chore: merge python mcp sdk - #184
Merged
Merged
Conversation
* fix: expose safe denial outcomes on 0.1 Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com> * fix: make denial telemetry generic and explicit Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com> --------- Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>
cafalchio
requested review from
araujof,
jonpspri,
tedhabeck and
terylt
as code owners
September 17, 2026 16:53
Signed-off-by: cafalchio <mcafalchio@gmail.com>
cafalchio
force-pushed
the
merge_python_mcp_sdk
branch
from
September 17, 2026 16:59
e91560f to
4ec871f
Compare
araujof
added a commit
that referenced
this pull request
Sep 18, 2026
* refactor(mcp): migrate from MCP SDK v1 to v2.0.0b1 Breaking changes applied: - streamablehttp_client → streamable_http_client (renamed import) - McpError → MCPError (exception renamed) - mcp.types → mcp_types (split into separate package) - FastMCP → MCPServer (base class renamed) - SSLCapableFastMCP → SSLCapableMCPServer - MCPServer.__init__ no longer accepts host/port/transport_security; these are passed to run methods and streamable_http_app() instead - streamable_http_client returns 2-tuple (read, write) instead of 3-tuple; session ID tracking and manual termination removed (terminate_on_close=True) - Remove _http_client_factory; use pre-built httpx.AsyncClient directly - Replace self.settings.host/port with self.server_config.host/port Deprecations removed: - __terminate_http_session(), _session_id, _get_session_id, _http_client_factory Tests: 190 passing Signed-off-by: Jonathan Springer <jps@s390x.com> * chore(mcp): apply review fixes from PR #112 - Fix spurious whitespace in runtime.py f-strings and dict values - Replace broken server.settings.host/port doctests with server.server_config.* - Simplify getattr(_transport_security) to direct attribute access - Update stale "Fast MCP server" docstring and class Examples indentation - Update scaffold template to mcp==2.0.0b1 and mcp-types==2.0.0b1 - Remove unused ErrorData import in test_client_reconnect.py - Remove dead plugin._session_id = None test setup - Rename http_client_instance to http_client Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com> * fix(mcp): pass bind host to streamable_http_app and close caller-owned http client - runtime.py: pass host=server_config.host to streamable_http_app(). Without it the v2 SDK defaults host to 127.0.0.1 and auto-applies a localhost-only DNS rebinding allowlist when transport_security is None, causing HTTP 421 on every non-localhost request for servers bound to 0.0.0.0. - client.py: enter the caller-provided httpx.AsyncClient into the exit stack. The v2 SDK does not close a caller-provided client, so it leaked on every connection attempt. Entered before the transport so LIFO teardown fires the terminate_on_close DELETE while the client is still open. - test_runtime_coverage.py: set _transport_security on object.__new__ servers that bypass __init__, now required after dropping the getattr fallback. Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com> * test(mcp): cover v2 reconnect, transport wiring, and session security - Split test_invoke_hook_reconnects_on_session_terminated: the session-terminated success path (reconnect then retry succeeds) was dead code shadowed by a second plugin setup. Restore it as a real assertion and re-add the separate no-reconnect-on-other-errors test that had been merged away. - Assert streamable_http_client is called with a pre-built http_client instance and terminate_on_close=True (the v2 API change and DELETE-on-close behavior that replaced the removed __terminate_http_session). - Assert UDS servers populate _transport_security with DNS rebinding protection, non-UDS servers leave it unset, and run_streamable_http_async forwards both transport_security and the real bind host to streamable_http_app(). Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com> * fix(mcp): adapt external plugin client to MCP SDK 2.0.0b2's httpx2 switch MCP SDK 2.0.0b2 replaces httpx with httpx2 (pydantic's API-identical fork) internally. Update the TLS HTTP client factory in client.py to build httpx2.AsyncClient instances with httpx2 types (Timeout, Limits, Auth, AsyncHTTPTransport), and update test_client_coverage.py to patch httpx2.AsyncClient and drop the unused httpx import. No dependency changes: pyproject.toml already requires mcp>=2.0.0. Signed-off-by: Jonathan Springer <jps@s390x.com> * refactor: migrate from httpx to httpx2 Replace legacy httpx with httpx2 across PDP resolvers (opa, authzen), tools (integrity, catalog), and their tests. No dependency in the locked tree requires httpx 1.x -- mcp 2.0.0 already depends on httpx2. - Drop httpx and unused httpx[http2] extra; declare httpx2>=2.0.0 - Relock: removes httpx, httpcore, h2, hpack, hyperframe - Fix stale pre-migration httpx.AsyncClient refs in test_client_coverage.py (missing import would NameError) - Keep PLUGINS_HTTPX_* setting names for config compatibility Signed-off-by: Jonathan Springer <jps@s390x.com> * Fixed dependency in templates and update to latest sdk (#181) Signed-off-by: cafalchio <mcafalchio@gmail.com> * chore: merge python mcp sdk (#184) Signed-off-by: cafalchio <mcafalchio@gmail.com> --------- Signed-off-by: Jonathan Springer <jps@s390x.com> Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com> Signed-off-by: cafalchio <mcafalchio@gmail.com> Co-authored-by: Frederico Araujo <frederico.araujo@ibm.com> Co-authored-by: __cafa__ <47299428+cafalchio@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
merge python sdk into 0.1.x