[GMLP-5458] Sync upstream (#5)

* Add regression test for stateless request memory cleanup (modelcontextprotocol#1140)

* Implement RFC9728 - Support WWW-Authenticate header by MCP client (modelcontextprotocol#1071)

* Add streamable HTTP starlette example to Python SDK docs (modelcontextprotocol#1111)

* fix markdown error in README in main (modelcontextprotocol#1147)

* README - replace code snippets with examples - add lowlevel to snippets (modelcontextprotocol#1150)

* README - replace code snippets with examples - streamable http (modelcontextprotocol#1155)

* chore: don't allow users to create issues outside the templates (modelcontextprotocol#1163)

* Tests(cli): Add coverage for helper functions (modelcontextprotocol#635)

* Docs: Update CallToolResult parsing in README (modelcontextprotocol#812)

Co-authored-by: Felix Weinberger <[email protected]>

* docs: add pre-commit install guide on CONTRIBUTING.md (modelcontextprotocol#995)

Co-authored-by: Felix Weinberger <[email protected]>

* fix flaky fix-test_streamablehttp_client_resumption test (modelcontextprotocol#1166)

* README - replace code snippets with examples -- auth examples (modelcontextprotocol#1164)

* Support falling back to OIDC metadata for auth (modelcontextprotocol#1061)

* Add CODEOWNERS file for sdk (modelcontextprotocol#1169)

* fix flaky test test_88_random_error (modelcontextprotocol#1171)

* Make sure `RequestId` is not coerced as `int` (modelcontextprotocol#1178)

* Fix: Replace threading.Lock with anyio.Lock for Ray deployment compatibility (modelcontextprotocol#1151)

* fix: fix OAuth flow request object handling (modelcontextprotocol#1174)

* update codeowners group (modelcontextprotocol#1191)

* fix: perform auth server metadata discovery fallbacks on any 4xx (modelcontextprotocol#1193)

* server: skip duplicate response on CancelledError (modelcontextprotocol#1153)

Co-authored-by: ihrpr <[email protected]>

* Unpack settings in FastMCP (modelcontextprotocol#1198)

* chore: Remove unused prompt_manager.py file (modelcontextprotocol#1229)

Co-authored-by: Tapan Chugh <[email protected]>

* Improved supported for ProtectedResourceMetadata (modelcontextprotocol#1235)

Co-authored-by: Paul Carleton <[email protected]>

* chore: Remove unused variable notification_options (modelcontextprotocol#1238)

* Improve README around the Context object (modelcontextprotocol#1203)

* fix: allow to pass `list[str]` to `token_endpoint_auth_signing_alg_values_supported` (modelcontextprotocol#1226)

* Remove strict validation on `response_modes_supported` member of `OAuthMetadata` (modelcontextprotocol#1243)

* Add pyright strict mode on the whole project (modelcontextprotocol#1254)

* Consistent casing for default headers Accept and Content-Type (modelcontextprotocol#1263)

* Update dependencies and fix type issues (modelcontextprotocol#1268)

Co-authored-by: Marcelo Trylesinski <[email protected]>

* fix: prevent async generator cleanup errors in StreamableHTTP transport (modelcontextprotocol#1271)

Co-authored-by: David Soria Parra <[email protected]>

* chore: uncomment .idea/ in .gitignore (modelcontextprotocol#1287)

Co-authored-by: Claude <[email protected]>

* docs: clarify streamable_http_path configuration when mounting servers (modelcontextprotocol#1172)

* feat: Add CORS configuration for browser-based MCP clients (modelcontextprotocol#1059)

Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Added Audio to FastMCP (modelcontextprotocol#1130)

* fix: avoid uncessary retries in OAuth authenticated requests (modelcontextprotocol#1206)

Co-authored-by: Felix Weinberger <[email protected]>

* Add PATHEXT to default STDIO env vars in windows (modelcontextprotocol#1256)

* fix: error too many values to unpack (expected 2) (modelcontextprotocol#1279)

