chore(deps): update dependency mcp to v1.23.0 [security] (#589)

renovate[bot] · web-flow · commit a0e90f911cc3 · 2025-12-04T17:19:07.000+01:00
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [mcp](https://redirect.github.com/modelcontextprotocol/python-sdk) | `==1.16.0` -> `==1.23.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/mcp/1.23.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/mcp/1.16.0/1.23.0?slim=true) | ### GitHub Vulnerability Alerts #### [CVE-2025-66416](https://redirect.github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f) ### Description The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. Servers created via `FastMCP()` now have DNS rebinding protection enabled by default when the `host` parameter is `127.0.0.1` or `localhost`. Users are advised to update to version `1.23.0` to receive this automatic protection. Users with custom low-level server configurations using `StreamableHTTPSessionManager` or `SseServerTransport` directly should explicitly configure `TransportSecuritySettings` when running an unauthenticated server on localhost. --- ### Release Notes <details> <summary>modelcontextprotocol/python-sdk (mcp)</summary> ### [`v1.23.0`](https://redirect.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.23.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/python-sdk/compare/v1.22.0...v1.23.0) ##### Summary This release brings us up to speed with the latest MCP spec `2025-11-25`. Take a look at the [latest spec](https://modelcontextprotocol.io/specification/2025-11-25) as well as the release [blog post.](https://blog.modelcontextprotocol.io/posts/2025-11-25-first-mcp-anniversary/) ##### What's Changed - Add tests for JSON Schema 2020-12 field preservation (SEP-1613) by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1649](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1649) - Add client\_secret\_basic authentication support by [@&#8203;jonshea](https://redirect.github.com/jonshea) in [#&#8203;1334](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1334) - Implement SEP-1577 - Sampling With Tools by [@&#8203;ochafik](https://redirect.github.com/ochafik) in [#&#8203;1594](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1594) - SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance by [@&#8203;chughtapan](https://redirect.github.com/chughtapan) in [#&#8203;1246](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1246) - \[auth]\[conformance] add conformance auth client by [@&#8203;pcarleton](https://redirect.github.com/pcarleton) in [#&#8203;1640](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1640) - Implement SEP-986: Tool name validation by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1655](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1655) - fix: url for spec by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1659](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1659) - feat: implement SEP-991 URL-based client ID (CIMD) support by [@&#8203;pcarleton](https://redirect.github.com/pcarleton) in [#&#8203;1652](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1652) - Update doc string on custom\_route by [@&#8203;pcarleton](https://redirect.github.com/pcarleton) in [#&#8203;1660](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1660) - Implement SEP-1036: URL mode elicitation for secure out-of-band interactions by [@&#8203;cbcoutinho](https://redirect.github.com/cbcoutinho) in [#&#8203;1580](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1580) - Skip empty SSE data to avoid parsing errors by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1670](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1670) - SEP-1686: Tasks by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1645](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1645) - Add on\_session\_created callback option by [@&#8203;crondinini-ant](https://redirect.github.com/crondinini-ant) in [#&#8203;1710](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1710) - Add SSE polling support (SEP-1699) by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1654](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1654) - Support client\_credentials flow with JWT and Basic auth by [@&#8203;pcarleton](https://redirect.github.com/pcarleton) in [#&#8203;1663](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1663) - feat: backwards-compatible create\_message overloads for SEP-1577 by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1713](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1713) - Auto-enable DNS rebinding protection for localhost servers by [@&#8203;pcarleton](https://redirect.github.com/pcarleton) ([`d3a1841`](https://redirect.github.com/modelcontextprotocol/python-sdk/commit/d3a184119e4479ea6a63590bc41f01dc06e3fa99)) ##### New Contributors - [@&#8203;ochafik](https://redirect.github.com/ochafik) made their first contribution in [#&#8203;1594](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1594) **Full Changelog**: <modelcontextprotocol/python-sdk@v1.22.0...v1.23.0> ### [`v1.22.0`](https://redirect.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.22.