unstale

pypi / mcp

mcp

What changed in mcp 1 to 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

18 breaking1 security5 deprecations6 new APIs and options1 performance4 behavior and defaults1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

mcp 227 changes

Breaking changes 13

  • After a HeaderMismatch (-32020) rejection, call_tool re-lists the tools and retries once.

    2.3.0release notes

  • initialize omits experimental when none is configured; client code reading capabilities.experimental on a legacy connection should handle None.

    2.3.0release notes

  • The required version is now httpx2>=2.10.0, up from >=2.5.0; the new max_sse_event_size option depends on it.

    2.3.0release notes

  • Validation now looks up the registered tool schema by name instead of running tools/list for every tools/call; middleware filtering or rewriting tools/list no longer affects validation.

    2.3.0release notes

  • Empty _meta is omitted from outbound requests; on the receiving side ctx.meta is None rather than an empty mapping.

    2.3.0release notes

  • Ping and list requests without a cursor omit params; middleware sees ctx.params as None for a request without params.

    2.3.0release notes

  • Invalid header annotations now fail during tool registration with InvalidSignature, naming the tool and the problem.

    2.3.0release notes

  • On the legacy OAuth discovery path, metadata is rejected when its issuer differs from the server's origin.

    2.2.0release notes

  • MCP HTTP clients and OAuth providers follow redirects only within the endpoint's origin, with an HTTP-to-HTTPS upgrade on the same host allowed; other redirects fail.

    2.2.0release notes

  • Streamable HTTP servers now allow at most 10,000 sessions by default; set this parameter to None to disable the limit.

    1.30.0, 2.2.0release notesrelease notes

  • A 403 response without an insufficient_scope challenge is returned to the caller instead of being retried.

    2.2.0release notes

  • OAuth discovery stops instead of falling back to legacy endpoints when protected resource metadata cannot be fetched because of a 5xx or 429 response.

    1.30.0, 2.2.0release notesrelease notes

  • Stateful legacy Streamable HTTP sessions now expire after 30 minutes of inactivity by default; set this parameter to None to disable the timeout.

    1.30.0, 2.2.0release notesrelease notes

Security 1

  • Controls whether to accept only tokens that the TokenVerifier reports as issued for this server.

    1.30.0, 2.2.0release notesrelease notes

Deprecations 3

  • When resource_server_url is set, leaving validate_token_resource unset emits an MCPDeprecationWarning; set it to True or False because 3.0 defaults it to True.

    2.2.0release notes

  • Constructing this provider without issuer= emits an MCPDeprecationWarning; pass the authorization server's issuer URL because 3.0 will require it.

    1.30.0, 2.2.0release notesrelease notes

  • Constructing this provider without issuer= emits an MCPDeprecationWarning; pass the authorization server's issuer URL because 3.0 will require it.

    2.2.0release notes

New APIs and options 4

  • Adds an option to streamable_http_client and StreamableHttpParameters for setting the maximum SSE event size; pass None or raise it for larger tool results.

    2.3.0release notes

  • Setting subscriptions=False stops serving subscriptions/listen and advertises listChanged and subscribe as false.

    2.3.0release notes

  • Adds a way for a low-level server to supply a tool's schema for header validation without running its tools/list handler.

    2.3.0release notes

  • ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider accept an issuer URL, which is required in 3.0.

    2.2.0release notes

Performance 1

  • On Windows, stdio_client resolves the executable off the event loop.

    2.3.0release notes

Behavior and default changes 4

  • Client OpenTelemetry spans now record JSON-RPC error responses; in auto mode, a server without server/discover produces one ERROR span for the probe.

    2.3.0release notes

  • ctx: Context[AppState] now works on prompts and resource templates, not only on tools.

    2.3.0release notes

  • Request timeouts pause while redirect_handler and callback_handler wait for an interactive OAuth login; add a limit inside callback_handler if needed.

    2.3.0release notes

  • References resolve only within the tool's output schema; an unresolvable reference raises a RuntimeError identifying the invalid tool schema.

    2.2.0release notes

Fixes and other changes 1

  • A progress_callback that raises no longer fails the call on an in-process Client(server).

    2.3.0release notes

mcp 19 changes

Breaking changes 5

  • Authorization server metadata is rejected when its issuer does not match the server it was fetched for; client registrations are remembered per issuer.

    1.30.0release notes

  • OAuth provider requests follow the same-origin redirect rule as MCP HTTP clients.

    1.30.0release notes

  • Redirects are followed only within the endpoint's origin, or when upgrading HTTP to HTTPS on the same host; other redirects fail with httpx.HTTPStatusError.

    1.30.0release notes

  • Redirects are followed only within the endpoint's origin, or when upgrading HTTP to HTTPS on the same host; other redirects fail with httpx.HTTPStatusError.

    1.30.0release notes

  • Tool output-schema references are resolved only within the schema document.

    1.30.0release notes

Deprecations 2

  • Setting resource_server_url without validate_token_resource emits a DeprecationWarning; set it to True or False.

    1.30.0release notes

  • Using the provider without issuer= emits a DeprecationWarning; pass the authorization server's issuer URL.

    1.30.0release notes

New APIs and options 2

  • Accepts issuer= to specify the authorization server's issuer URL.

    1.30.0release notes

  • Accepts issuer= to specify the authorization server's issuer URL.

    1.30.0release notes