chore(deps): update dependency mcp to v1.28.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mcp	1.23.1 → 1.28.1

---

Release Notes

modelcontextprotocol/python-sdk (mcp)

v1.28.1

Compare Source

What's Changed

• [v1.x] Buffer per-request StreamableHTTP streams; store priming event before dispatch by @​maxisbey in #​2948
• [v1.x] Set Development Status classifier to Production/Stable by @​maxisbey in #​2976
• [v1.x] Support TransportSecuritySettings in the WebSocket server transport by @​maxisbey in #​2992

Full Changelog: modelcontextprotocol/python-sdk@v1.28.0...v1.28.1

v1.28.0

Compare Source

Deprecations

Two API surfaces now emit DeprecationWarning ahead of their removal in v2. Nothing is removed in 1.x, and the warnings fire only when the deprecated API is called - importing the modules stays silent.

• WebSocket transport - mcp.client.websocket.websocket_client and mcp.server.websocket.websocket_server. WebSocket was never part of the MCP specification; use the streamable HTTP transport instead. The TypeScript SDK has likewise removed its WebSocket client for v2 (modelcontextprotocol/typescript-sdk#1783).
• Experimental tasks API - ClientSession.experimental, Server.experimental, ServerSession.experimental, and the experimental_task_handlers= kwarg on ClientSession. Tasks (SEP-1686) were removed from the MCP specification and are expected to return as a separate MCP extension.

If your test suite runs with filterwarnings = ["error"] and exercises these paths, add a scoped ignore such as ignore:The experimental tasks API is deprecated:DeprecationWarning or ignore:The WebSocket .* transport is deprecated:DeprecationWarning.

See #​2828 for full details.

What's Changed

• [v1.x] Support Python 3.14 by @​maxisbey in #​2769
• fix: omit null optional fields from task result payloads by @​liuzemei in #​2809
• [v1.x] Deprecate the WebSocket transport and the experimental tasks entry points by @​maxisbey in #​2828
• [v1.x] Add a v2 status banner to the README by @​maxisbey in #​2835
• [v1.x] Deflake the child process cleanup tests by @​maxisbey in #​2839

New Contributors

• @​liuzemei made their first contribution in #​2809

Full Changelog: modelcontextprotocol/python-sdk@v1.27.2...v1.28.0

v1.27.2

Compare Source

What's Changed

• [v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages artifact by @​maxisbey in #​2635
• [v1.x] Add subject and claims to AccessToken by @​maxisbey in #​2690
• [v1.x] Bind transport sessions to the authenticated principal by @​maxisbey in #​2719
• [v1.x] Scope experimental tasks to the session that created them by @​maxisbey in #​2720

Full Changelog: modelcontextprotocol/python-sdk@v1.27.1...v1.27.2

v1.27.1

Compare Source

What's Changed

• [v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2.13 compat) by @​maxisbey in #​2435
• [v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by @​felixweinberger in #​2405
• [v1.x] build: restrict httpx to <1.0.0 by @​maxisbey in #​2559
• [v1.x] refactor: import SSEError from httpx_sse public API by @​maxisbey in #​2561

Full Changelog: modelcontextprotocol/python-sdk@v1.27.0...v1.27.1

v1.27.0

Compare Source

What's Changed

• fix: remove unused requests dependency from simple-chatbot example by @​maxisbey in #​1959
• ci: backport conformance tests from main to v1.x by @​felixweinberger in #​2068
• fix: add RFC 8707 resource validation to OAuth client by @​felixweinberger in #​2069
• feat: add idle timeout for StreamableHTTP sessions by @​felixweinberger in #​1994
• [v1.x] fix: prevent command injection in example URL opening by @​maxisbey in #​2085
• Add VERSIONING.md, ROADMAP.md, and DEPENDENCY_POLICY.md by @​felixweinberger in #​2084
• docs: restructure README into docs/ pages by @​felixweinberger in #​2091
• docs: comprehensive feature documentation for SEP-1730 Tier 1 by @​felixweinberger in #​2090
• docs: fix stub pages and improve docs structure by @​felixweinberger in #​2101
• docs: fix GitHub links to point to v1.x branch by @​felixweinberger in #​2102
• docs: add snippet verification for docs/ pages by @​felixweinberger in #​2115
• docs: add server-side tool error handling documentation by @​felixweinberger in #​2129
• Backport: Add missing TasksCallCapability to v1.x by @​BabyChrist666 in #​2137
• [v1.x] fix: handle non-UTF-8 bytes in stdio server stdin by @​maxisbey in #​2303
• [v1.x] fix: handle ClosedResourceError when transport closes mid-request by @​owendevereaux in #​2334