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* SDK Parity: Avoid Parsing Server Response for non-JsonRPCMessage Requests (modelcontextprotocol#1290)

* types: Setting default value for method: Literal (modelcontextprotocol#1292)

* changes structured temperature to not deadly (modelcontextprotocol#1328)

* Update simple-resource example to use non-deprecated read_resource return type (modelcontextprotocol#1331)

Co-authored-by: Claude <[email protected]>

* docs: Update README to include link to API docs for modelcontextprotocol#1329 (modelcontextprotocol#1330)

* Allow ping requests before initialization (modelcontextprotocol#1312)

* Python lint: Ruff rules for pylint and code complexity (modelcontextprotocol#525)

* Fix context injection for resources and prompts (modelcontextprotocol#1336)

* fix(fastmcp): propagate mimeType in resource template list (modelcontextprotocol#1186)

Co-authored-by: Felix Weinberger <[email protected]>

* fix: allow elicitations accepted without content (modelcontextprotocol#1285)

Co-authored-by: Olivier Schiavo <[email protected]>

* Use --frozen in pre-commit config (modelcontextprotocol#1375)

* Return HTTP 403 for invalid Origin headers (modelcontextprotocol#1353)

* Add test for ProtectedResourceMetadataParsing (modelcontextprotocol#1236)

Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Fastmcp logging progress example (modelcontextprotocol#1270)

Co-authored-by: Felix Weinberger <[email protected]>

* feat: add paginated list decorators for prompts, resources, and tools (modelcontextprotocol#1286)

Co-authored-by: Claude <[email protected]>

* Remove "unconditionally" from conditional description (modelcontextprotocol#1289)

* Use streamable-http consistently in examples (modelcontextprotocol#1389)

* feat: Add SDK support for SEP-1034 default values in elicitation schemas (modelcontextprotocol#1337)

Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Implementation of SEP 973 - Additional metadata + icons support (modelcontextprotocol#1357)

* Merge upstream/main with custom filtering

---------

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: yurikunash <[email protected]>
Co-authored-by: Pamela Fox <[email protected]>
Co-authored-by: Inna Harper <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Ian Davenport <[email protected]>
Co-authored-by: Dagang Wei <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Stanley Law <[email protected]>
Co-authored-by: Luca Chang <[email protected]>
Co-authored-by: leweng <[email protected]>
Co-authored-by: Clare Liguori <[email protected]>
Co-authored-by: lukacf <[email protected]>
Co-authored-by: ihrpr <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Yann Jouanin <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Sreenath Somarajapuram <[email protected]>
Co-authored-by: Omer Korner <[email protected]>
Co-authored-by: joesavage-silabs <[email protected]>
Co-authored-by: Gregory L <[email protected]>
Co-authored-by: David Soria Parra <[email protected]>
Co-authored-by: Moustapha Ebnou <[email protected]>
Co-authored-by: Max Isbey <[email protected]>
Co-authored-by: Claude <[email protected]>
Co-authored-by: Jerome <[email protected]>
Co-authored-by: xavier <[email protected]>
Co-authored-by: keurcien <[email protected]>
Co-authored-by: Tim Esler <[email protected]>
Co-authored-by: San Nguyen <[email protected]>
Co-authored-by: Justin Wang <[email protected]>
Co-authored-by: jess <[email protected]>
Co-authored-by: Peter Alexander <[email protected]>
Co-authored-by: Reid Geyer <[email protected]>
Co-authored-by: Eleftheria Stein-Kousathana <[email protected]>
Co-authored-by: Christian Clauss <[email protected]>
Co-authored-by: pchoudhury22 <[email protected]>
Co-authored-by: owengo <[email protected]>
Co-authored-by: Olivier Schiavo <[email protected]>
Co-authored-by: Steve Billings <[email protected]>
Co-authored-by: Mike Salvatore <[email protected]>

