[dependabot]

Bumps the uv group with 1 update in the / directory: mcp.

Updates mcp from 1.29.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

• streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
• A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
• The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
• OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

• A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
• Clients that keep the GET stream open (the SDK's client does) are not affected.
• A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
• To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

• Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
• Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
• If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

• ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
• AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
• Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

• AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
• issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
• session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

• [v1.x] Resolve tool output-schema references within the schema document only by @​maxisbey in modelcontextprotocol/python-sdk#3396
• [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @​maxisbey in modelcontextprotocol/python-sdk#3426
• [v1.x] Validate the authorization server metadata issuer on every discovery path by @​maxisbey in modelcontextprotocol/python-sdk#3431
• [v1.x] Follow redirects only within the MCP endpoint's origin by @​maxisbey in modelcontextprotocol/python-sdk#3448
• [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @​maxisbey in modelcontextprotocol/python-sdk#3451

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

Commits

• 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
• 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
• 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
• 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
• 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[fmueller]

@dependabot rebase