// event · sdk
MCP Python SDK 2.2.0: origin-scoped redirects, idle session limits, OAuth issuer checks
sdkvendor: modelcontextprotocolpublished: 2h agoconfidence: 0.92id: 6434f1da-bbfc-4bdd-8bf8-d798b03c9c16
The official MCP Python SDK v2.2.0 tightens defaults for agent deployments: HTTP client redirects are only followed within the endpoint's origin, idle Streamable HTTP sessions expire after 30 min with a 10k session cap, and the OAuth client validates authorization-server issuer on the legacy path. Adds AuthSettings.validate_token_resource, issuer= on OAuth providers, and session_idle_timeout/max_sessions knobs.
capability delta
an agent can now cap idle Streamable HTTP MCP sessions, validate bearer-token resources, and restrict OAuth/HTTP redirects to the endpoint's origin via the mcp Python SDK 2.2.0.
// install
pip install -U mcp==2.2.0pypi · mcp @ 2.2.0
// example
python
from mcp.server.fastmcp import FastMCP
from mcp.server.auth.settings import AuthSettings
mcp = FastMCP(
"my-server",
auth=AuthSettings(
resource_server_url="https://my-server.example.com",
validate_token_resource=True, # new in 2.2.0
),
)
@mcp.tool()
def ping() -> str:
return "pong"
# Configure idle timeout and session cap for Streamable HTTP
mcp.run(
transport="streamable-http",
session_idle_timeout=1800, # seconds; None to disable
max_sessions=10_000, # None to disable
)
// links