Author: 41 people

.gitattribute

@@ -0,0 +1,2 @@
+# Generated
+uv.lock  linguist-generated=true

.github/CODEOWNERS

@@ -0,0 +1,23 @@
+# CODEOWNERS for MCP Python SDK
+# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default maintainers for everything
+* @modelcontextprotocol/python-sdk
+
+# Auth-related code requires additional review from auth team
+/src/mcp/client/auth.py @modelcontextprotocol/python-sdk-auth
+/src/mcp/server/auth/ @modelcontextprotocol/python-sdk-auth
+/src/mcp/server/transport_security.py @modelcontextprotocol/python-sdk-auth
+/src/mcp/shared/auth*.py @modelcontextprotocol/python-sdk-auth
+
+# Auth-related tests
+/tests/client/test_auth.py @modelcontextprotocol/python-sdk-auth
+/tests/server/auth/ @modelcontextprotocol/python-sdk-auth
+/tests/server/test_*security.py @modelcontextprotocol/python-sdk-auth
+/tests/server/fastmcp/auth/ @modelcontextprotocol/python-sdk-auth
+/tests/shared/test_auth*.py @modelcontextprotocol/python-sdk-auth
+
+# Auth-related examples
+/examples/clients/simple-auth-client/ @modelcontextprotocol/python-sdk-auth
+/examples/snippets/clients/oauth_client.py @modelcontextprotocol/python-sdk-auth
+/examples/snippets/servers/oauth_server.py @modelcontextprotocol/python-sdk-auth

.github/ISSUE_TEMPLATE/config.yaml

@@ -1 +1 @@
-blank_issues_enabled: true
+blank_issues_enabled: false

.github/workflows/shared.yml

@@ -6,6 +6,9 @@ on:
 permissions:
   contents: read
 
+env:
+  COLUMNS: 150
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
@@ -33,6 +36,7 @@ jobs:
     strategy:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
+        dep-resolution: ["lowest-direct", "highest"]
         os: [ubuntu-latest, windows-latest]
 
     steps:
@@ -45,18 +49,11 @@ jobs:
           version: 0.7.2
 
       - name: Install the project
-        run: uv sync --frozen --all-extras --python ${{ matrix.python-version }}
+        run: uv sync --frozen --all-extras --python ${{ matrix.python-version }} --resolution ${{ matrix.dep-resolution }}
 
       - name: Run pytest
         run: uv run --frozen --no-sync pytest
 
-      # This must run last as it modifies the environment!
-      - name: Run pytest with lowest versions
-        run: |
-          uv sync --all-extras --upgrade
-          uv run --no-sync pytest
-        env:
-          UV_RESOLUTION: lowest-direct
   readme-snippets:
     runs-on: ubuntu-latest
     steps:

.gitignore

@@ -52,6 +52,7 @@ coverage.xml
 *.py,cover
 .hypothesis/
 .pytest_cache/
+.ruff_cache/
 cover/
 
 # Translations
@@ -162,9 +163,12 @@ cython_debug/
 #  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
-#.idea/
+.idea/
 
 # vscode
 .vscode/
 .windsurfrules
 **/CLAUDE.local.md
+
+# claude code
+.claude/

.pre-commit-config.yaml

@@ -25,22 +25,22 @@ repos:
     hooks:
       - id: ruff-format
         name: Ruff Format
-        entry: uv run ruff
+        entry: uv run --frozen ruff
         args: [format]
         language: system
         types: [python]
         pass_filenames: false
       - id: ruff
         name: Ruff
-        entry: uv run ruff
+        entry: uv run --frozen ruff
         args: ["check", "--fix", "--exit-non-zero-on-fix"]
         types: [python]
         language: system
         pass_filenames: false
         exclude: ^README\.md$
       - id: pyright
         name: pyright
-        entry: uv run pyright
+        entry: uv run --frozen pyright
         language: system
         types: [python]
         pass_filenames: false
@@ -52,7 +52,7 @@ repos:
         pass_filenames: false
       - id: readme-snippets
         name: Check README snippets are up to date
-        entry: uv run scripts/update_readme_snippets.py --check
+        entry: uv run --frozen python scripts/update_readme_snippets.py --check
         language: system
         files: ^(README\.md|examples/.*\.py|scripts/update_readme_snippets\.py)$
         pass_filenames: false

