Repository Issue Activity (beta)

#3476 Missing prompt-level _meta support in MCPServer.prompt() and Prompt model

#3391 Tool input schemas carry a pydantic-derived title on every property

#3332 [v2] Expose the SSE max_event_size setting in Streamable HTTP clients

#3463 DNS rebinding :* allowlist matches Host/Origin suffixes that are not ports

#1401 ClientSession Error Handling

#1842 ClientAuthenticator ignores token_endpoint_auth_method="none" when client_secret is stored

#2141 Add wildcard pattern support for `allowed_hosts` in transport security

#3303 check_resource_allowed(): path matching skips dot-segment/percent-encoding normalization (auth-boundary bypass)

#3469 StreamableHTTP: a client disconnect while reading the POST body is logged as an exception and answered 500

#3473 [Bug] Client sends empty _meta:{} on every request; strict servers (Meta Ads MCP) reject with HTTP 400

#3464 check_resource_allowed treats /api/../admin as under /api

#3472 [v2] Add an end-to-end public-client PKCE server contract

#3471 # TypeScript npm install @modelcontextprotocol/sdk zod # Python pip install mcp

#3358 Client SSRF / protocol confusion: streamable HTTP transport follows server 3xx into internal+loopback services (follow_redirects=True, no host validation; #2106 closed but fix #2180 never merged)

#3467 CallToolResult structuredContent is not alias-normalized to match outputSchema

#3439 [v2] modern streamable HTTP watch_disconnect can busy-loop and peg a CPU core

#3437 TransportSecuritySettings.allowed_hosts is compared case-sensitively (NOT RFC 9110 compliant), so an uppercase host entry (the Windows default) rejects every fetch-based client with 421

#3457 StdioServerParameters exposes no preexec_fn / rlimit / process-group hook for spawned MCP server subprocess

#3432 coerce_request_id() folds non-canonical numeric strings, conflating wire-distinct JSON-RPC ids

#3373 pyjwt[crypto] as an unconditional dependency blocks installation on platforms without a cryptography wheel (e.g. Windows on ARM)

#2317 Don't override client_metadata.scopes if they are already set

#3441 1.x: streamable_http client leaves a request unresolved when the SSE response stream ends without a response (fixed on 2.x by #3047 — backport request for v1.x)

#3452 [TDCA Notice] Congratulations — your project has been selected for the TDCA configuration network

#3408 test_safe_join_rejects_symlink_escape fails on Windows without elevation or Developer Mode

#1281 Modular system to define MCP Primitives