Skip to content

Conversation

@lukacf
Copy link
Contributor

@lukacf lukacf commented Jul 16, 2025

When clients cancel long-running tool calls, the server crashes with an assertion error and becomes unresponsive. This PR fixes the issue by preventing duplicate responses.

Problem

  • RequestResponder.cancel() sends an error response when cancelled
  • _handle_request tries to send another error response
  • This causes "Request already responded to" assertion
  • Server becomes completely unresponsive

Solution

Catch CancelledError in _handle_request and return early without sending a second response.

Testing

Added test that cancels a tool call and verifies the server remains responsive.

Fixes #1152
Related: jlowin/fastmcp#508, jlowin/fastmcp#823

lukacf added 6 commits July 16, 2025 12:31
When a tool call is cancelled, RequestResponder.cancel() sends an error
response. Previously, _handle_request would try to send another error
response, causing "Request already responded to" assertion.

This fix catches CancelledError and returns early, preventing the
duplicate response.

Fixes modelcontextprotocol#1152
@lukacf lukacf requested review from a team and felixweinberger July 18, 2025 18:58
Copy link
Contributor

@ihrpr ihrpr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for woking on the fix! Left some comments

@@ -0,0 +1,138 @@
"""Test that cancelled requests don't cause double responses."""

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a lot of mocking happening. I'd suggest to use test_integration or leverage create_connected_server_and_client_session and test with CancelledNotification

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed, thanks for the directions!

- Use anyio.get_cancelled_exc_class() instead of asyncio.CancelledError
  for proper backend compatibility (supports both asyncio and trio)
- Rewrote cancel handling tests to use integration testing pattern with
  create_connected_server_and_client_session instead of mocking
- Tests now properly send CancelledNotification messages through real
  client-server communication
- Added proper type annotations and fixed type issues in tests

Addresses review feedback about using anyio idioms and integration testing.

Reported-by: @ihrpr
@lukacf lukacf force-pushed the fix-cancelled-error-response branch from 89075b0 to a5a112a Compare July 21, 2025 19:37
@lukacf lukacf requested a review from ihrpr July 21, 2025 19:45
Copy link
Contributor

@ihrpr ihrpr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the quick turnaround, I think we can remove test_cancelled_request_no_double_response test. wdyt?



@pytest.mark.anyio
async def test_cancelled_request_no_double_response():
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we need this test? it doesn't look like it's testing much and test_server_remains_functional_after_cancel looks complete to cover the fix?

@ihrpr ihrpr requested a review from a team July 25, 2025 09:13
Copy link
Contributor

@ihrpr ihrpr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you

(I removed the test mentioned in comments as test_server_remains_functional_after_cancel already covers the change)

@ihrpr ihrpr merged commit b34e720 into modelcontextprotocol:main Jul 25, 2025
10 checks passed
saqadri pushed a commit to saqadri/stdio-fixes that referenced this pull request Aug 6, 2025
rbehal pushed a commit to gumloop/gumloop-mcp that referenced this pull request Sep 25, 2025
* Add regression test for stateless request memory cleanup (modelcontextprotocol#1140)

* Implement RFC9728 - Support WWW-Authenticate header by MCP client (modelcontextprotocol#1071)

* Add streamable HTTP starlette example to Python SDK docs (modelcontextprotocol#1111)

* fix markdown error in README in main (modelcontextprotocol#1147)

* README - replace code snippets with examples - add lowlevel to snippets (modelcontextprotocol#1150)

* README - replace code snippets with examples - streamable http (modelcontextprotocol#1155)

* chore: don't allow users to create issues outside the templates (modelcontextprotocol#1163)

* Tests(cli): Add coverage for helper functions (modelcontextprotocol#635)

* Docs: Update CallToolResult parsing in README (modelcontextprotocol#812)

Co-authored-by: Felix Weinberger <[email protected]>

* docs: add pre-commit install guide on CONTRIBUTING.md (modelcontextprotocol#995)

Co-authored-by: Felix Weinberger <[email protected]>

* fix flaky fix-test_streamablehttp_client_resumption test (modelcontextprotocol#1166)

* README - replace code snippets with examples -- auth examples (modelcontextprotocol#1164)

* Support falling back to OIDC metadata for auth (modelcontextprotocol#1061)

* Add CODEOWNERS file for sdk (modelcontextprotocol#1169)

* fix flaky test test_88_random_error (modelcontextprotocol#1171)

* Make sure `RequestId` is not coerced as `int` (modelcontextprotocol#1178)

* Fix: Replace threading.Lock with anyio.Lock for Ray deployment compatibility (modelcontextprotocol#1151)

* fix: fix OAuth flow request object handling (modelcontextprotocol#1174)

* update codeowners group (modelcontextprotocol#1191)

* fix: perform auth server metadata discovery fallbacks on any 4xx (modelcontextprotocol#1193)

* server: skip duplicate response on CancelledError (modelcontextprotocol#1153)

Co-authored-by: ihrpr <[email protected]>

* Unpack settings in FastMCP (modelcontextprotocol#1198)

* chore: Remove unused prompt_manager.py file (modelcontextprotocol#1229)

Co-authored-by: Tapan Chugh <[email protected]>

* Improved supported for ProtectedResourceMetadata (modelcontextprotocol#1235)

Co-authored-by: Paul Carleton <[email protected]>

* chore: Remove unused variable notification_options (modelcontextprotocol#1238)

* Improve README around the Context object (modelcontextprotocol#1203)

* fix: allow to pass `list[str]` to `token_endpoint_auth_signing_alg_values_supported` (modelcontextprotocol#1226)

* Remove strict validation on `response_modes_supported` member of `OAuthMetadata` (modelcontextprotocol#1243)

* Add pyright strict mode on the whole project (modelcontextprotocol#1254)

* Consistent casing for default headers Accept and Content-Type (modelcontextprotocol#1263)

* Update dependencies and fix type issues (modelcontextprotocol#1268)

Co-authored-by: Marcelo Trylesinski <[email protected]>

* fix: prevent async generator cleanup errors in StreamableHTTP transport (modelcontextprotocol#1271)

Co-authored-by: David Soria Parra <[email protected]>

* chore: uncomment .idea/ in .gitignore (modelcontextprotocol#1287)

Co-authored-by: Claude <[email protected]>

* docs: clarify streamable_http_path configuration when mounting servers (modelcontextprotocol#1172)

