[dependabot]

Updates the requirements on mcp to permit the latest version.

Release notes

Sourced from mcp's releases.

v2.3.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

Mostly fixes, plus three new options. A few things behave differently, so skim these first:

Behaviour changes

httpx2>=2.10.0 is now required (#3600)

• It was >=2.5.0. The new max_sse_event_size option needs it.
• Nothing to do unless you pin httpx2 below 2.10.

A tool with an invalid x-mcp-header annotation fails at registration (#3620)

• @mcp.tool(), add_tool and Tool.from_function raise InvalidSignature, naming the tool and the problem.
• Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.
• Refused: anything other than a plain str, int or bool parameter (so also str | None, float, lists and enums), a header name that isn't a valid token, and two names that differ only by case.
• For an optional header parameter, give the schema directly: Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None.

Empty _meta and params are no longer sent (#3628)

• On 2025-11-25 and earlier connections, 2.x sent "_meta": {} on every request. Some servers reject that. It is now left out, as in v1.
• ping and list requests without a cursor go out with no params member.
• On the receiving side ctx.meta is None rather than {}, and middleware sees ctx.params as None for a request without params.
• 2026-07-28 connections are unchanged.

initialize leaves out experimental when none is configured (#3614)

• It used to send "experimental": {}. server/discover already left it out.
• Client code reading capabilities.experimental on a legacy connection should handle None.

Mcp-Param-* validation looks the tool up by name (#3630)

• MCPServer no longer runs tools/list for every tools/call, so middleware no longer sees that extra request.
• The registered schema is what gets checked. Middleware that filters or rewrites tools/list no longer affects it.

An interactive OAuth login no longer counts against request timeouts (#3635)

• The timeout pauses while OAuthClientProvider waits on redirect_handler and callback_handler.
• This fixes Client(mode="auto") settling on 2025-11-25 when the login took longer than 10 seconds.
• A request timeout no longer ends a login nobody finishes. Put a limit inside callback_handler if you need one.

New

• max_sse_event_size= on streamable_http_client and StreamableHttpParameters. The default stays 1 MiB per SSE event; raise it, or pass None, for larger tool results (#3600).
• MCPServer(subscriptions=False) stops serving subscriptions/listen and advertises listChanged and subscribe as false (#3626).
• Server(get_tool_input_schema=...) lets a low-level server supply a tool's schema for header validation without running its tools/list handler (#3630).
• Client.call_tool re-lists the tools and retries once after a HeaderMismatch (-32020) rejection (#3627).

Fixes

• ctx: Context[AppState] works on prompts and resource templates, not only on tools (#3624).
• An explicit "structuredContent": null is checked against the output schema instead of being treated as missing (#3621).
• A progress_callback that raises no longer fails the call on an in-process Client(server) (#3623).
• Client OpenTelemetry spans record JSON-RPC error responses. With mode="auto", connecting to a server without server/discover now shows one ERROR span for the probe (#3629).
• stdio_client resolves the executable off the event loop on Windows (#3510).

... (truncated)

Commits

• 2118f14 docs: refresh translations for recent English changes (#3636)
• ed9b2d6 Stop counting an interactive OAuth login against request timeouts (#3635)
• d5cebd1 Keep inline-snapshot disabled when pytest runs in a terminal (#3634)
• c15566c Link What's new to the Header parameters page (#3632)
• 4d29994 Let a newer Deploy Docs run cancel the one in progress (#3633)
• 0acea60 Bump urllib3 from 2.7.0 to 2.8.0 (#3607)
• c54075c Look the tool schema up by name for Mcp-Param-* validation instead of running...
• 9afccae Retry a tool call once after a HeaderMismatch rejection (#3627)
• cafa33b Record JSON-RPC error responses on the client OpenTelemetry span (#3629)
• 0b2fd3e Omit an empty _meta and empty params from outbound requests (#3628)
• Additional commits viewable in compare view

[tom-sapletta-com]

@dependabot rebase

[tom-sapletta-com]

@dependabot rebase

[tom-sapletta-com]

@dependabot rebase

[ifuri-validator-agent]

Validator approval after policy checks for exact head a1ae6bdd8892ad97d3c2493f29dfa6699549812c.

Ticket: ticket-021
Correlation ID: mcp-021-dep33
Model: gemini/gemini-3.8-flash
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). Updates mcp requirement from >=2.2.0 to >=2.3.0 across llm-agent and mcp-skills. All required checks passed with no breaking issues detected.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Semantic review prerequisite: not_required; policy 676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7.

