chore(deps): update dependency mcp to v1.28.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mcp	==1.19.0 → ==1.28.1

---

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

CVE-2025-66416 / GHSA-9h52-p55h-vw2f

More information

Details

Description

The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.

Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.

Servers created via FastMCP() now have DNS rebinding protection enabled by default when the host parameter is 127.0.0.1 or localhost. Users are advised to update to version 1.23.0 to receive this automatic protection. Users with custom low-level server configurations using StreamableHTTPSessionManager or SseServerTransport directly should explicitly configure TransportSecuritySettings when running an unauthenticated server on localhost.

Severity

• CVSS Score: 7.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f
• https://github.com/modelcontextprotocol/python-sdk/commit/d3a184119e4479ea6a63590bc41f01dc06e3fa99
• https://nvd.nist.gov/vuln/detail/CVE-2025-66416
• https://github.com/advisories/GHSA-9h52-p55h-vw2f
• https://github.com/modelcontextprotocol/python-sdk
• https://github.com/pypa/advisory-database/tree/main/vulns/mcp/PYSEC-2026-1617.yaml
• https://pypi.org/project/mcp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

CVE-2026-52869 / GHSA-jpw9-pfvf-9f58

More information

Details

Summary

In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a session ID could send JSON-RPC messages on that session, regardless of which bearer token the request carried.

Am I affected?

Only if a developer's application server uses an HTTP transport (SSE, or Streamable HTTP in stateful mode) and authenticates requests. Servers on stdio, stateless Streamable HTTP, or with no authentication configured are not affected.

Details

Both transports look up the target session by its identifier alone — the session_id query parameter for SSE (mcp.server.sse.SseServerTransport) and the Mcp-Session-Id header for Streamable HTTP (mcp.server.streamable_http_manager.StreamableHTTPSessionManager). Once the lookup succeeded, the request was handled on that session without comparing its authentication context to the credentials presented when the session was created, so a request authenticated as a different OAuth client could inject messages into the session. On the SSE transport the response is delivered to the original client's event stream; on the Streamable HTTP transport it is returned on the injecting request, so the injecting client can also read the result. The SSE transport has been affected since the first release; the Streamable HTTP transport since version 1.8.0.

Impact

Servers using either HTTP transport together with the SDK's built-in bearer-token authentication are affected: the per-client isolation that authentication provides can be bypassed for any session whose ID is known. Session IDs are randomly generated UUIDs, so exploitation requires obtaining one out of band (logs, network observation). Servers that do not enable bearer-token authentication have no per-client isolation to bypass and are not addressed by this advisory, and stateless Streamable HTTP deployments do not maintain sessions and are unaffected.

Mitigation

Upgrade to version 1.27.2 or later, which records the authenticated principal that created each session — the OAuth client ID together with the token's issuer and subject when the token verifier supplies them — and answers requests presenting a different principal with the same 404 response as for an unknown session.

Deployments where many end users share a single OAuth client (hosted MCP clients, gateways) should ensure their token verifier populates AccessToken.subject (e.g. from the token's sub claim) so sessions are isolated per user rather than per client. Deployments using a custom authentication backend other than the built-in BearerAuthBackend should enforce an equivalent check themselves.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

References

• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58
• https://nvd.nist.gov/vuln/detail/CVE-2026-52869
• https://github.com/modelcontextprotocol/python-sdk/pull/2690
• https://github.com/modelcontextprotocol/python-sdk/pull/2719
• https://github.com/modelcontextprotocol/python-sdk/commit/1abcca2408a6b50e10ec601181f63f9978705c00
• https://github.com/modelcontextprotocol/python-sdk/commit/ce267b6fc515dc4efc1dc70b6975b16ff0feef0a
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2
• https://github.com/advisories/GHSA-jpw9-pfvf-9f58

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

CVE-2026-59950 / GHSA-vj7q-gjh5-988w

More information

Details

Summary

In affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this purpose was not wired into the WebSocket transport, so there was no SDK-level way to restrict which origins could connect.

Am I affected?