* feat: Add CORS configuration for browser-based MCP clients (modelcontextprotocol#1059)

Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Added Audio to FastMCP (modelcontextprotocol#1130)

* fix: avoid uncessary retries in OAuth authenticated requests (modelcontextprotocol#1206)

Co-authored-by: Felix Weinberger <[email protected]>

* Add PATHEXT to default STDIO env vars in windows (modelcontextprotocol#1256)

* fix: error too many values to unpack (expected 2) (modelcontextprotocol#1279)

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* SDK Parity: Avoid Parsing Server Response for non-JsonRPCMessage Requests (modelcontextprotocol#1290)

* types: Setting default value for method: Literal (modelcontextprotocol#1292)

* changes structured temperature to not deadly (modelcontextprotocol#1328)

* Update simple-resource example to use non-deprecated read_resource return type (modelcontextprotocol#1331)

Co-authored-by: Claude <[email protected]>

* docs: Update README to include link to API docs for modelcontextprotocol#1329 (modelcontextprotocol#1330)

* Allow ping requests before initialization (modelcontextprotocol#1312)

* Python lint: Ruff rules for pylint and code complexity (modelcontextprotocol#525)

* Fix context injection for resources and prompts (modelcontextprotocol#1336)

* fix(fastmcp): propagate mimeType in resource template list (modelcontextprotocol#1186)

Co-authored-by: Felix Weinberger <[email protected]>

* fix: allow elicitations accepted without content (modelcontextprotocol#1285)

Co-authored-by: Olivier Schiavo <[email protected]>

* Use --frozen in pre-commit config (modelcontextprotocol#1375)

* Return HTTP 403 for invalid Origin headers (modelcontextprotocol#1353)

* Add test for ProtectedResourceMetadataParsing (modelcontextprotocol#1236)

Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Fastmcp logging progress example (modelcontextprotocol#1270)

Co-authored-by: Felix Weinberger <[email protected]>

* feat: add paginated list decorators for prompts, resources, and tools (modelcontextprotocol#1286)

Co-authored-by: Claude <[email protected]>

* Remove "unconditionally" from conditional description (modelcontextprotocol#1289)

* Use streamable-http consistently in examples (modelcontextprotocol#1389)

* feat: Add SDK support for SEP-1034 default values in elicitation schemas (modelcontextprotocol#1337)

Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Implementation of SEP 973 - Additional metadata + icons support (modelcontextprotocol#1357)

* Merge upstream/main with custom filtering

---------

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: yurikunash <[email protected]>
Co-authored-by: Pamela Fox <[email protected]>
Co-authored-by: Inna Harper <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Ian Davenport <[email protected]>
Co-authored-by: Dagang Wei <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Stanley Law <[email protected]>
Co-authored-by: Luca Chang <[email protected]>
Co-authored-by: leweng <[email protected]>
Co-authored-by: Clare Liguori <[email protected]>
Co-authored-by: lukacf <[email protected]>
Co-authored-by: ihrpr <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Yann Jouanin <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Sreenath Somarajapuram <[email protected]>
Co-authored-by: Omer Korner <[email protected]>
Co-authored-by: joesavage-silabs <[email protected]>
Co-authored-by: Gregory L <[email protected]>
Co-authored-by: David Soria Parra <[email protected]>
Co-authored-by: Moustapha Ebnou <[email protected]>
Co-authored-by: Max Isbey <[email protected]>
Co-authored-by: Claude <[email protected]>
Co-authored-by: Jerome <[email protected]>
Co-authored-by: xavier <[email protected]>
Co-authored-by: keurcien <[email protected]>
Co-authored-by: Tim Esler <[email protected]>
Co-authored-by: San Nguyen <[email protected]>
Co-authored-by: Justin Wang <[email protected]>
Co-authored-by: jess <[email protected]>
Co-authored-by: Peter Alexander <[email protected]>
Co-authored-by: Reid Geyer <[email protected]>
Co-authored-by: Eleftheria Stein-Kousathana <[email protected]>
Co-authored-by: Christian Clauss <[email protected]>
Co-authored-by: pchoudhury22 <[email protected]>
Co-authored-by: owengo <[email protected]>
Co-authored-by: Olivier Schiavo <[email protected]>
Co-authored-by: Steve Billings <[email protected]>
Co-authored-by: Mike Salvatore <[email protected]>
rbehal pushed a commit to gumloop/gumloop-mcp that referenced this pull request Dec 9, 2025
* Add regression test for stateless request memory cleanup (modelcontextprotocol#1140)

* Implement RFC9728 - Support WWW-Authenticate header by MCP client (modelcontextprotocol#1071)

* Add streamable HTTP starlette example to Python SDK docs (modelcontextprotocol#1111)

* fix markdown error in README in main (modelcontextprotocol#1147)

* README - replace code snippets with examples - add lowlevel to snippets (modelcontextprotocol#1150)

* README - replace code snippets with examples - streamable http (modelcontextprotocol#1155)

* chore: don't allow users to create issues outside the templates (modelcontextprotocol#1163)

* Tests(cli): Add coverage for helper functions (modelcontextprotocol#635)

* Docs: Update CallToolResult parsing in README (modelcontextprotocol#812)

Co-authored-by: Felix Weinberger <[email protected]>

* docs: add pre-commit install guide on CONTRIBUTING.md (modelcontextprotocol#995)

Co-authored-by: Felix Weinberger <[email protected]>

* fix flaky fix-test_streamablehttp_client_resumption test (modelcontextprotocol#1166)

* README - replace code snippets with examples -- auth examples (modelcontextprotocol#1164)

* Support falling back to OIDC metadata for auth (modelcontextprotocol#1061)

* Add CODEOWNERS file for sdk (modelcontextprotocol#1169)

* fix flaky test test_88_random_error (modelcontextprotocol#1171)

* Make sure `RequestId` is not coerced as `int` (modelcontextprotocol#1178)

* Fix: Replace threading.Lock with anyio.Lock for Ray deployment compatibility (modelcontextprotocol#1151)

* fix: fix OAuth flow request object handling (modelcontextprotocol#1174)

* update codeowners group (modelcontextprotocol#1191)

* fix: perform auth server metadata discovery fallbacks on any 4xx (modelcontextprotocol#1193)

