[dependabot]

Bumps mcp from 1.28.1 to 1.30.0.

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

• streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
• A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
• The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
• OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

• A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
• Clients that keep the GET stream open (the SDK's client does) are not affected.
• A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
• To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

• Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
• Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
• If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

• ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
• AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
• Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

• AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
• issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
• session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

• [v1.x] Resolve tool output-schema references within the schema document only by @​maxisbey in modelcontextprotocol/python-sdk#3396
• [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @​maxisbey in modelcontextprotocol/python-sdk#3426
• [v1.x] Validate the authorization server metadata issuer on every discovery path by @​maxisbey in modelcontextprotocol/python-sdk#3431
• [v1.x] Follow redirects only within the MCP endpoint's origin by @​maxisbey in modelcontextprotocol/python-sdk#3448
• [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @​maxisbey in modelcontextprotocol/python-sdk#3451

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

• [v1.x] Complete the FastMCP Settings model at import time by @​maxisbey in modelcontextprotocol/python-sdk#3352
• [v1.x] Apply the request body limit to the SSE and OAuth endpoints by @​maxisbey in modelcontextprotocol/python-sdk#3344

... (truncated)

Commits

• 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
• 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
• 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
• 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
• 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
• b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
• 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
• ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
• 98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
• c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[AlexStocks]

[P1] 本 PR 唯一变更（mcp 1.28.1 → 1.30.0）在同一个 head 上伴随 ZCode 宿主验收失败，且失败步骤就在 MCP 路径上

本 PR 只改了 uv.lock。在该 head e7965019db510efa117a6f61d909e5542da1a87c 上：

• zcode-acceptance.yml 的 controlled-cli（windows-latest）job 失败：AssertionError: native_mcp_object_result_missing_list_scopes，位置 tests/e2e/zcode_acceptance/protocol.py:90，两个参数 [1]、[2] 全部失败，末尾为 2 failed, 2 deselected in 172.31s（workflow run 38860700374，job log 已落盘）。该断言的含义是：list_scopes 这个 MCP 工具的响应里既没有可解析为对象的 structuredContent，也没有可解析为对象的 text block。
• 同一提交上其它 workflow 全部通过：quality、tests (3.11–3.14, unit/e2e)、Acceptance (sqlite/oceanbase)、Atomic Memory clean migration、kimi-code-acceptance 的 controlled-cli (ubuntu-latest) 与 controlled-cli (windows-latest) 等均为 success。
• 同一时间窗内其它 head 在该 workflow 上全部成功：bcdac732（master, 06:08）、40bd8481（master, 07:42）、faa8b2c7（feat: expose dependency and processing observations #2019, 07:19）、1c7ed6fa（docs(rfc): propose source plugin framework #2012, 08:22）、9a994ec2（fix(topic-memory): add durable block inspection and recovery #1966, 07:57）。10-16 当天该 job 只有本 head 失败。
• 因此本 head 与 master 的差异只剩 uv.lock 内的 mcp 版本（外加同一 lock 轮次里的若干 marker 归一化），而失败步骤恰好是 fastmcp OpenAPI provider 的 MCP 工具结果形态。

既有噪声已排除：该 job 历史上确有与宿主相关的 flaky 失败，但断言形态不同——host_process_exit_*、concurrent_host_failed（run 38589535235、38671535589、38592435504、38587621581）。本次是「MCP 工具结果结构」类断言，且两个矩阵参数都命中。

背景（机制假设，未在本机验证）：mcp 是 fastmcp>=3.4,<4 的传递依赖，pyproject.toml 未直接约束它；1.30.0 是 1.x 维护版，其行为变更包括「HTTP 客户端只在端点同源内跟随重定向」与「空闲 Streamable HTTP 会话 30 分钟后过期」，与工具结果形态的关联需要确认。

请先给出结论再合入，二选一：

1. 在 Base（bcdac732 + mcp 1.28.1）或回退该 bump 的本地分支上复现/排除同一断言；若确认由本次 bump 引起，则不要合入；
2. 若判定与本 bump 无关，请把「已排查为非依赖原因」的结论与证据记录在本 PR（含失败 run 链接与排除依据）。

我没有在本地做 Base/Head 对照复现（ZCode 宿主验收依赖 Windows 上的真实宿主），这一残留不确定性如实标注；本条定级基于「同一 head 上唯一变化与该失败步骤同域」的证据，而不是已复现的因果。

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.