MCP Python SDK 发布: v2.2.0

来源摘要

`pip install -U mcp`. Docs: https://py.sdk.modelcontextprotocol.io/ A few defaults changed in this release. If you run a server or client on 2.x, skim these first: ## Behaviour changes **HTTP client redirects are only followed within the endpoint's origin** (#3397) - `Client("https://...")`, `streamable_http_client` and `sse_client` follow a redirect only if it stays on the same scheme, host and port (or upgrades `http` to `https` on the same host). - A redirect anywhere else is not followed: the call fails with `MCPError` and the session stays usable (an SSE connect fails with `httpx2.HTTPStatusError`). If that other URL is the server you meant, use it as the endpoint URL. - The `follow_redirects` setting on an `httpx2.AsyncClient` you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more. - The OAuth providers apply the same rule to their own requests. **Idle Streamable HTTP sessions now expire (legacy <=2025-11-25 spec(** (#3395) - A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again. - Clients that keep the GET stream open (the SDK's `Client` does) are not affected. Neither are stateless servers or 2026-07-28 connections. - A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503. - To turn either off: `mcp.run(transport="streamable-http", session_idle_timeout=None, max_sessions=None)` (also on `streamable_http_app()` and `run_streamable_http_async()`). **The OAuth client checks the authorization server's `issuer` on the legacy path too** (#3398) - For servers without protected resource metadata, authorization server metadata whose `issuer` isn't the server's own origin is now rejected with `OAuthFlowE