MCP Python SDK 2.2.0 Tightens Redirect and OAuth Security and Limits Legacy HTTP Sessions

The official Model Context Protocol Python SDK 2.2.0 is not a new protocol revision, but it changes several security and resource-management defaults for remote MCP deployments. The `Client`, Streamable HTTP client, and SSE client now follow redirects only when the scheme, host, and port remain the same; the sole exception is an upgrade from HTTP to HTTPS on the same host. Redirects to another host or port terminate with an `MCPError` or `httpx2.HTTPStatusError`, and passing `httpx2.AsyncClient(follow_redirects=True)` cannot bypass the restriction. This prevents tool requests carrying authorization information from being redirected across trust boundaries, but deployments using vanity URLs, cross-domain reverse proxies, or legacy migration URLs may break immediately.

The OAuth path now also checks the authorization server’s `issuer` during the legacy discovery flow. If protected resource metadata cannot be retrieved because of a 429 or 5xx response, the SDK no longer silently falls back to the legacy flow. The new `AuthSettings.validate_token_resource` option can require validators to confirm that a bearer token was actually issued for the current resource server. Users that do not provide `issuer=` or explicitly enable token-resource validation currently receive only deprecation warnings, but version 3.0 is expected to tighten these defaults further.

For stateful Streamable HTTP servers using protocol version 2025-11-25 or earlier, sessions are closed after 30 minutes of inactivity; the next request receives a 404 response and must reinitialize. Requests exceeding the 10,000-session limit receive a 503 response. Official high-level clients that keep the GET stream open, stateless servers, and connections using the 2026-07-28 protocol are not subject to these limits. Teams should first test reconnection behavior, proxy topology, and OAuth error paths instead of simply disabling the limits. The same core fixes have also been backported to 1.30.0, allowing systems that have not yet migrated to 2.x to adopt the hardening in the meantime.