Only if a developer's application server exposes mcp.server.websocket.websocket_server. This transport has never been part of the MCP specification, is marked deprecated, and is not reachable through FastMCP — a developer must have wired it into an ASGI application themselves. Servers using stdio, SSE, or Streamable HTTP are not affected by this advisory.

Details

websocket_server() constructed a Starlette WebSocket and called accept(subprotocol="mcp") immediately, with no inspection of the connection's headers. By contrast, SseServerTransport and StreamableHTTPServerTransport accept an optional security_settings: TransportSecuritySettings and run TransportSecurityMiddleware.validate_request() against the incoming Host and Origin headers before establishing a session. Because browsers attach an Origin header to cross-origin WebSocket upgrade requests but do not enforce a same-origin policy on the response, a web page served from any origin could open a WebSocket to a reachable MCP server on this transport, complete the initialize handshake, and issue JSON-RPC requests on the resulting session.

Impact

A user who runs an MCP server on this transport bound to localhost or a LAN address, without a separate authentication or origin gate in front of it, and visits a malicious web page, can have that page enumerate and invoke the server's tools and read its resources. The consequences depend entirely on what the server exposes. The transport itself requires no token or prior session. Some browsers prompt before allowing a public page to open a connection to a local-network address, which adds a user-interaction step but is not a substitute for server-side validation.

Mitigation

Upgrade to version 1.28.1 or later, in which websocket_server() accepts the same optional security_settings: TransportSecuritySettings argument as the other HTTP-based transports and validates the Host and Origin headers before accepting the handshake; a request that fails validation is rejected with HTTP 403 and ValueError("Request validation failed") is raised to the caller. As with the other transports the parameter defaults to None, which leaves validation disabled, so upgrading alone does not change behaviour: pass a TransportSecuritySettings with enable_dns_rebinding_protection=True and appropriate allowed_hosts / allowed_origins to receive the protection. The recommended path remains to migrate off this deprecated transport to Streamable HTTP, where FastMCP enables this protection automatically for localhost binds. The WebSocket transport has been removed entirely in v2.

Severity

• CVSS Score: 7.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w
• https://nvd.nist.gov/vuln/detail/CVE-2026-59950
• https://github.com/modelcontextprotocol/python-sdk/pull/2992
• https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.28.1
• https://github.com/advisories/GHSA-vj7q-gjh5-988w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

modelcontextprotocol/python-sdk (mcp)

v1.28.1

Compare Source

What's Changed

• [v1.x] Buffer per-request StreamableHTTP streams; store priming event before dispatch by @​maxisbey in #​2948
• [v1.x] Set Development Status classifier to Production/Stable by @​maxisbey in #​2976
• [v1.x] Support TransportSecuritySettings in the WebSocket server transport by @​maxisbey in #​2992

Full Changelog: modelcontextprotocol/python-sdk@v1.28.0...v1.28.1

v1.28.0

Compare Source

Deprecations

Two API surfaces now emit DeprecationWarning ahead of their removal in v2. Nothing is removed in 1.x, and the warnings fire only when the deprecated API is called - importing the modules stays silent.

• WebSocket transport - mcp.client.websocket.websocket_client and mcp.server.websocket.websocket_server. WebSocket was never part of the MCP specification; use the streamable HTTP transport instead. The TypeScript SDK has likewise removed its WebSocket client for v2 (modelcontextprotocol/typescript-sdk#1783).
• Experimental tasks API - ClientSession.experimental, Server.experimental, ServerSession.experimental, and the experimental_task_handlers= kwarg on ClientSession. Tasks (SEP-1686) were removed from the MCP specification and are expected to return as a separate MCP extension.

If your test suite runs with filterwarnings = ["error"] and exercises these paths, add a scoped ignore such as ignore:The experimental tasks API is deprecated:DeprecationWarning or ignore:The WebSocket .* transport is deprecated:DeprecationWarning.

See #​2828 for full details.

