chore(deps): bump mcp from 1.29.1 to 1.30.0

[dependabot]

Bumps mcp from 1.29.1 to 1.30.0.

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

• streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
• A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
• The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
• OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

• A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
• Clients that keep the GET stream open (the SDK's client does) are not affected.
• A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
• To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

• Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
• Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
• If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

• ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
• AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
• Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

• AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
• issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
• session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

• [v1.x] Resolve tool output-schema references within the schema document only by @​maxisbey in modelcontextprotocol/python-sdk#3396
• [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @​maxisbey in modelcontextprotocol/python-sdk#3426
• [v1.x] Validate the authorization server metadata issuer on every discovery path by @​maxisbey in modelcontextprotocol/python-sdk#3431
• [v1.x] Follow redirects only within the MCP endpoint's origin by @​maxisbey in modelcontextprotocol/python-sdk#3448
• [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @​maxisbey in modelcontextprotocol/python-sdk#3451

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

Commits

• 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
• 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
• 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
• 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
• 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
mcp	[>= 2.dev0, < 3]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
attune-ai.dev	Ready	Preview	Sep 14, 2026 2:57am UTC
smartaimemory.com	Ready	Preview	Sep 14, 2026 2:57am UTC

[github-actions]

Auto-approved Dependabot dependency update