New Contributors

• @​owendevereaux made their first contribution in #​2334

Full Changelog: modelcontextprotocol/python-sdk@v1.26.0...v1.27.0

v1.26.0

Compare Source

What's Changed

• ci: add all-green job to pull-request-checks workflow by @​maxisbey in #​1929
• Backport: Support for Resource and ResourceTemplate metadata by @​maxisbey in #​1928
• [v1.x] fix: return HTTP 404 for unknown session IDs instead of 400 by @​LucaButBoring in #​1945

Full Changelog: modelcontextprotocol/python-sdk@v1.25.0...v1.26.0

v1.25.0

Compare Source

Branching Update

Starting with this release, the repository has adopted a new branching strategy for v2 development:

• main — v2 development (breaking changes)
• v1.x — v1 maintenance (security and critical bug fixes only, with very rare feature additions ported from main)

Users who need to stay on v1.x should pin to mcp>=1.25,<2.

The current plan is to work through v2 and have it released some time in Q1. This also relies on the next upcoming spec release which will heavily change how the transport layer works, which in turn will guide a lot of how we architect v2.

---

What's Changed

• Fix for Url Elicitation issue 1768 by @​gopitk in #​1780
• ci: add v1.x branch to main-checks workflow by @​maxisbey in #​1802

New Contributors

• @​gopitk made their first contribution in #​1780

Full Changelog: modelcontextprotocol/python-sdk@v1.24.0...v1.25.0

v1.24.0

Compare Source

What's Changed

• feat: client-side support for SEP-1577 sampling with tools by @​jlowin in #​1722
• Fix JSON-RPC error response ID matching by @​crondinini-ant in #​1720
• Add streamable_http_client which accepts httpx.AsyncClient instead of httpx_client_factory by @​Kludex in #​1177
• fix: use correct python command name in test_stdio.py by @​WOnder93 in #​1782

New Contributors

• @​WOnder93 made their first contribution in #​1782

Full Changelog: modelcontextprotocol/python-sdk@v1.23.3...v1.24.0

v1.23.3

Compare Source

What's Changed

• refactor(auth): remove unused _register_client method by @​maxisbey in #​1748
• feat: add workflow to comment on PRs when released by @​felixweinberger in #​1750
• fix: allow MIME type parameters in resource validation (RFC 2045) by @​antonpk1 in #​1755
• Skip empty SSE data to avoid parsing errors by @​injusticescorpio in #​1753
• chore: remove release-comment workflow by @​maxisbey in #​1758

New Contributors

• @​antonpk1 made their first contribution in #​1755
• @​injusticescorpio made their first contribution in #​1753

Full Changelog: modelcontextprotocol/python-sdk@v1.23.2...v1.23.3

v1.23.2

Compare Source

What's Changed

• fix: add lifespan context manager to StreamableHTTP mounting examples by @​TheMailmans in #​1669
• fix: handle ClosedResourceError in StreamableHTTP message router by @​Edison-A-N in #​1384
• fix: skip priming events and close_sse_stream for old protocol versions by @​felixweinberger in #​1719

New Contributors

• @​TheMailmans made their first contribution in #​1669
• @​Edison-A-N made their first contribution in #​1384

Full Changelog: modelcontextprotocol/python-sdk@v1.23.1...v1.23.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.