What's Changed

• [v1.x] Support Python 3.14 by @​maxisbey in #​2769
• fix: omit null optional fields from task result payloads by @​liuzemei in #​2809
• [v1.x] Deprecate the WebSocket transport and the experimental tasks entry points by @​maxisbey in #​2828
• [v1.x] Add a v2 status banner to the README by @​maxisbey in #​2835
• [v1.x] Deflake the child process cleanup tests by @​maxisbey in #​2839

New Contributors

• @​liuzemei made their first contribution in #​2809

Full Changelog: modelcontextprotocol/python-sdk@v1.27.2...v1.28.0

v1.27.2

Compare Source

What's Changed

• [v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages artifact by @​maxisbey in #​2635
• [v1.x] Add subject and claims to AccessToken by @​maxisbey in #​2690
• [v1.x] Bind transport sessions to the authenticated principal by @​maxisbey in #​2719
• [v1.x] Scope experimental tasks to the session that created them by @​maxisbey in #​2720

Full Changelog: modelcontextprotocol/python-sdk@v1.27.1...v1.27.2

v1.27.1

Compare Source

What's Changed

• [v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2.13 compat) by @​maxisbey in #​2435
• [v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by @​felixweinberger in #​2405
• [v1.x] build: restrict httpx to <1.0.0 by @​maxisbey in #​2559
• [v1.x] refactor: import SSEError from httpx_sse public API by @​maxisbey in #​2561

Full Changelog: modelcontextprotocol/python-sdk@v1.27.0...v1.27.1

v1.27.0

Compare Source

What's Changed

• fix: remove unused requests dependency from simple-chatbot example by @​maxisbey in #​1959
• ci: backport conformance tests from main to v1.x by @​felixweinberger in #​2068
• fix: add RFC 8707 resource validation to OAuth client by @​felixweinberger in #​2069
• feat: add idle timeout for StreamableHTTP sessions by @​felixweinberger in #​1994
• [v1.x] fix: prevent command injection in example URL opening by @​maxisbey in #​2085
• Add VERSIONING.md, ROADMAP.md, and DEPENDENCY_POLICY.md by @​felixweinberger in #​2084
• docs: restructure README into docs/ pages by @​felixweinberger in #​2091
• docs: comprehensive feature documentation for SEP-1730 Tier 1 by @​felixweinberger in #​2090
• docs: fix stub pages and improve docs structure by @​felixweinberger in #​2101
• docs: fix GitHub links to point to v1.x branch by @​felixweinberger in #​2102
• docs: add snippet verification for docs/ pages by @​felixweinberger in #​2115
• docs: add server-side tool error handling documentation by @​felixweinberger in #​2129
• Backport: Add missing TasksCallCapability to v1.x by @​BabyChrist666 in #​2137
• [v1.x] fix: handle non-UTF-8 bytes in stdio server stdin by @​maxisbey in #​2303
• [v1.x] fix: handle ClosedResourceError when transport closes mid-request by @​owendevereaux in #​2334

New Contributors

• @​owendevereaux made their first contribution in #​2334

Full Changelog: modelcontextprotocol/python-sdk@v1.26.0...v1.27.0

v1.26.0

Compare Source

What's Changed

• ci: add all-green job to pull-request-checks workflow by @​maxisbey in #​1929
• Backport: Support for Resource and ResourceTemplate metadata by @​maxisbey in #​1928
• [v1.x] fix: return HTTP 404 for unknown session IDs instead of 400 by @​LucaButBoring in #​1945

Full Changelog: modelcontextprotocol/python-sdk@v1.25.0...v1.26.0

v1.25.0

Compare Source

Branching Update

Starting with this release, the repository has adopted a new branching strategy for v2 development:

• main — v2 development (breaking changes)
• v1.x — v1 maintenance (security and critical bug fixes only, with very rare feature additions ported from main)

Users who need to stay on v1.x should pin to mcp>=1.25,<2.

The current plan is to work through v2 and have it released some time in Q1. This also relies on the next upcoming spec release which will heavily change how the transport layer works, which in turn will guide a lot of how we architect v2.