* server: skip duplicate response on CancelledError (modelcontextprotocol#1153)

Co-authored-by: ihrpr <[email protected]>

* Unpack settings in FastMCP (modelcontextprotocol#1198)

* chore: Remove unused prompt_manager.py file (modelcontextprotocol#1229)

Co-authored-by: Tapan Chugh <[email protected]>

* Improved supported for ProtectedResourceMetadata (modelcontextprotocol#1235)

Co-authored-by: Paul Carleton <[email protected]>

* chore: Remove unused variable notification_options (modelcontextprotocol#1238)

* Improve README around the Context object (modelcontextprotocol#1203)

* fix: allow to pass `list[str]` to `token_endpoint_auth_signing_alg_values_supported` (modelcontextprotocol#1226)

* Remove strict validation on `response_modes_supported` member of `OAuthMetadata` (modelcontextprotocol#1243)

* Add pyright strict mode on the whole project (modelcontextprotocol#1254)

* Consistent casing for default headers Accept and Content-Type (modelcontextprotocol#1263)

* Update dependencies and fix type issues (modelcontextprotocol#1268)

Co-authored-by: Marcelo Trylesinski <[email protected]>

* fix: prevent async generator cleanup errors in StreamableHTTP transport (modelcontextprotocol#1271)

Co-authored-by: David Soria Parra <[email protected]>

* chore: uncomment .idea/ in .gitignore (modelcontextprotocol#1287)

Co-authored-by: Claude <[email protected]>

* docs: clarify streamable_http_path configuration when mounting servers (modelcontextprotocol#1172)

* feat: Add CORS configuration for browser-based MCP clients (modelcontextprotocol#1059)

Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Added Audio to FastMCP (modelcontextprotocol#1130)

* fix: avoid uncessary retries in OAuth authenticated requests (modelcontextprotocol#1206)

Co-authored-by: Felix Weinberger <[email protected]>

* Add PATHEXT to default STDIO env vars in windows (modelcontextprotocol#1256)

* fix: error too many values to unpack (expected 2) (modelcontextprotocol#1279)

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* SDK Parity: Avoid Parsing Server Response for non-JsonRPCMessage Requests (modelcontextprotocol#1290)

* types: Setting default value for method: Literal (modelcontextprotocol#1292)

* changes structured temperature to not deadly (modelcontextprotocol#1328)

* Update simple-resource example to use non-deprecated read_resource return type (modelcontextprotocol#1331)

Co-authored-by: Claude <[email protected]>

* docs: Update README to include link to API docs for modelcontextprotocol#1329 (modelcontextprotocol#1330)

* Allow ping requests before initialization (modelcontextprotocol#1312)

* Python lint: Ruff rules for pylint and code complexity (modelcontextprotocol#525)

* Fix context injection for resources and prompts (modelcontextprotocol#1336)

* fix(fastmcp): propagate mimeType in resource template list (modelcontextprotocol#1186)

Co-authored-by: Felix Weinberger <[email protected]>

* fix: allow elicitations accepted without content (modelcontextprotocol#1285)

Co-authored-by: Olivier Schiavo <[email protected]>

* Use --frozen in pre-commit config (modelcontextprotocol#1375)

* Return HTTP 403 for invalid Origin headers (modelcontextprotocol#1353)

* Add test for ProtectedResourceMetadataParsing (modelcontextprotocol#1236)

Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Fastmcp logging progress example (modelcontextprotocol#1270)

Co-authored-by: Felix Weinberger <[email protected]>

* feat: add paginated list decorators for prompts, resources, and tools (modelcontextprotocol#1286)

Co-authored-by: Claude <[email protected]>

* Remove "unconditionally" from conditional description (modelcontextprotocol#1289)

* Use streamable-http consistently in examples (modelcontextprotocol#1389)

* feat: Add SDK support for SEP-1034 default values in elicitation schemas (modelcontextprotocol#1337)

Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Implementation of SEP 973 - Additional metadata + icons support (modelcontextprotocol#1357)

* Add error log for client stdio (modelcontextprotocol#924)

Co-authored-by: Your Name <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Accept additional response_types values from OAuth servers (modelcontextprotocol#1323)

* Issue 1379 patch - Fix MCP server OAuth not working with Visual Studio Code and others with extra grant_types (modelcontextprotocol#1380)

* Add comprehensive Unicode tests for streamable HTTP transport (modelcontextprotocol#1381)

* Update Icon.sizes to use string array format (modelcontextprotocol#1411)

* Delete CODEOWNERS to eliminate notification overload (modelcontextprotocol#1413)

* fix: fix the system message in simple-chatbot example (modelcontextprotocol#1394)

* fix: improve misleading warning for progress callback exceptions (modelcontextprotocol#775)

* fix: catch and rethrow SSEError during SSE connection establishment (modelcontextprotocol#975)

Co-authored-by: zhangchuanhui <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Add icons support for ResourceTemplate (modelcontextprotocol#1412)

* Add documentation structure (modelcontextprotocol#1425)

* Add documentation about testing (modelcontextprotocol#1426)

* Improve OAuth protected resource metadata URL construction per RFC 9728 (modelcontextprotocol#1407)

* feat: add ability to remove tools (modelcontextprotocol#1322)

Co-authored-by: David Soria Parra <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Max Isbey <[email protected]>
Co-authored-by: Claude <[email protected]>

* Update README to link to Python SDK documentation (modelcontextprotocol#1430)

* fix: update CLAUDE.md to remove auto-addition of reviewers. (modelcontextprotocol#1431)

* [client] Implement MCP OAuth scope selection and step-up authorization (modelcontextprotocol#1324)

* Handles message type Exception in lowlevel/server.py _handle_message function. Mentioned as TODO on line 528. (modelcontextprotocol#786)

Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Fix workspace configuration error with structured_output_lowlevel.py  (modelcontextprotocol#1471)

Co-authored-by: lorenss-m <[email protected]>

* fix: Remove unnecessary constructor from ResourceServerSettings (modelcontextprotocol#1424)

Co-authored-by: Felix Weinberger <[email protected]>

* feat: add resource annotations support to FastMCP (modelcontextprotocol#1468)

* fix: send params as empty object for list methods without cursor (modelcontextprotocol#1453)

* fix: Set the Server session initialization state immediately after respond… (modelcontextprotocol#1478)

