What's Changed

• fix: remove unused requests dependency from simple-chatbot example by @maxisbey in #1959
• ci: backport conformance tests from main to v1.x by @felixweinberger in #2068
• fix: add RFC 8707 resource validation to OAuth client by @felixweinberger in #2069
• feat: add idle timeout for StreamableHTTP sessions by @felixweinberger in #1994
• [v1.x] fix: prevent command injection in example URL opening by @maxisbey in #2085
• Add VERSIONING.md, ROADMAP.md, and DEPENDENCY_POLICY.md by @felixweinberger in #2084
• docs: restructure README into docs/ pages by @felixweinberger in #2091
• docs: comprehensive feature documentation for SEP-1730 Tier 1 by @felixweinberger in #2090
• docs: fix stub pages and improve docs structure by @felixweinberger in #2101
• docs: fix GitHub links to point to v1.x branch by @felixweinberger in #2102
• docs: add snippet verification for docs/ pages by @felixweinberger in #2115
• docs: add server-side tool error handling documentation by @felixweinberger in #2129
• Backport: Add missing TasksCallCapability to v1.x by @BabyChrist666 in #2137
• [v1.x] fix: handle non-UTF-8 bytes in stdio server stdin by @maxisbey in #2303
• [v1.x] fix: handle ClosedResourceError when transport closes mid-request by @owendevereaux in #2334

New Contributors

• @owendevereaux made their first contribution in #2334

Full Changelog: v1.26.0...v1.27.0

Branching Update

Starting with this release, the repository has adopted a new branching strategy for v2 development:

• main — v2 development (breaking changes)
• v1.x — v1 maintenance (security and critical bug fixes only, with very rare feature additions ported from main)

Users who need to stay on v1.x should pin to mcp>=1.25,<2.

The current plan is to work through v2 and have it released some time in Q1. This also relies on the next upcoming spec release which will heavily change how the transport layer works, which in turn will guide a lot of how we architect v2.

What's Changed

• Fix for Url Elicitation issue 1768 by @gopitk in #1780
• ci: add v1.x branch to main-checks workflow by @maxisbey in #1802

New Contributors

• @gopitk made their first contribution in #1780

Full Changelog: v1.24.0...v1.25.0

What's Changed

• feat: client-side support for SEP-1577 sampling with tools by @jlowin in #1722
• Fix JSON-RPC error response ID matching by @crondinini-ant in #1720
• Add streamable_http_client which accepts httpx.AsyncClient instead of httpx_client_factory by @Kludex in #1177
• fix: use correct python command name in test_stdio.py by @WOnder93 in #1782

New Contributors

• @WOnder93 made their first contribution in #1782

Full Changelog: v1.23.3...v1.24.0

Hotfix Release

This is a hotfix release to address a critical bug in OAuth scope handling that caused failures on 401 responses.

Related:

• #1630
• #1632

What's Changed

• fix get_client_metadata_scopes on 401 by @abliznyuk in #1631

New Contributors

• @abliznyuk made their first contribution in #1631

Full Changelog: v1.21.1...v1.21.2