---

What's Changed

• Fix for Url Elicitation issue 1768 by @​gopitk in #​1780
• ci: add v1.x branch to main-checks workflow by @​maxisbey in #​1802

New Contributors

• @​gopitk made their first contribution in #​1780

Full Changelog: modelcontextprotocol/python-sdk@v1.24.0...v1.25.0

v1.24.0

Compare Source

What's Changed

• feat: client-side support for SEP-1577 sampling with tools by @​jlowin in #​1722
• Fix JSON-RPC error response ID matching by @​crondinini-ant in #​1720
• Add streamable_http_client which accepts httpx.AsyncClient instead of httpx_client_factory by @​Kludex in #​1177
• fix: use correct python command name in test_stdio.py by @​WOnder93 in #​1782

New Contributors

• @​WOnder93 made their first contribution in #​1782

Full Changelog: modelcontextprotocol/python-sdk@v1.23.3...v1.24.0

v1.23.3

Compare Source

What's Changed

• refactor(auth): remove unused _register_client method by @​maxisbey in #​1748
• feat: add workflow to comment on PRs when released by @​felixweinberger in #​1750
• fix: allow MIME type parameters in resource validation (RFC 2045) by @​antonpk1 in #​1755
• Skip empty SSE data to avoid parsing errors by @​injusticescorpio in #​1753
• chore: remove release-comment workflow by @​maxisbey in #​1758

New Contributors

• @​antonpk1 made their first contribution in #​1755
• @​injusticescorpio made their first contribution in #​1753

Full Changelog: modelcontextprotocol/python-sdk@v1.23.2...v1.23.3

v1.23.2

Compare Source

What's Changed

• fix: add lifespan context manager to StreamableHTTP mounting examples by @​TheMailmans in #​1669
• fix: handle ClosedResourceError in StreamableHTTP message router by @​Edison-A-N in #​1384
• fix: skip priming events and close_sse_stream for old protocol versions by @​felixweinberger in #​1719

New Contributors

• @​TheMailmans made their first contribution in #​1669
• @​Edison-A-N made their first contribution in #​1384

Full Changelog: modelcontextprotocol/python-sdk@v1.23.1...v1.23.2

v1.23.1

Compare Source

What's Changed

• chore: update LATEST_PROTOCOL_VERSION to 2025-11-25 by @​felixweinberger in #​1715

Full Changelog: modelcontextprotocol/python-sdk@v1.23.0...v1.23.1

v1.23.0

Compare Source

Summary

This release brings us up to speed with the latest MCP spec 2025-11-25. Take a look at the latest spec as well as the release blog post.

What's Changed

• Add tests for JSON Schema 2020-12 field preservation (SEP-1613) by @​felixweinberger in #​1649
• Add client_secret_basic authentication support by @​jonshea in #​1334
• Implement SEP-1577 - Sampling With Tools by @​ochafik in #​1594
• SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance by @​chughtapan in #​1246
• [auth][conformance] add conformance auth client by @​pcarleton in #​1640
• Implement SEP-986: Tool name validation by @​felixweinberger in #​1655
• fix: url for spec by @​felixweinberger in #​1659
• feat: implement SEP-991 URL-based client ID (CIMD) support by @​pcarleton in #​1652
• Update doc string on custom_route by @​pcarleton in #​1660
• Implement SEP-1036: URL mode elicitation for secure out-of-band interactions by @​cbcoutinho in #​1580
• Skip empty SSE data to avoid parsing errors by @​felixweinberger in #​1670
• SEP-1686: Tasks by @​maxisbey in #​1645
• Add on_session_created callback option by @​crondinini-ant in #​1710
• Add SSE polling support (SEP-1699) by @​felixweinberger in #​1654
• Support client_credentials flow with JWT and Basic auth by @​pcarleton in #​1663
• feat: backwards-compatible create_message overloads for SEP-1577 by @​felixweinberger in #​1713
• Auto-enable DNS rebinding protection for localhost servers by @​pcarleton (d3a1841)

New Contributors

• @​ochafik made their first contribution in #​1594

Full Changelog: modelcontextprotocol/python-sdk@v1.22.0...v1.23.0

v1.22.0

Compare Source

What's Changed

• feat: Pass through and expose additional parameters in ClientSessionGroup.call_tool and .connect_to_server by @​inaku-Gyan in #​1576
• chore: Lazy import jsonschema library by @​wuliang229 in #​1596
• docs: Update examples to use stateless HTTP with JSON responses by @​domdomegg in #​1499

New Contributors

• @​wuliang229 made their first contribution in #​1596

Full Changelog: modelcontextprotocol/python-sdk@v1.21.1...v1.22.0

v1.21.2

Compare Source

Hotfix Release

This is a hotfix release to address a critical bug in OAuth scope handling that caused failures on 401 responses.

