Issues

• Skills: URI traversal validation skips percent-encoded dot-segments

  modelcontextprotocol/python-sdk#3685 · Filter by author chauvuusvn opened on Oct 12, 2026 · Updated on Oct 12, 2026

• Streamable HTTP server rejects a mixed-case Content-Type with 415

  bugv1v2
  modelcontextprotocol/python-sdk#3670 · Filter by author v0ropaev opened on Oct 10, 2026 · Updated on Oct 11, 2026
  4

• Add a filesystem backed provider for the Skills extension

  enhancement
  modelcontextprotocol/python-sdk#3683 · Filter by author vijaydeepsinha opened on Oct 11, 2026 · Updated on Oct 11, 2026

• Simple chatbot: unused Server.stdio_context attribute obscures transport ownership

  enhancement
  modelcontextprotocol/python-sdk#3654 · by Filter by author JEFFTIMES was closed on Oct 11, 2026 · Updated on Oct 11, 2026

• Add SEP-2640 (Skills Extension) protocol support

  enhancement
  modelcontextprotocol/python-sdk#3486 · by Filter by author vijaydeepsinha was closed on Oct 11, 2026 · Updated on Oct 11, 2026
  

• MCPServer answers an unknown tool with an isError result; the spec (and the TS SDK) use JSON-RPC -32602

  bugv1v2
  modelcontextprotocol/python-sdk#3659 · Filter by author ANcpLua opened on Oct 8, 2026 · Updated on Oct 11, 2026
  4

• OAuthClientProvider._initialize() breaks transparent refresh: missing update_token_expiry + missing oauth_metadata load

  bugP1v1v2
  modelcontextprotocol/python-sdk#3250 · Filter by author draesthetic opened on Aug 4, 2026 · Updated on Oct 11, 2026
  1

• Streamable HTTP client logs a WARNING for valid 202 Accepted on session termination (DELETE)

  bugv1v2
  modelcontextprotocol/python-sdk#3546 · by Filter by author deadczarvc was closed on Oct 11, 2026 · Updated on Oct 11, 2026
  5

• Don't override client_metadata.scopes if they are already set

  authenhancementneeds decisionP2
  modelcontextprotocol/python-sdk#2317 · Filter by author artdent opened on Mar 20, 2026 · Updated on Oct 11, 2026
  6

• [v1.x] Server revalidates every tools/call with one-shot jsonschema.validate(), re-checking the schema each time

  bugv1
  modelcontextprotocol/python-sdk#3676 · Filter by author mechnotech opened on Oct 11, 2026 · Updated on Oct 11, 2026

• MCPServer answers an unknown prompt name or a missing required argument with code 0 / -32603; the spec uses -32602

  bugv1v2
  modelcontextprotocol/python-sdk#3669 · Filter by author ANcpLua opened on Oct 10, 2026 · Updated on Oct 11, 2026
  1

• stdio server never exits on stdin EOF while the client leaves stdout unread

  bugv1v2
  modelcontextprotocol/python-sdk#3674 · Filter by author superbiche opened on Oct 10, 2026 · Updated on Oct 11, 2026
  1

• Windows: TextIOWrapper in stdio_server() emits CRLF instead of LF, corrupting newline-delimited JSON messages

  bugfix proposedP2ready for work
  modelcontextprotocol/python-sdk#2433 · Filter by author DonovanDeHart opened on Apr 13, 2026 · Updated on Oct 11, 2026
  10

• Document and provide hooks for sandboxing file and network access in MCP tools

  documentationenhancementneeds confirmation
  modelcontextprotocol/python-sdk#1705 · Filter by author dgenio opened on Nov 28, 2025 · Updated on Oct 10, 2026
  29

• Streamable HTTP: ASGI application returns before the full SSE body is sent

  bugv1v2
  modelcontextprotocol/python-sdk#3494 · Filter by author jonpspri opened on Sep 11, 2026 · Updated on Oct 10, 2026
  4

• Type annotation gaps and unhandled FileNotFoundError in src/mcp/cli/cli.py

  enhancement
  modelcontextprotocol/python-sdk#3673 · Filter by author avk-dwvd opened on Oct 10, 2026 · Updated on Oct 10, 2026

• DPoP sender-constrained tokens not implemented in OAuth client (spec mandates it)

  enhancement
  modelcontextprotocol/python-sdk#3671 · Filter by author eaakun opened on Oct 10, 2026 · Updated on Oct 10, 2026
  1

• Revocation requires client_secret to be present

  bugv1v2
  modelcontextprotocol/python-sdk#3508 · Filter by author jaworpa opened on Sep 15, 2026 · Updated on Oct 10, 2026
  4

• Generated output schema uses Pydantic's validation shape while structured output uses its serialization shape

  bugneeds confirmationP2v1v2
  modelcontextprotocol/python-sdk#3100 · Filter by author destire-mio opened on Jul 16, 2026 · Updated on Oct 10, 2026
  3

• Client transports/sessions swallow the original exception; applications cannot classify 401/403/429 transport failures

  enhancement
  modelcontextprotocol/python-sdk#3569 · by Filter by author dgilman-perplexity was closed on Oct 10, 2026 · Updated on Oct 10, 2026 · Duplicate
  1

• Streamable HTTP client treats 404 as terminal instead of re-initializing, as the spec requires

  bugv1v2
  modelcontextprotocol/python-sdk#3556 · by Filter by author ikeniborn was closed on Oct 10, 2026 · Updated on Oct 10, 2026 · Duplicate
  3

• OAuthClientProvider auth lock is permanently poisoned when httpx closes async_auth_flow from a different task (RuntimeError: The current task is not holding this lock)

  bugv1v2
  modelcontextprotocol/python-sdk#3382 · by Filter by author flanker-stack was closed on Oct 10, 2026 · Updated on Oct 10, 2026 · Duplicate
  5

• OAuth client: authorization URL is built with a second ? when the advertised authorization_endpoint already carries a query (RFC 6749 §3.1)

  bugv1v2
  modelcontextprotocol/python-sdk#3505 · by Filter by author r-marques was closed on Oct 10, 2026 · Updated on Oct 10, 2026 · Duplicate
  5

• Streamable HTTP clean EOF reconnects can exceed the request retry budget

  bugneeds confirmationP2v1v2
  modelcontextprotocol/python-sdk#3307 · by Filter by author jstar0 was closed on Oct 10, 2026 · Updated on Oct 10, 2026 · Duplicate
  6

• Streamable HTTP notification sends a second response when the session writer is closed

  v1v2
  modelcontextprotocol/python-sdk#3651 · by Filter by author amenck was closed on Oct 10, 2026 · Updated on Oct 10, 2026 · Duplicate
  3