The official Python SDK for Model Context Protocol servers and clients
by modelcontextprotocolLast 12 weeks · 121 commits
5 of 6 standards met
Summary bind from the current request metadata at low-level request dispatch time clear the auth context for requests that do not carry an authenticated user add an integration regression test that changes bearer tokens mid-session in stateful streamable HTTP Problem In stateful streamable HTTP mode, request handlers can run inside task-group tasks whose context was copied from the session-creating request. That means keeps returning the bearer token from the first request in the session, even after later requests send a different header. Fix Each handled request already carries its Starlette request object in . At dispatch time, the low-level server now reads the authenticated user from that request scope and binds for the duration of the handler call. This refreshes on every request while preserving the existing behavior for unauthenticated apps. Validation reproduced the bug locally on current with an in-process ASGI app and a mutable bearer auth client ( stayed visible after switching to )
Repository: modelcontextprotocol/python-sdk. Description: The official Python SDK for Model Context Protocol servers and clients Stars: 21980, Forks: 3142. Primary language: Python. Languages: Python (100%), Shell (0%). License: MIT. Homepage: https://modelcontextprotocol.github.io/python-sdk/ Latest release: v1.26.0 (1mo ago). Open PRs: 100, open issues: 296. Last activity: 6h ago. Community health: 87%. Top contributors: dsp-ant, Kludex, ihrpr, maxisbey, jspahrsummers, felixweinberger, nick-merrill, jerome3o-anthropic, calclavia, pja-ant and others.
Python
Summary cancel the stdio client task group before closing its memory streams during shutdown move memory stream teardown until after the task group has exited add a regression test that exits while is blocked on a zero-buffer send Problem starts background tasks that read process stdout and forward messages into a zero-buffer memory stream. If the caller exits the context without consuming , can block on . Before this change, the cleanup path closed while was still running inside the task group. That raises and surfaces as an during context exit. Fix The cleanup sequence now cancels the task group before any of the memory streams it owns are closed. The stream handles are closed only after the task group has exited, so and are no longer racing against stream teardown. Validation reproduced the failure locally on current with a minimal stdio server that writes one JSON-RPC message and then idles
Summary guard the low-level exception logging path when the session write stream is already closed add regression coverage for both and from Problem When the server receives an exception from the stream during shutdown, tries to emit an internal error log notification through . If the session write stream has already been torn down, that best-effort log write can raise or and crash the enclosing task group. Fix Treat exception logging in this shutdown path as best-effort. If the write stream is already gone, skip the log notification and continue handling the original shutdown flow. Validation