# What changed in mcp-types

> 32 changes in mcp-types 2 from its official release notes, upgrade guides and advisories: 11 breaking, 4 deprecations, 1 security, 6 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/mcp-types/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## mcp-types 2

### Breaking changes

- initialize leaves out experimental when none is configured; client code reading capabilities.experimental on a legacy connection should handle None. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- The required version is now httpx2>=2.10.0, up from >=2.5.0; the new max_sse_event_size option needs it. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- Empty _meta is omitted from outbound requests; on receiving connections, ctx.meta is None rather than {}. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- Requests without params omit the params member, and middleware sees ctx.params as None. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- Invalid tool header annotations now raise InvalidSignature at registration, naming the tool and the problem. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- MCP HTTP clients and OAuth providers follow redirects only within the endpoint's origin, with an http-to-https upgrade on the same host allowed. Other redirects fail instead of being followed. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- A 403 without an `insufficient_scope` challenge is returned to the caller rather than retried. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- On the legacy discovery path, authorization server metadata is rejected when its issuer differs from the server's origin. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- Tool schema `$ref`s resolve only within that schema; an unresolvable reference raises `RuntimeError: Invalid schema for tool ...`. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- If fetching protected resource metadata fails with a 5xx or 429, the OAuth flow stops instead of falling back to legacy endpoints. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- Idle stateful Streamable HTTP sessions using the legacy spec now expire after 30 minutes; set `session_idle_timeout=None` to disable expiration. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)

### Security

- Controls whether only tokens that the `TokenVerifier` reports as issued for this server are accepted. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)

### Deprecations

- When `resource_server_url` is set, leaving `validate_token_resource` unset emits an `MCPDeprecationWarning`; set it to `True` or `False` because 3.0 defaults it to `True`. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- Constructing this provider without `issuer=` emits an `MCPDeprecationWarning`; pass the authorization server's issuer URL because 3.0 will require it. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- Constructing this provider without `issuer=` emits an `MCPDeprecationWarning`; pass the authorization server's issuer URL because 3.0 will require it. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- Imports of mcp.server.fastmcp point to the migration guide, helping developers address the import warning. (2.0.1) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.0.1)

### New APIs and options

- Server accepts get_tool_input_schema so a low-level server can supply a tool schema for header validation without running its tools/list handler. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- Added to streamable_http_client and StreamableHttpParameters; the default remains 1 MiB per SSE event, and None or a larger value permits larger tool results. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- MCPServer(subscriptions=False) stops serving subscriptions/listen and advertises listChanged and subscribe as false. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- Adds `issuer=` for specifying the authorization server's issuer URL. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- Streamable HTTP servers now hold at most 10,000 sessions; set `max_sessions=None` to disable the cap. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)
- Adds `issuer=` for specifying the authorization server's issuer URL. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)

### Behavior and default changes

- Context[AppState] now works on prompts and resource templates, as well as tools. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- Validation looks up the registered tool schema by name instead of running tools/list for each tools/call; list middleware no longer affects validation. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- Request timeouts pause while OAuthClientProvider waits on redirect_handler and callback_handler, so an interactive login no longer counts against them. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- Client spans now record JSON-RPC error responses; with mode="auto", probing a server without server/discover shows one ERROR span. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- A client DELETE now frees its session immediately. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)

### Fixes and other changes

- After a HeaderMismatch (-32020) rejection, the client re-lists tools and retries the call once. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- A raising progress_callback no longer fails a call on an in-process Client(server). (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- On Windows, stdio_client resolves the executable off the event loop. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- An explicit structuredContent null is now checked against the output schema instead of being treated as missing. (2.3.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.3.0)
- A refused opening request no longer leaves a session behind. (2.2.0) — [release notes](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0)