Co-authored-by: Max Isbey <[email protected]>

* feat: add tool metadata in FastMCP.tool decorator (modelcontextprotocol#1463)

Co-authored-by: Max Isbey <[email protected]>

* Make client examples workspaces to reflect package code (modelcontextprotocol#1466)

* Expose RequestParams._meta in ClientSession.call_tool (modelcontextprotocol#1231)

Co-authored-by: Felix Weinberger <[email protected]>

* Allow CallToolResult to be returned directly to support _meta field for OpenAI Apps (modelcontextprotocol#1459)

Co-authored-by: Max Isbey <[email protected]>

* fix: uv CVE-2025-62518 astral-tokio-tar issue GHSA-j5gw-2vrg-8fgx (modelcontextprotocol#1505)

* fix: use proper dependency resolution in CI (modelcontextprotocol#1507)

* Upgrade GitHub Actions (modelcontextprotocol#1473)

* test: use errno.ENOENT for command not found assertion (modelcontextprotocol#1498)

* Replace deprecated dev-dependencies with dependency-groups (modelcontextprotocol#1488)

Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* update uv to 0.9.5 (modelcontextprotocol#1510)

* Relax Accept header requirement for JSON-only responses (modelcontextprotocol#1500)

* fix: replace deprecated dev-dependencies in examples/clients (modelcontextprotocol#1518)

* fix: Update spec links to new modelcontextprotocol.io location (modelcontextprotocol#1491)

* fix: Replace fixed sleep with active server readiness check in SSE tests (modelcontextprotocol#1526)

* fix: Replace arbitrary sleeps with active server readiness checks in tests (modelcontextprotocol#1527)

Co-authored-by: Claude <[email protected]>

* Fix flaky timeout test in test_88_random_error (modelcontextprotocol#1525)

* fix: Replace remaining manual server polling with wait_for_server helper (modelcontextprotocol#1529)

* Implement RFC 7523 JWT flows (modelcontextprotocol#1247)

Co-authored-by: Yann Jouanin <[email protected]>

* Fix pyright error and replace wildcard import with explicit imports (modelcontextprotocol#1532)

* Fix auth client example URL handling for oauth provider (modelcontextprotocol#1549)

* docs: use article "an" before "MCP" instead of "a" (modelcontextprotocol#1558)

* Update Starlette to 0.49.1 in uv.lock (modelcontextprotocol#1559)

* Fix typo in `ClientSessionGroup` doc string (modelcontextprotocol#1572)

* Implement SEP-985: OAuth Protected Resource Metadata discovery fallback (modelcontextprotocol#1548)

Co-authored-by: Claude <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>

* Add --frozen flag to uv run commands in Claude config (modelcontextprotocol#1583)

* Add get_server_capabilities() to ClientSession (modelcontextprotocol#1588)

* Add everything-server for comprehensive MCP conformance testing (modelcontextprotocol#1587)

* Get baseline 100% clean coverage (modelcontextprotocol#1553)

* Add end-of-file-fixer pre-commit hook (modelcontextprotocol#1610)

* Add coverage baseline commit to git-blame-ignore (modelcontextprotocol#1613)

* Add SEP-1034 conformance test support to everything-server (modelcontextprotocol#1604)

Co-authored-by: Max Isbey <[email protected]>

* refactor: extract OAuth helper functions and simplify provider state (modelcontextprotocol#1586)

* Add client_id_metadata_document_supported to OAuthMetadata (modelcontextprotocol#1603)

* Fix OAuth discovery fallback and URL ordering (modelcontextprotocol#1624)

* Refactor `func_metadata()` implementation (modelcontextprotocol#1496)

* Fix CI highest resolution test to actually test highest versions (modelcontextprotocol#1609)

* feat: Pass through and expose additional parameters in `ClientSessionGroup.call_tool` and `.connect_to_server` (modelcontextprotocol#1576)

* fix get_client_metadata_scopes on 401 (modelcontextprotocol#1631)

Co-authored-by: Max Isbey <[email protected]>

* chore: Lazy import `jsonschema` library (modelcontextprotocol#1596)

Co-authored-by: Max Isbey <[email protected]>

* docs: Update examples to use stateless HTTP with JSON responses (modelcontextprotocol#1499)

* Add tests for JSON Schema 2020-12 field preservation (SEP-1613) (modelcontextprotocol#1649)

* Add client_secret_basic authentication support (modelcontextprotocol#1334)

Co-authored-by: Paul Carleton <[email protected]>

* Implement SEP-1577 - Sampling With Tools (modelcontextprotocol#1594)

Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Claude <[email protected]>

* SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance (modelcontextprotocol#1246)

Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* [auth][conformance] add conformance auth client (modelcontextprotocol#1640)

Co-authored-by: Claude <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Implement SEP-986: Tool name validation (modelcontextprotocol#1655)

* fix: url for spec (modelcontextprotocol#1659)

* feat: implement SEP-991 URL-based client ID (CIMD) support (modelcontextprotocol#1652)

Co-authored-by: Claude <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Update doc string on custom_route (modelcontextprotocol#1660)

* Implement SEP-1036: URL mode elicitation for secure out-of-band interactions (modelcontextprotocol#1580)

Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Skip empty SSE data to avoid parsing errors (modelcontextprotocol#1670)

* SEP-1686: Tasks (modelcontextprotocol#1645)

* Add on_session_created callback option (modelcontextprotocol#1710)

* Add SSE polling support (SEP-1699) (modelcontextprotocol#1654)

* Support client_credentials flow with JWT and Basic auth (modelcontextprotocol#1663)

Co-authored-by: Claude <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* feat: backwards-compatible create_message overloads for SEP-1577 (modelcontextprotocol#1713)

* Merge commit from fork

* Auto-enable DNS rebinding protection for localhost servers

When a FastMCP server is created with host="127.0.0.1" or "localhost"
and no explicit transport_security is provided, automatically enable
DNS rebinding protection. Both 127.0.0.1 and localhost are allowed
as valid hosts/origins since clients may use either to connect.

* Add tests for auto DNS rebinding protection on localhost

Tests verify that:
- Protection auto-enables for host=127.0.0.1
- Protection auto-enables for host=localhost
- Both 127.0.0.1 and localhost are in allowed hosts/origins
- Protection does NOT auto-enable for other hosts (e.g., 0.0.0.0)
- Explicit transport_security settings are not overridden

* Add IPv6 localhost (::1) support for DNS rebinding protection

Extend auto-enable DNS rebinding protection to also cover IPv6
localhost. When host="::1", protection is now auto-enabled with
appropriate allowed hosts ([::1]:*) and origins (http://[::1]:*).