Related:

• #​1630
• #​1632

What's Changed

• fix get_client_metadata_scopes on 401 by @​abliznyuk in #​1631

New Contributors

• @​abliznyuk made their first contribution in #​1631

Full Changelog: modelcontextprotocol/python-sdk@v1.21.1...v1.21.2

v1.21.1

Compare Source

What's Changed

• Add everything-server for comprehensive MCP conformance testing by @​felixweinberger in #​1587
• Get baseline 100% clean coverage by @​maxisbey in #​1553
• Add end-of-file-fixer pre-commit hook by @​maxisbey in #​1610
• Add coverage baseline commit to git-blame-ignore by @​maxisbey in #​1613
• Add SEP-1034 conformance test support to everything-server by @​felixweinberger in #​1604
• refactor: extract OAuth helper functions and simplify provider state by @​maxisbey in #​1586
• Add client_id_metadata_document_supported to OAuthMetadata by @​maxisbey in #​1603
• Fix OAuth discovery fallback and URL ordering by @​maxisbey in #​1624
• Refactor func_metadata() implementation by @​Viicos in #​1496
• Fix CI highest resolution test to actually test highest versions by @​maxisbey in #​1609

New Contributors

• @​Viicos made their first contribution in #​1496

Full Changelog: modelcontextprotocol/python-sdk@v1.21.0...v1.21.1

v1.21.0

Compare Source

What's Changed

• docs: use article "an" before "MCP" instead of "a" by @​koic in #​1558
• Update Starlette to 0.49.1 in uv.lock by @​ColeMurray in #​1559
• Fix typo in ClientSessionGroup doc string by @​inaku-Gyan in #​1572
• Implement SEP-985: OAuth Protected Resource Metadata discovery fallback by @​cbcoutinho in #​1548
• Add --frozen flag to uv run commands in Claude config by @​maxisbey in #​1583
• Add get_server_capabilities() to ClientSession by @​crondinini-ant in #​1588

New Contributors

• @​koic made their first contribution in #​1558
• @​ColeMurray made their first contribution in #​1559
• @​inaku-Gyan made their first contribution in #​1572
• @​cbcoutinho made their first contribution in #​1548
• @​crondinini-ant made their first contribution in #​1588

Full Changelog: modelcontextprotocol/python-sdk@v1.20.0...v1.21.0

v1.20.0

Compare Source

What's Changed

• Relax Accept header requirement for JSON-only responses by @​domdomegg in #​1500
• fix: replace deprecated dev-dependencies in examples/clients by @​yukuanj in #​1518
• fix: Update spec links to new modelcontextprotocol.io location by @​maxisbey in #​1491
• fix: Replace fixed sleep with active server readiness check in SSE tests by @​maxisbey in #​1526
• fix: Replace arbitrary sleeps with active server readiness checks in tests by @​maxisbey in #​1527
• Fix flaky timeout test in test_88_random_error by @​maxisbey in #​1525
• fix: Replace remaining manual server polling with wait_for_server helper by @​maxisbey in #​1529
• Implement RFC 7523 JWT flows by @​LucaButBoring in #​1247
• Fix pyright error and replace wildcard import with explicit imports by @​maxisbey in #​1532
• Fix auth client example URL handling for oauth provider by @​pcarleton in #​1549

New Contributors

• @​domdomegg made their first contribution in #​1500
• @​pcarleton made their first contribution in #​1549

Full Changelog: modelcontextprotocol/python-sdk@v1.19.0...v1.20.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.