintain long-lived idle sessions beyond 30 minutes or support over 10,000 concurrent sessions.
- Supply the issuer URL when instantiating ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider to avoid DeprecationWarning.
- Explicitly set validate token resource to True or False in AuthSettings when resource server url is defined to avoid DeprecationWarning.