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/python-sdk/compare/v1.21.2...v1.22.0) #### What's Changed - feat: Pass through and expose additional parameters in `ClientSessionGroup.call_tool` and `.connect_to_server` by [@&#8203;inaku-Gyan](https://redirect.github.com/inaku-Gyan) in [#&#8203;1576](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1576) - chore: Lazy import `jsonschema` library by [@&#8203;wuliang229](https://redirect.github.com/wuliang229) in [#&#8203;1596](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1596) - docs: Update examples to use stateless HTTP with JSON responses by [@&#8203;domdomegg](https://redirect.github.com/domdomegg) in [#&#8203;1499](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1499) #### New Contributors - [@&#8203;wuliang229](https://redirect.github.com/wuliang229) made their first contribution in [#&#8203;1596](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1596) **Full Changelog**: <modelcontextprotocol/python-sdk@v1.21.1...v1.22.0> ### [`v1.21.2`](https://redirect.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.21.2) [Compare Source](https://redirect.github.com/modelcontextprotocol/python-sdk/compare/v1.21.1...v1.21.2) #### Hotfix Release This is a hotfix release to address a critical bug in OAuth scope handling that caused failures on 401 responses. ##### Related: - [#&#8203;1630](https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1630) - [#&#8203;1632](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1632) #### What's Changed - fix get\_client\_metadata\_scopes on 401 by [@&#8203;abliznyuk](https://redirect.github.com/abliznyuk) in [#&#8203;1631](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1631) #### New Contributors - [@&#8203;abliznyuk](https://redirect.github.com/abliznyuk) made their first contribution in [#&#8203;1631](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1631) **Full Changelog**: <modelcontextprotocol/python-sdk@v1.21.1...v1.21.2> ### [`v1.21.1`](https://redirect.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.21.1) [Compare Source](https://redirect.github.com/modelcontextprotocol/python-sdk/compare/v1.21.0...v1.21.1) #### What's Changed - Add everything-server for comprehensive MCP conformance testing by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1587](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1587) - Get baseline 100% clean coverage by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1553](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1553) - Add end-of-file-fixer pre-commit hook by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1610](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1610) - Add coverage baseline commit to git-blame-ignore by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1613](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1613) - Add SEP-1034 conformance test support to everything-server by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1604](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1604) - refactor: extract OAuth helper functions and simplify provider state by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1586](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1586) - Add client\_id\_metadata\_document\_supported to OAuthMetadata by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1603](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1603) - Fix OAuth discovery fallback and URL ordering by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1624](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1624) - Refactor `func_metadata()` implementation by [@&#8203;Viicos](https://redirect.github.com/Viicos) in [#&#8203;1496](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1496) - Fix CI highest resolution test to actually test highest versions by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1609](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1609) #### New Contributors - [@&#8203;Viicos](https://redirect.github.com/Viicos) made their first contribution in [#&#8203;1496](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1496) **Full Changelog**: <modelcontextprotocol/python-sdk@v1.21.0...v1.21.1> ### [`v1.21.0`](https://redirect.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.21.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/python-sdk/compare/v1.20.0...v1.21.0) #### What's Changed - docs: use article "an" before "MCP" instead of "a" by [@&#8203;koic](https://redirect.github.com/koic) in [#&#8203;1558](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1558) - Update Starlette to 0.49.1 in uv.lock by [@&#8203;ColeMurray](https://redirect.github.com/ColeMurray) in [#&#8203;1559](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1559) - Fix typo in `ClientSessionGroup` doc string by [@&#8203;inaku-Gyan](https://redirect.github.com/inaku-Gyan) in [#&#8203;1572](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1572) - Implement SEP-985: OAuth Protected Resource Metadata discovery fallback by [@&#8203;cbcoutinho](https://redirect.github.com/cbcoutinho) in [#&#8203;1548](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1548) - Add --frozen flag to uv run commands in Claude config by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1583](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1583) - Add get\_server\_capabilities() to ClientSession by [@&#8203;crondinini-ant](https://redirect.github.com/crondinini-ant) in [#&#8203;1588](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1588) #### New Contributors - [@&#8203;koic](https://redirect.github.com/koic) made their first contribution