* Fix import ordering in test file

* chore: update LATEST_PROTOCOL_VERSION to 2025-11-25 (modelcontextprotocol#1715)

* fix: add lifespan context manager to StreamableHTTP mounting examples (modelcontextprotocol#1669)

Co-authored-by: TheMailmans <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>

* fix: handle ClosedResourceError in StreamableHTTP message router (modelcontextprotocol#1384)

Co-authored-by: Max Isbey <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>

* fix: skip priming events and close_sse_stream for old protocol versions (modelcontextprotocol#1719)

* refactor(auth): remove unused _register_client method (modelcontextprotocol#1748)

* [MCP-266] Add tests for Gumloop server extensions

* Fix uv workspace config for gumloop-mcp package name

* Sync with upstream MCP SDK and fix merge conflicts

* Fix tool cache timing and missing properties check in server.py

* Fix coverage and add proper type annotations for Gumloop extensions

* Version up

* Skip README code example tests (Gumloop README has no code snippets)

---------

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: yurikunash <[email protected]>
Co-authored-by: Pamela Fox <[email protected]>
Co-authored-by: Inna Harper <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Ian Davenport <[email protected]>
Co-authored-by: Dagang Wei <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Stanley Law <[email protected]>
Co-authored-by: Luca Chang <[email protected]>
Co-authored-by: leweng <[email protected]>
Co-authored-by: Clare Liguori <[email protected]>
Co-authored-by: lukacf <[email protected]>
Co-authored-by: ihrpr <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Yann Jouanin <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Sreenath Somarajapuram <[email protected]>
Co-authored-by: Omer Korner <[email protected]>
Co-authored-by: joesavage-silabs <[email protected]>
Co-authored-by: Gregory L <[email protected]>
Co-authored-by: David Soria Parra <[email protected]>
Co-authored-by: Moustapha Ebnou <[email protected]>
Co-authored-by: Max Isbey <[email protected]>
Co-authored-by: Claude <[email protected]>
Co-authored-by: Jerome <[email protected]>
Co-authored-by: xavier <[email protected]>
Co-authored-by: keurcien <[email protected]>
Co-authored-by: Tim Esler <[email protected]>
Co-authored-by: San Nguyen <[email protected]>
Co-authored-by: Justin Wang <[email protected]>
Co-authored-by: jess <[email protected]>
Co-authored-by: Peter Alexander <[email protected]>
Co-authored-by: Reid Geyer <[email protected]>
Co-authored-by: Eleftheria Stein-Kousathana <[email protected]>
Co-authored-by: Christian Clauss <[email protected]>
Co-authored-by: pchoudhury22 <[email protected]>
Co-authored-by: owengo <[email protected]>
Co-authored-by: Olivier Schiavo <[email protected]>
Co-authored-by: Steve Billings <[email protected]>
Co-authored-by: Mike Salvatore <[email protected]>
Co-authored-by: pengwa <[email protected]>
Co-authored-by: Your Name <[email protected]>
Co-authored-by: Jon Shea <[email protected]>
Co-authored-by: automaton82 <[email protected]>
Co-authored-by: Yukuan Jia <[email protected]>
Co-authored-by: Lorenzo <[email protected]>
Co-authored-by: ZhangChuanhui <[email protected]>
Co-authored-by: zhangchuanhui <[email protected]>
Co-authored-by: Marcus Shu <[email protected]>
Co-authored-by: Brandon Wu <[email protected]>
Co-authored-by: Dogacan Colak <[email protected]>
Co-authored-by: AishwaryaKalloli <[email protected]>
Co-authored-by: lorenss-m <[email protected]>
Co-authored-by: Rocky Haotian Du <[email protected]>
Co-authored-by: Fenn Bailey <[email protected]>
Co-authored-by: daamitt <[email protected]>
Co-authored-by: Mat Leonard <[email protected]>
Co-authored-by: Samuel Felipe Chenatti <[email protected]>
Co-authored-by: Brandon Shar <[email protected]>
Co-authored-by: mingo007 <[email protected]>
Co-authored-by: adam jones <[email protected]>
Co-authored-by: Yann Jouanin <[email protected]>
Co-authored-by: Koichi ITO <[email protected]>
Co-authored-by: Cole Murray <[email protected]>
Co-authored-by: inaku <[email protected]>
Co-authored-by: Chris Coutinho <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Camila Rondinini <[email protected]>
Co-authored-by: Victorien <[email protected]>
Co-authored-by: Andrii Blyzniuk <[email protected]>
Co-authored-by: Liang Wu <[email protected]>
Co-authored-by: adam jones <[email protected]>
Co-authored-by: Olivier Chafik <[email protected]>
Co-authored-by: Tyler Mailman <[email protected]>
Co-authored-by: TheMailmans <[email protected]>
Co-authored-by: Edison <[email protected]>
rbehal added a commit to gumloop/gumloop-mcp that referenced this pull request Dec 10, 2025
* Add regression test for stateless request memory cleanup (modelcontextprotocol#1140)

* Implement RFC9728 - Support WWW-Authenticate header by MCP client (modelcontextprotocol#1071)

* Add streamable HTTP starlette example to Python SDK docs (modelcontextprotocol#1111)

* fix markdown error in README in main (modelcontextprotocol#1147)

* README - replace code snippets with examples - add lowlevel to snippets (modelcontextprotocol#1150)

* README - replace code snippets with examples - streamable http (modelcontextprotocol#1155)

* chore: don't allow users to create issues outside the templates (modelcontextprotocol#1163)

* Tests(cli): Add coverage for helper functions (modelcontextprotocol#635)

* Docs: Update CallToolResult parsing in README (modelcontextprotocol#812)

Co-authored-by: Felix Weinberger <[email protected]>

* docs: add pre-commit install guide on CONTRIBUTING.md (modelcontextprotocol#995)

Co-authored-by: Felix Weinberger <[email protected]>

* fix flaky fix-test_streamablehttp_client_resumption test (modelcontextprotocol#1166)

* README - replace code snippets with examples -- auth examples (modelcontextprotocol#1164)