CONTRIBUTING.md

@@ -14,6 +14,12 @@ Thank you for your interest in contributing to the MCP Python SDK! This document
 uv sync --frozen --all-extras --dev
 ```
 
+6. Set up pre-commit hooks:
+
+```bash
+uv tool install pre-commit --with pre-commit-uv --force-reinstall
+```
+
 ## Development Workflow
 
 1. Choose the correct branch for your changes:
@@ -50,7 +56,13 @@ uv run ruff format .
 uv run scripts/update_readme_snippets.py
 ```
 
-8. Submit a pull request to the same branch you branched from
+8. (Optional) Run pre-commit hooks on all files:
+
+```bash
+pre-commit run --all-files
+```
+
+9. Submit a pull request to the same branch you branched from
 
 ## Code Style
 

examples/clients/simple-auth-client/README.md

@@ -71,4 +71,4 @@ mcp> quit
 ## Configuration
 
 - `MCP_SERVER_PORT` - Server URL (default: 8000)
-- `MCP_TRANSPORT_TYPE` - Transport type: `streamable_http` (default) or `sse`
+- `MCP_TRANSPORT_TYPE` - Transport type: `streamable-http` (default) or `sse`

examples/clients/simple-auth-client/mcp_simple_auth_client/main.py

@@ -150,7 +150,7 @@ def get_state(self):
 class SimpleAuthClient:
     """Simple MCP client with auth support."""
 
-    def __init__(self, server_url: str, transport_type: str = "streamable_http"):
+    def __init__(self, server_url: str, transport_type: str = "streamable-http"):
         self.server_url = server_url
         self.transport_type = transport_type
         self.session: ClientSession | None = None
@@ -188,9 +188,7 @@ async def _default_redirect_handler(authorization_url: str) -> None:
             # Create OAuth authentication handler using the new interface
             oauth_auth = OAuthClientProvider(
                 server_url=self.server_url.replace("/mcp", ""),
-                client_metadata=OAuthClientMetadata.model_validate(
-                    client_metadata_dict
-                ),
+                client_metadata=OAuthClientMetadata.model_validate(client_metadata_dict),
                 storage=InMemoryTokenStorage(),
                 redirect_handler=_default_redirect_handler,
                 callback_handler=callback_handler,
@@ -322,9 +320,7 @@ async def interactive_loop(self):
                     await self.call_tool(tool_name, arguments)
 
                 else:
-                    print(
-                        "❌ Unknown command. Try 'list', 'call <tool_name>', or 'quit'"
-                    )
+                    print("❌ Unknown command. Try 'list', 'call <tool_name>', or 'quit'")
 
             except KeyboardInterrupt:
                 print("\n\n👋 Goodbye!")
@@ -338,10 +334,10 @@ async def main():
     # Default server URL - can be overridden with environment variable
     # Most MCP streamable HTTP servers use /mcp as the endpoint
     server_url = os.getenv("MCP_SERVER_PORT", 8000)
-    transport_type = os.getenv("MCP_TRANSPORT_TYPE", "streamable_http")
+    transport_type = os.getenv("MCP_TRANSPORT_TYPE", "streamable-http")
     server_url = (
         f"http://localhost:{server_url}/mcp"
-        if transport_type == "streamable_http"
+        if transport_type == "streamable-http"
         else f"http://localhost:{server_url}/sse"
     )
 

examples/clients/simple-auth-client/pyproject.toml

@@ -15,7 +15,7 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
 ]
 dependencies = [
-    "click>=8.0.0",
+    "click>=8.2.0",
     "mcp>=1.0.0",
 ]
 
@@ -39,7 +39,7 @@ select = ["E", "F", "I"]
 ignore = []
 
 [tool.ruff]
-line-length = 88
+line-length = 120
 target-version = "py310"
 
 [tool.uv]