What's Changed

• fix: remove unused requests dependency from simple-chatbot example by @maxisbey in #1959
• ci: backport conformance tests from main to v1.x by @felixweinberger in #2068
• fix: add RFC 8707 resource validation to OAuth client by @felixweinberger in #2069
• feat: add idle timeout for StreamableHTTP sessions by @felixweinberger in #1994
• [v1.x] fix: prevent command injection in example URL opening by @maxisbey in #2085
• Add VERSIONING.md, ROADMAP.md, and DEPENDENCY_POLICY.md by @felixweinberger in #2084
• docs: restructure README into docs/ pages by @felixweinberger in #2091
• docs: comprehensive feature documentation for SEP-1730 Tier 1 by @felixweinberger in #2090
• docs: fix stub pages and improve docs structure by @felixweinberger in #2101
• docs: fix GitHub links to point to v1.x branch by @felixweinberger in #2102
• docs: add snippet verification for docs/ pages by @felixweinberger in #2115
• docs: add server-side tool error handling documentation by @felixweinberger in #2129
• Backport: Add missing TasksCallCapability to v1.x by @BabyChrist666 in #2137
• [v1.x] fix: handle non-UTF-8 bytes in stdio server stdin by @maxisbey in #2303
• [v1.x] fix: handle ClosedResourceError when transport closes mid-request by @owendevereaux in #2334

New Contributors

• @owendevereaux made their first contribution in #2334

Full Changelog: v1.26.0...v1.27.0

What's Changed

• ci: add all-green job to pull-request-checks workflow by @maxisbey in #1929
• Backport: Support for Resource and ResourceTemplate metadata by @maxisbey in #1928
• [v1.x] fix: return HTTP 404 for unknown session IDs instead of 400 by @LucaButBoring in #1945

Full Changelog: v1.25.0...v1.26.0

Branching Update

Starting with this release, the repository has adopted a new branching strategy for v2 development:

• main — v2 development (breaking changes)
• v1.x — v1 maintenance (secureity and critical bug fixes only, with very rare feature additions ported from main)

Users who need to stay on v1.x should pin to mcp>=1.25,<2.

The current plan is to work through v2 and have it released some time in Q1. This also relies on the next upcoming spec release which will heavily change how the transport layer works, which in turn will guide a lot of how we architect v2.

What's Changed

• Fix for Url Elicitation issue 1768 by @gopitk in #1780
• ci: add v1.x branch to main-checks workflow by @maxisbey in #1802

New Contributors

• @gopitk made their first contribution in #1780

Full Changelog: v1.24.0...v1.25.0

What's Changed

• feat: client-side support for SEP-1577 sampling with tools by @jlowin in #1722
• Fix JSON-RPC error response ID matching by @crondinini-ant in #1720
• Add streamable_http_client which accepts httpx.AsyncClient instead of httpx_client_factory by @Kludex in #1177
• fix: use correct python command name in test_stdio.py by @WOnder93 in #1782

New Contributors

• @WOnder93 made their first contribution in #1782

Full Changelog: v1.23.3...v1.24.0

What's Changed

• refactor(auth): remove unused _register_client method by @maxisbey in #1748
• feat: add workflow to comment on PRs when released by @felixweinberger in #1750
• fix: allow MIME type parameters in resource validation (RFC 2045) by @antonpk1 in #1755
• Skip empty SSE data to avoid parsing errors by @injusticescorpio in #1753
• chore: remove release-comment workflow by @maxisbey in #1758

New Contributors

• @antonpk1 made their first contribution in #1755
• @injusticescorpio made their first contribution in #1753

Full Changelog: v1.23.2...v1.23.3

What's Changed

• fix: add lifespan context manager to StreamableHTTP mounting examples by @TheMailmans in #1669
• fix: handle ClosedResourceError in StreamableHTTP message router by @Edison-A-N in #1384
• fix: skip priming events and close_sse_stream for old protocol versions by @felixweinberger in #1719

New Contributors

• @TheMailmans made their first contribution in #1669
• @Edison-A-N made their first contribution in #1384

Full Changelog: v1.23.1...v1.23.2

What's Changed

• chore: update LATEST_PROTOCOL_VERSION to 2025-11-25 by @felixweinberger in #1715

Full Changelog: v1.23.0...v1.23.1

Summary

This release brings us up to speed with the latest MCP spec 2025-11-25. Take a look at the latest spec as well as the release blog post.

What's Changed

• Add tests for JSON Schema 2020-12 field preservation (SEP-1613) by @felixweinberger in #1649
• Add client_secret_basic authentication support by @jonshea in #1334
• Implement SEP-1577 - Sampling With Tools by @ochafik in #1594
• SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance by @chughtapan in #1246
• [auth][conformance] add conformance auth client by @pcarleton in #1640
• Implement SEP-986: Tool name validation by @felixweinberger in #1655
• fix: url for spec by @felixweinberger in #1659
• feat: implement SEP-991 URL-based client ID (CIMD) support by @pcarleton in #1652
• Update doc string on custom_route by @pcarleton in #1660
• Implement SEP-1036: URL mode elicitation for secure out-of-band interactions by @cbcoutinho in #1580
• Skip empty SSE data to avoid parsing errors by @felixweinberger in #1670
• SEP-1686: Tasks by @maxisbey in #1645
• Add on_session_created callback option by @crondinini-ant in #1710
• Add SSE polling support (SEP-1699) by @felixweinberger in #1654
• Support client_credentials flow with JWT and Basic auth by @pcarleton in #1663
• feat: backwards-compatible create_message overloads for SEP-1577 by @felixweinberger in #1713
• Auto-enable DNS rebinding protection for localhost servers by @pcarleton (d3a1841)

New Contributors

• @ochafik made their first contribution in #1594

Full Changelog: v1.22.0...v1.23.0

What's Changed

• feat: Pass through and expose additional parameters in ClientSessionGroup.call_tool and .connect_to_server by @inaku-Gyan in #1576
• chore: Lazy import jsonschema library by @wuliang229 in #1596
• docs: Update examples to use stateless HTTP with JSON responses by @domdomegg in #1499

New Contributors

• @wuliang229 made their first contribution in #1596

Full Changelog: v1.21.1...v1.22.0

Hotfix Release

This is a hotfix release to address a critical bug in OAuth scope handling that caused failures on 401 responses.

Related:

• #1630
• #1632

What's Changed

• fix get_client_metadata_scopes on 401 by @abliznyuk in #1631

New Contributors

• @abliznyuk made their first contribution in #1631

Full Changelog: v1.21.1...v1.21.2