* Support falling back to OIDC metadata for auth (modelcontextprotocol#1061)

* Add CODEOWNERS file for sdk (modelcontextprotocol#1169)

* fix flaky test test_88_random_error (modelcontextprotocol#1171)

* Make sure `RequestId` is not coerced as `int` (modelcontextprotocol#1178)

* Fix: Replace threading.Lock with anyio.Lock for Ray deployment compatibility (modelcontextprotocol#1151)

* fix: fix OAuth flow request object handling (modelcontextprotocol#1174)

* update codeowners group (modelcontextprotocol#1191)

* fix: perform auth server metadata discovery fallbacks on any 4xx (modelcontextprotocol#1193)

* server: skip duplicate response on CancelledError (modelcontextprotocol#1153)

Co-authored-by: ihrpr <[email protected]>

* Unpack settings in FastMCP (modelcontextprotocol#1198)

* chore: Remove unused prompt_manager.py file (modelcontextprotocol#1229)

Co-authored-by: Tapan Chugh <[email protected]>

* Improved supported for ProtectedResourceMetadata (modelcontextprotocol#1235)

Co-authored-by: Paul Carleton <[email protected]>

* chore: Remove unused variable notification_options (modelcontextprotocol#1238)

* Improve README around the Context object (modelcontextprotocol#1203)

* fix: allow to pass `list[str]` to `token_endpoint_auth_signing_alg_values_supported` (modelcontextprotocol#1226)

* Remove strict validation on `response_modes_supported` member of `OAuthMetadata` (modelcontextprotocol#1243)

* Add pyright strict mode on the whole project (modelcontextprotocol#1254)

* Consistent casing for default headers Accept and Content-Type (modelcontextprotocol#1263)

* Update dependencies and fix type issues (modelcontextprotocol#1268)

Co-authored-by: Marcelo Trylesinski <[email protected]>

* fix: prevent async generator cleanup errors in StreamableHTTP transport (modelcontextprotocol#1271)

Co-authored-by: David Soria Parra <[email protected]>

* chore: uncomment .idea/ in .gitignore (modelcontextprotocol#1287)

Co-authored-by: Claude <[email protected]>

* docs: clarify streamable_http_path configuration when mounting servers (modelcontextprotocol#1172)

* feat: Add CORS configuration for browser-based MCP clients (modelcontextprotocol#1059)

Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Added Audio to FastMCP (modelcontextprotocol#1130)

* fix: avoid uncessary retries in OAuth authenticated requests (modelcontextprotocol#1206)

Co-authored-by: Felix Weinberger <[email protected]>

* Add PATHEXT to default STDIO env vars in windows (modelcontextprotocol#1256)

* fix: error too many values to unpack (expected 2) (modelcontextprotocol#1279)

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* SDK Parity: Avoid Parsing Server Response for non-JsonRPCMessage Requests (modelcontextprotocol#1290)

* types: Setting default value for method: Literal (modelcontextprotocol#1292)

* changes structured temperature to not deadly (modelcontextprotocol#1328)

* Update simple-resource example to use non-deprecated read_resource return type (modelcontextprotocol#1331)

Co-authored-by: Claude <[email protected]>

* docs: Update README to include link to API docs for modelcontextprotocol#1329 (modelcontextprotocol#1330)

* Allow ping requests before initialization (modelcontextprotocol#1312)

* Python lint: Ruff rules for pylint and code complexity (modelcontextprotocol#525)

* Fix context injection for resources and prompts (modelcontextprotocol#1336)

* fix(fastmcp): propagate mimeType in resource template list (modelcontextprotocol#1186)

Co-authored-by: Felix Weinberger <[email protected]>

* fix: allow elicitations accepted without content (modelcontextprotocol#1285)

Co-authored-by: Olivier Schiavo <[email protected]>

* Use --frozen in pre-commit config (modelcontextprotocol#1375)

* Return HTTP 403 for invalid Origin headers (modelcontextprotocol#1353)

* Add test for ProtectedResourceMetadataParsing (modelcontextprotocol#1236)

Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Fastmcp logging progress example (modelcontextprotocol#1270)

Co-authored-by: Felix Weinberger <[email protected]>

* feat: add paginated list decorators for prompts, resources, and tools (modelcontextprotocol#1286)

Co-authored-by: Claude <[email protected]>

* Remove "unconditionally" from conditional description (modelcontextprotocol#1289)

* Use streamable-http consistently in examples (modelcontextprotocol#1389)

* feat: Add SDK support for SEP-1034 default values in elicitation schemas (modelcontextprotocol#1337)

Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Implementation of SEP 973 - Additional metadata + icons support (modelcontextprotocol#1357)

* Add error log for client stdio (modelcontextprotocol#924)

Co-authored-by: Your Name <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Accept additional response_types values from OAuth servers (modelcontextprotocol#1323)

* Issue 1379 patch - Fix MCP server OAuth not working with Visual Studio Code and others with extra grant_types (modelcontextprotocol#1380)

* Add comprehensive Unicode tests for streamable HTTP transport (modelcontextprotocol#1381)

* Update Icon.sizes to use string array format (modelcontextprotocol#1411)

* Delete CODEOWNERS to eliminate notification overload (modelcontextprotocol#1413)

* fix: fix the system message in simple-chatbot example (modelcontextprotocol#1394)

* fix: improve misleading warning for progress callback exceptions (modelcontextprotocol#775)

* fix: catch and rethrow SSEError during SSE connection establishment (modelcontextprotocol#975)

Co-authored-by: zhangchuanhui <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Add icons support for ResourceTemplate (modelcontextprotocol#1412)

* Add documentation structure (modelcontextprotocol#1425)

* Add documentation about testing (modelcontextprotocol#1426)

* Improve OAuth protected resource metadata URL construction per RFC 9728 (modelcontextprotocol#1407)

* feat: add ability to remove tools (modelcontextprotocol#1322)

Co-authored-by: David Soria Parra <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Max Isbey <[email protected]>
Co-authored-by: Claude <[email protected]>

* Update README to link to Python SDK documentation (modelcontextprotocol#1430)

* fix: update CLAUDE.md to remove auto-addition of reviewers. (modelcontextprotocol#1431)

* [client] Implement MCP OAuth scope selection and step-up authorization (modelcontextprotocol#1324)