in [#&#8203;1558](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1558) - [@&#8203;ColeMurray](https://redirect.github.com/ColeMurray) made their first contribution in [#&#8203;1559](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1559) - [@&#8203;inaku-Gyan](https://redirect.github.com/inaku-Gyan) made their first contribution in [#&#8203;1572](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1572) - [@&#8203;cbcoutinho](https://redirect.github.com/cbcoutinho) made their first contribution in [#&#8203;1548](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1548) - [@&#8203;crondinini-ant](https://redirect.github.com/crondinini-ant) made their first contribution in [#&#8203;1588](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1588) **Full Changelog**: <modelcontextprotocol/python-sdk@v1.20.0...v1.21.0> ### [`v1.20.0`](https://redirect.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.20.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/python-sdk/compare/v1.19.0...v1.20.0) #### What's Changed - Relax Accept header requirement for JSON-only responses by [@&#8203;domdomegg](https://redirect.github.com/domdomegg) in [#&#8203;1500](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1500) - fix: replace deprecated dev-dependencies in examples/clients by [@&#8203;yukuanj](https://redirect.github.com/yukuanj) in [#&#8203;1518](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1518) - fix: Update spec links to new modelcontextprotocol.io location by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1491](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1491) - fix: Replace fixed sleep with active server readiness check in SSE tests by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1526](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1526) - fix: Replace arbitrary sleeps with active server readiness checks in tests by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1527](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1527) - Fix flaky timeout test in test\_88\_random\_error by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1525](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1525) - fix: Replace remaining manual server polling with wait\_for\_server helper by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1529](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1529) - Implement RFC 7523 JWT flows by [@&#8203;LucaButBoring](https://redirect.github.com/LucaButBoring) in [#&#8203;1247](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1247) - Fix pyright error and replace wildcard import with explicit imports by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1532](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1532) - Fix auth client example URL handling for oauth provider by [@&#8203;pcarleton](https://redirect.github.com/pcarleton) in [#&#8203;1549](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1549) #### New Contributors - [@&#8203;domdomegg](https://redirect.github.com/domdomegg) made their first contribution in [#&#8203;1500](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1500) - [@&#8203;pcarleton](https://redirect.github.com/pcarleton) made their first contribution in [#&#8203;1549](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1549) **Full Changelog**: <modelcontextprotocol/python-sdk@v1.19.0...v1.20.0> ### [`v1.19.0`](https://redirect.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.19.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/python-sdk/compare/v1.18.0...v1.19.0) #### What's Changed - feat: add tool metadata in FastMCP.tool decorator by [@&#8203;mat-octave](https://redirect.github.com/mat-octave) in [#&#8203;1463](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1463) - Make client examples workspaces to reflect package code by [@&#8203;LucaButBoring](https://redirect.github.com/LucaButBoring) in [#&#8203;1466](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1466) - Expose RequestParams.\_meta in ClientSession.call\_tool by [@&#8203;samchenatti](https://redirect.github.com/samchenatti) in [#&#8203;1231](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1231) - Allow CallToolResult to be returned directly to support \_meta field for OpenAI Apps by [@&#8203;BrandonShar](https://redirect.github.com/BrandonShar) in [#&#8203;1459](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1459) - fix: uv CVE-2025-62518 astral-tokio-tar issue GHSA-j5gw-2vrg-8fgx by [@&#8203;cclauss](https://redirect.github.com/cclauss) in [#&#8203;1505](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1505) - fix: use proper dependency resolution in CI by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1507](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1507) - Upgrade GitHub Actions by [@&#8203;cclauss](https://redirect.github.com/cclauss) in [#&#8203;1473](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1473) - test: use errno.ENOENT for command not found assertion by [@&#8203;mingo1996](https://redirect.github.com/mingo1996) in [#&#8203;1498](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1498) - Replace deprecated dev-dependencies with dependency-groups by [@&#8203;yukuanj](https://redirect.github.com/yukuanj) in [#&#8203;1488](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1488) - update uv to 0.9.5 by [@&#8203;maxisbey](https://redirect.github.com/maxisbey) in [#&#8203;1510](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1510) #### New Contributors - [@&#8203;mat-octave](https://redirect.github.com/mat-octave) made their first contribution in [#&#8203;1463](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1463) - [@&#8203;samchenatti](https://redirect.github.com/samchenatti) made their first contribution in [#&#8203;1231](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1231) - [@&#8203;BrandonShar](https://redirect.github.com/BrandonShar) made their first contribution in [#&#8203;1459](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1459) - [@&#8203;mingo1996](https://redirect.github.com/mingo1996) made their first contribution in [#&#8203;1498](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1498) **Full Changelog**: <modelcontextprotocol/python-sdk@v1.18.0...v1.19.0> ### [`v1.18.0`](https://redirect.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.18.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/python-sdk/compare/v1.17.0...v1.18.0) #### What's Changed - \[client] Implement MCP OAuth scope selection and step-up authorization by [@&#8203;dogacancolak](https://redirect.github.com/dogacancolak) in [#&#8203;1324](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1324) - Handles message type Exception in lowlevel/server.py \_handle\_message function. Mentioned as TODO on line 528. by [@&#8203;AishwaryaKalloli](https://redirect.github.com/AishwaryaKalloli) in [#&#8203;786](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/786) - Fix workspace configuration error with structured\_output\_lowlevel.py by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1471](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1471) - fix: Remove unnecessary constructor from ResourceServerSettings by [@&#8203;rocky-d](https://redirect.github.com/rocky-d) in [#&#8203;1424](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1424) - feat: add resource annotations support to FastMCP by [@&#8203;fennb](https://redirect.github.com/fennb) in [#&#8203;1468](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1468) - fix: send params as empty object for list methods without cursor by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1453](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1453) - fix: Set the Server session initialization state immediately after respond… by [@&#8203;daamitt](https://redirect.github.com/daamitt) in [#&#8203;1478](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1478) #### New Contributors - [@&#8203;dogacancolak](https://redirect.github.com/dogacancolak) made their first contribution in [#&#8203;1324](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1324) - [@&#8203;rocky-d](https://redirect.github.com/rocky-d) made their first contribution in [#&#8203;1424](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1424) - [@&#8203;fennb](https://redirect.github.com/fennb) made their first contribution in [#&#8203;1468](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1468) - [@&#8203;daamitt](https://redirect.github.com/daamitt) made their first contribution in [#&#8203;1478](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1478) **Full Changelog**: <modelcontextprotocol/python-sdk@v1.17.0...v1.18.0> ### [`v1.17.0`](https://redirect.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.17.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/python-sdk/compare/v1.16.0...v1.17.0) #### What's Changed - Add documentation structure by [@&#8203;Kludex](https://redirect.github.com/Kludex) in [#&#8203;1425](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1425) - Add documentation about testing by [@&#8203;Kludex](https://redirect.github.com/Kludex) in [#&#8203;1426](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1426) - Improve OAuth protected resource metadata URL construction per RFC 9728 by [@&#8203;shulkx](https://redirect.github.com/shulkx) in [#&#8203;1407](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1407) - feat: add ability to remove tools by [@&#8203;brandonspark](https://redirect.github.com/brandonspark) in [#&#8203;1322](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1322) - Update README to link to Python SDK documentation by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1430](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1430) - fix: update CLAUDE.md to remove auto-addition of reviewers. by [@&#8203;felixweinberger](https://redirect.github.com/felixweinberger) in [#&#8203;1431](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1431) #### New Contributors - [@&#8203;shulkx](https://redirect.github.com/shulkx) made their first contribution in [#&#8203;1407](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1407) - [@&#8203;brandonspark](https://redirect.github.com/brandonspark) made their first contribution in [#&#8203;1322](https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1322) **Full Changelog**: <modelcontextprotocol/python-sdk@v1.16.0...v1.17.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apify/actor-templates).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
diff --git a/templates/python-mcp-proxy/requirements.txt b/templates/python-mcp-proxy/requirements.txt
@@ -6,7 +6,7 @@ apify-client < 3.0.0
 arxiv-mcp-server==0.3.1
 fastapi==0.119.1
 httpx>=0.24.0
-mcp==1.16.0
+mcp==1.23.0
 pydantic>=2.0.0
 uv>=0.7.8
 uvicorn>=0.27.0
