MCP Python SDK v1.30.0：HTTP 重定向限制
v1.30.0
推荐理由
MCP Python SDK 1.x 用户注意：v1.30.0 收紧 HTTP 重定向、默认 30 分钟空闲会话过期并校验 OAuth issuer，可能打断现有服务端与客户端行为。升级前请先核对变更说明，按需调整 endpoint 与 FastMCP 参数。
Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.
1.x 系列的维护版本。2.x 是当前版本；1.x 文档位于 https://py.sdk.modelcontextprotocol.io/v1/。
A few defaults changed in this release. If you run a server or client on 1.x, skim these first:
此版本中一些默认值发生了变化。如果你在 1.x 上运行服务器或客户端，请先浏览以下内容：
Behaviour changes
行为变更
HTTP client redirects are only followed within the endpoint's origin (#3448)
HTTP 客户端重定向仅在端点来源内被跟随 (#3448)
- streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
- A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
- The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
- OAuthClientProvider applies the same rule to its own requests.
- streamable_http_client 和 sse_client 仅在重定向保持相同协议、主机和端口（或同一主机上从 http 升级到 https）时才跟随重定向。
- 任何其他位置的重定向现在都会导致请求失败并抛出 httpx.HTTPStatusError。如果该其他 URL 是你想要的服务器，请将其用作端点 URL。
- 你传入的 httpx.AsyncClient 上的 follow_redirects 设置不再用于 MCP 请求，因此你不再需要它来处理尾部斜杠重定向。
- OAuthClientProvider 对其自身请求应用相同规则。
Idle Streamable HTTP sessions now expire (#3426)
空闲的 Streamable HTTP 会话现在会过期 (#3426)
- A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
- Clients that keep the GET stream open (the SDK's client does) are not affected.
- A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
- To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).
- 无任何进行中操作的有状态会话在 30 分钟后关闭。客户端的下一个请求将收到 404，并且必须重新初始化。
- 保持 GET 流打开的客户端（SDK 的客户端会这样做）不受影响。
- 服务器同时最多持有 10,000 个会话；超过此限制，新会话将收到 503。
- 要关闭任一功能：FastMCP(..., session_idle_timeout=None, max_sessions=None)。
The OAuth client checks the authorization server's issuer (#3431)
OAuth 客户端检查授权服务器的 issuer (#3431)
- Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
- Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
- If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.
- 现在，如果授权服务器元数据的 issuer 与获取该元数据的服务器不匹配，则会被拒绝并抛出 OAuthFlowError: Authorization server metadata issuer mismatch。
- 客户端注册现在按 issuer 记忆；如果服务器稍后指向不同的授权服务器，客户端将重新注册。
- 如果由于 5xx/429 错误而无法获取受保护资源元数据，流程现在会停止，而不是回退到旧端点。
Two new DeprecationWarnings (#3431, #3451)
两个新的 DeprecationWarnings (#3431, #3451)
- ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
- AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
- Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.
- ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider 未使用 issuer=。请传递你的授权服务器的 issuer URL。
- AuthSettings 设置了 resource_server_url 但未设置 validate_token_resource。请将其设置为 True 或 False。
- 两者在 1.x 中仍像以前一样工作；这主要影响你将警告视为错误的测试。
New
新增
- AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
- issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
- session_idle_timeout= and max_sessions= on FastMCP (#3426).
- AuthSettings.validate_token_resource：仅接受你的 TokenVerifier 报告为为此服务器颁发的令牌 (#3451)。
- ClientCredentialsOAuthProvider 和 PrivateKeyJWTOAuthProvider 上的 issuer= (#3431)。
- 在 FastMCP 上设置 session_idle_timeout= 和 max_sessions= (#3426)。
What's Changed
更新内容
- [v1.x] Resolve tool output-schema references within the schema document only by @maxisbey in #3396
- [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @maxisbey in #3426
- [v1.x] Validate the authorization server metadata issuer on every discovery path by @maxisbey in #3431
- [v1.x] Follow redirects only within the MCP endpoint's origin by @maxisbey in #3448
- [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @maxisbey in #3451
- [v1.x] 仅解析模式文档中的工具输出模式引用，作者 @maxisbey，见 #3396
- [v1.x] 默认使空闲的流式 HTTP 会话过期，并限制并发会话数，作者 @maxisbey，见 #3426
- [v1.x] 在每次发现路径上验证授权服务器元数据签发者，作者 @maxisbey，见 #3431
- [v1.x] 仅跟随 MCP 端点同源的重定向，作者 @maxisbey，见 #3448
- [v1.x] 添加 AuthSettings.validate_token_resource 以检查不记名令牌的资源，作者 @maxisbey，见 #3451
Full Changelog: v1.29.1...v1.30.0
完整变更日志：v1.29.1...v1.30.0
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力