* Handles message type Exception in lowlevel/server.py _handle_message function. Mentioned as TODO on line 528. (modelcontextprotocol#786)

Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Fix workspace configuration error with structured_output_lowlevel.py  (modelcontextprotocol#1471)

Co-authored-by: lorenss-m <[email protected]>

* fix: Remove unnecessary constructor from ResourceServerSettings (modelcontextprotocol#1424)

Co-authored-by: Felix Weinberger <[email protected]>

* feat: add resource annotations support to FastMCP (modelcontextprotocol#1468)

* fix: send params as empty object for list methods without cursor (modelcontextprotocol#1453)

* fix: Set the Server session initialization state immediately after respond… (modelcontextprotocol#1478)

Co-authored-by: Max Isbey <[email protected]>

* feat: add tool metadata in FastMCP.tool decorator (modelcontextprotocol#1463)

Co-authored-by: Max Isbey <[email protected]>

* Make client examples workspaces to reflect package code (modelcontextprotocol#1466)

* Expose RequestParams._meta in ClientSession.call_tool (modelcontextprotocol#1231)

Co-authored-by: Felix Weinberger <[email protected]>

* Allow CallToolResult to be returned directly to support _meta field for OpenAI Apps (modelcontextprotocol#1459)

Co-authored-by: Max Isbey <[email protected]>

* fix: uv CVE-2025-62518 astral-tokio-tar issue GHSA-j5gw-2vrg-8fgx (modelcontextprotocol#1505)

* fix: use proper dependency resolution in CI (modelcontextprotocol#1507)

* Upgrade GitHub Actions (modelcontextprotocol#1473)

* test: use errno.ENOENT for command not found assertion (modelcontextprotocol#1498)

* Replace deprecated dev-dependencies with dependency-groups (modelcontextprotocol#1488)

Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* update uv to 0.9.5 (modelcontextprotocol#1510)

* Relax Accept header requirement for JSON-only responses (modelcontextprotocol#1500)

* fix: replace deprecated dev-dependencies in examples/clients (modelcontextprotocol#1518)

* fix: Update spec links to new modelcontextprotocol.io location (modelcontextprotocol#1491)

* fix: Replace fixed sleep with active server readiness check in SSE tests (modelcontextprotocol#1526)

* fix: Replace arbitrary sleeps with active server readiness checks in tests (modelcontextprotocol#1527)

Co-authored-by: Claude <[email protected]>

* Fix flaky timeout test in test_88_random_error (modelcontextprotocol#1525)

* fix: Replace remaining manual server polling with wait_for_server helper (modelcontextprotocol#1529)

* Implement RFC 7523 JWT flows (modelcontextprotocol#1247)

Co-authored-by: Yann Jouanin <[email protected]>

* Fix pyright error and replace wildcard import with explicit imports (modelcontextprotocol#1532)

* Fix auth client example URL handling for oauth provider (modelcontextprotocol#1549)

* docs: use article "an" before "MCP" instead of "a" (modelcontextprotocol#1558)

* Update Starlette to 0.49.1 in uv.lock (modelcontextprotocol#1559)

* Fix typo in `ClientSessionGroup` doc string (modelcontextprotocol#1572)

* Implement SEP-985: OAuth Protected Resource Metadata discovery fallback (modelcontextprotocol#1548)

Co-authored-by: Claude <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>

* Add --frozen flag to uv run commands in Claude config (modelcontextprotocol#1583)

* Add get_server_capabilities() to ClientSession (modelcontextprotocol#1588)

* Add everything-server for comprehensive MCP conformance testing (modelcontextprotocol#1587)

* Get baseline 100% clean coverage (modelcontextprotocol#1553)

* Add end-of-file-fixer pre-commit hook (modelcontextprotocol#1610)

* Add coverage baseline commit to git-blame-ignore (modelcontextprotocol#1613)

* Add SEP-1034 conformance test support to everything-server (modelcontextprotocol#1604)

Co-authored-by: Max Isbey <[email protected]>

* refactor: extract OAuth helper functions and simplify provider state (modelcontextprotocol#1586)

* Add client_id_metadata_document_supported to OAuthMetadata (modelcontextprotocol#1603)

* Fix OAuth discovery fallback and URL ordering (modelcontextprotocol#1624)

* Refactor `func_metadata()` implementation (modelcontextprotocol#1496)

* Fix CI highest resolution test to actually test highest versions (modelcontextprotocol#1609)

* feat: Pass through and expose additional parameters in `ClientSessionGroup.call_tool` and `.connect_to_server` (modelcontextprotocol#1576)

* fix get_client_metadata_scopes on 401 (modelcontextprotocol#1631)

Co-authored-by: Max Isbey <[email protected]>

* chore: Lazy import `jsonschema` library (modelcontextprotocol#1596)

Co-authored-by: Max Isbey <[email protected]>

* docs: Update examples to use stateless HTTP with JSON responses (modelcontextprotocol#1499)

* Add tests for JSON Schema 2020-12 field preservation (SEP-1613) (modelcontextprotocol#1649)

* Add client_secret_basic authentication support (modelcontextprotocol#1334)

Co-authored-by: Paul Carleton <[email protected]>

* Implement SEP-1577 - Sampling With Tools (modelcontextprotocol#1594)

Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Claude <[email protected]>

* SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance (modelcontextprotocol#1246)

Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* [auth][conformance] add conformance auth client (modelcontextprotocol#1640)

Co-authored-by: Claude <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Implement SEP-986: Tool name validation (modelcontextprotocol#1655)

* fix: url for spec (modelcontextprotocol#1659)

* feat: implement SEP-991 URL-based client ID (CIMD) support (modelcontextprotocol#1652)

Co-authored-by: Claude <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Update doc string on custom_route (modelcontextprotocol#1660)

* Implement SEP-1036: URL mode elicitation for secure out-of-band interactions (modelcontextprotocol#1580)

Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* Skip empty SSE data to avoid parsing errors (modelcontextprotocol#1670)

* SEP-1686: Tasks (modelcontextprotocol#1645)

* Add on_session_created callback option (modelcontextprotocol#1710)

* Add SSE polling support (SEP-1699) (modelcontextprotocol#1654)

* Support client_credentials flow with JWT and Basic auth (modelcontextprotocol#1663)

Co-authored-by: Claude <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>

* feat: backwards-compatible create_message overloads for SEP-1577 (modelcontextprotocol#1713)

* Merge commit from fork

* Auto-enable DNS rebinding protection for localhost servers

When a FastMCP server is created with host="127.0.0.1" or "localhost"
and no explicit transport_security is provided, automatically enable
DNS rebinding protection. Both 127.0.0.1 and localhost are allowed
as valid hosts/origins since clients may use either to connect.

* Add tests for auto DNS rebinding protection on localhost

Tests verify that:
- Protection auto-enables for host=127.0.0.1
- Protection auto-enables for host=localhost
- Both 127.0.0.1 and localhost are in allowed hosts/origins
- Protection does NOT auto-enable for other hosts (e.g., 0.0.0.0)
- Explicit transport_security settings are not overridden

* Add IPv6 localhost (::1) support for DNS rebinding protection

Extend auto-enable DNS rebinding protection to also cover IPv6
localhost. When host="::1", protection is now auto-enabled with
appropriate allowed hosts ([::1]:*) and origins (http://[::1]:*).

* Fix import ordering in test file

* chore: update LATEST_PROTOCOL_VERSION to 2025-11-25 (modelcontextprotocol#1715)

* fix: add lifespan context manager to StreamableHTTP mounting examples (modelcontextprotocol#1669)

Co-authored-by: TheMailmans <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>

* fix: handle ClosedResourceError in StreamableHTTP message router (modelcontextprotocol#1384)

Co-authored-by: Max Isbey <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>

* fix: skip priming events and close_sse_stream for old protocol versions (modelcontextprotocol#1719)

* refactor(auth): remove unused _register_client method (modelcontextprotocol#1748)

* [MCP-266] Add tests for Gumloop server extensions

* Fix uv workspace config for gumloop-mcp package name

* Sync with upstream MCP SDK and fix merge conflicts

* Fix tool cache timing and missing properties check in server.py

* Fix coverage and add proper type annotations for Gumloop extensions

* Version up

* Skip README code example tests (Gumloop README has no code snippets)

* Support gumloop and mcp outptuschema

* Add publish tools to dev dependencies and update README for uv

---------

Signed-off-by: San Nguyen <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: yurikunash <[email protected]>
Co-authored-by: Pamela Fox <[email protected]>
Co-authored-by: Inna Harper <[email protected]>
Co-authored-by: Marcelo Trylesinski <[email protected]>
Co-authored-by: Ian Davenport <[email protected]>
Co-authored-by: Dagang Wei <[email protected]>
Co-authored-by: Felix Weinberger <[email protected]>
Co-authored-by: Stanley Law <[email protected]>
Co-authored-by: Luca Chang <[email protected]>
Co-authored-by: leweng <[email protected]>
Co-authored-by: Clare Liguori <[email protected]>
Co-authored-by: lukacf <[email protected]>
Co-authored-by: ihrpr <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Tapan Chugh <[email protected]>
Co-authored-by: Yann Jouanin <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Sreenath Somarajapuram <[email protected]>
Co-authored-by: Omer Korner <[email protected]>
Co-authored-by: joesavage-silabs <[email protected]>
Co-authored-by: Gregory L <[email protected]>
Co-authored-by: David Soria Parra <[email protected]>
Co-authored-by: Moustapha Ebnou <[email protected]>
Co-authored-by: Max Isbey <[email protected]>
Co-authored-by: Claude <[email protected]>
Co-authored-by: Jerome <[email protected]>
Co-authored-by: xavier <[email protected]>
Co-authored-by: keurcien <[email protected]>
Co-authored-by: Tim Esler <[email protected]>
Co-authored-by: San Nguyen <[email protected]>
Co-authored-by: Justin Wang <[email protected]>
Co-authored-by: jess <[email protected]>
Co-authored-by: Peter Alexander <[email protected]>
Co-authored-by: Reid Geyer <[email protected]>
Co-authored-by: Eleftheria Stein-Kousathana <[email protected]>
Co-authored-by: Christian Clauss <[email protected]>
Co-authored-by: pchoudhury22 <[email protected]>
Co-authored-by: owengo <[email protected]>
Co-authored-by: Olivier Schiavo <[email protected]>
Co-authored-by: Steve Billings <[email protected]>
Co-authored-by: Mike Salvatore <[email protected]>
Co-authored-by: pengwa <[email protected]>
Co-authored-by: Your Name <[email protected]>
Co-authored-by: Jon Shea <[email protected]>
Co-authored-by: automaton82 <[email protected]>
Co-authored-by: Yukuan Jia <[email protected]>
Co-authored-by: Lorenzo <[email protected]>
Co-authored-by: ZhangChuanhui <[email protected]>
Co-authored-by: zhangchuanhui <[email protected]>
Co-authored-by: Marcus Shu <[email protected]>
Co-authored-by: Brandon Wu <[email protected]>
Co-authored-by: Dogacan Colak <[email protected]>
Co-authored-by: AishwaryaKalloli <[email protected]>
Co-authored-by: lorenss-m <[email protected]>
Co-authored-by: Rocky Haotian Du <[email protected]>
Co-authored-by: Fenn Bailey <[email protected]>
Co-authored-by: daamitt <[email protected]>
Co-authored-by: Mat Leonard <[email protected]>
Co-authored-by: Samuel Felipe Chenatti <[email protected]>
Co-authored-by: Brandon Shar <[email protected]>
Co-authored-by: mingo007 <[email protected]>
Co-authored-by: adam jones <[email protected]>
Co-authored-by: Yann Jouanin <[email protected]>
Co-authored-by: Koichi ITO <[email protected]>
Co-authored-by: Cole Murray <[email protected]>
Co-authored-by: inaku <[email protected]>
Co-authored-by: Chris Coutinho <[email protected]>
Co-authored-by: Paul Carleton <[email protected]>
Co-authored-by: Camila Rondinini <[email protected]>
Co-authored-by: Victorien <[email protected]>
Co-authored-by: Andrii Blyzniuk <[email protected]>
Co-authored-by: Liang Wu <[email protected]>
Co-authored-by: adam jones <[email protected]>
Co-authored-by: Olivier Chafik <[email protected]>
Co-authored-by: Tyler Mailman <[email protected]>
Co-authored-by: TheMailmans <[email protected]>
Co-authored-by: Edison <[email protected]>
Co-authored-by: dvlpjrs <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CancelledError causes duplicate response and server crash

2 participants