Actual PR impact radar

Exact range: 2a8429ede77fb2f26e2ab4d29550a4bf8a012a33...a1ae6bdd8892ad97d3c2493f29dfa6699549812c
Change digest: 35c690132370a370837f770a63cb60045526346d9a4d6fdea4bfe0453756cb47
Score: 84/100 (L), estimated 240 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":2,"base_sha":"2a8429ede77fb2f26e2ab4d29550a4bf8a012a33","binary_files":0,"categories":{"code":2},"change_digest":"35c690132370a370837f770a63cb60045526346d9a4d6fdea4bfe0453756cb47","comparison":"2a8429ede77fb2f26e2ab4d29550a4bf8a012a33...a1ae6bdd8892ad97d3c2493f29dfa6699549812c","deletions":2,"file_count":2,"files":["llm-agent/requirements.txt","mcp-skills/requirements.txt"],"head_sha":"a1ae6bdd8892ad97d3c2493f29dfa6699549812c","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":5,"scope":5,"uncertainty":3,"validation":3},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":240,"within_budget":false},"impact":{"components":["github.com","llm-agent","mcp-skills","redirect.github.com","server","subscriptions","tools"],"files":["github.com/modelcontextprotocol/python-sdk","github.com/modelcontextprotocol/python-sdk/commit/0acea605135759a2228a33eaa7d792fea2c2282b","github.com/modelcontextprotocol/python-sdk/commit/0b2fd3ea60efb16b349e8c887cf91bf2f9f773fc","github.com/modelcontextprotocol/python-sdk/commit/2118f14f8a19bc158d8a1cf90af58d85d187f849","github.com/modelcontextprotocol/python-sdk/commit/4d29994023576e4b04e06c9ff2f32757abc50463","github.com/modelcontextprotocol/python-sdk/commit/9afccae3d0bff4062add01b7fb746634b9aad2a7","github.com/modelcontextprotocol/python-sdk/commit/c15566c9dd4828b8082fb7693060e3a0fd67e657","github.com/modelcontextprotocol/python-sdk/commit/c54075ccb8793e9b0d37f0c9e2c58dfd0256c23d","github.com/modelcontextprotocol/python-sdk/commit/cafa33b3530b0af2e4a8467d11f92bc1cb00368e","github.com/modelcontextprotocol/python-sdk/commit/d5cebd13defe97bf5bacb93496f132d4173cda23","github.com/modelcontextprotocol/python-sdk/commit/ed9b2d61823b3800de4c48abb23b951ad3a50834","github.com/modelcontextprotocol/python-sdk/compare/v2.2.0...v2.3.0","github.com/modelcontextprotocol/python-sdk/releases","llm-agent/requirements.txt","mcp-skills/requirements.txt","redirect.github.com/modelcontextprotocol/python-sdk/issues/3510","redirect.github.com/modelcontextprotocol/python-sdk/issues/3600","redirect.github.com/modelcontextprotocol/python-sdk/issues/3607","redirect.github.com/modelcontextprotocol/python-sdk/issues/3614","redirect.github.com/modelcontextprotocol/python-sdk/issues/3620","redirect.github.com/modelcontextprotocol/python-sdk/issues/3621","redirect.github.com/modelcontextprotocol/python-sdk/issues/3623","redirect.github.com/modelcontextprotocol/python-sdk/issues/3624","redirect.github.com/modelcontextprotocol/python-sdk/issues/3626","redirect.github.com/modelcontextprotocol/python-sdk/issues/3627","redirect.github.com/modelcontextprotocol/python-sdk/issues/3628","redirect.github.com/modelcontextprotocol/python-sdk/issues/3629","redirect.github.com/modelcontextprotocol/python-sdk/issues/3630","redirect.github.com/modelcontextprotocol/python-sdk/issues/3632","redirect.github.com/modelcontextprotocol/python-sdk/issues/3633","redirect.github.com/modelcontextprotocol/python-sdk/issues/3634","redirect.github.com/modelcontextprotocol/python-sdk/issues/3635","redirect.github.com/modelcontextprotocol/python-sdk/issues/3636","server/discover","subscriptions/listen","tools/call","tools/list"],"public_interfaces":["github.com/modelcontextprotocol/python-sdk/commit/0acea605135759a2228a33eaa7d792fea2c2282b","github.com/modelcontextprotocol/python-sdk/commit/0b2fd3ea60efb16b349e8c887cf91bf2f9f773fc","github.com/modelcontextprotocol/python-sdk/commit/2118f14f8a19bc158d8a1cf90af58d85d187f849","github.com/modelcontextprotocol/python-sdk/commit/4d29994023576e4b04e06c9ff2f32757abc50463","github.com/modelcontextprotocol/python-sdk/commit/9afccae3d0bff4062add01b7fb746634b9aad2a7","github.com/modelcontextprotocol/python-sdk/commit/c15566c9dd4828b8082fb7693060e3a0fd67e657","github.com/modelcontextprotocol/python-sdk/commit/c54075ccb8793e9b0d37f0c9e2c58dfd0256c23d","github.com/modelcontextprotocol/python-sdk/commit/cafa33b3530b0af2e4a8467d11f92bc1cb00368e","github.com/modelcontextprotocol/python-sdk/commit/d5cebd13defe97bf5bacb93496f132d4173cda23","github.com/modelcontextprotocol/python-sdk/commit/ed9b2d61823b3800de4c48abb23b951ad3a50834","github.com/modelcontextprotocol/python-sdk/compare/v2.2.0...v2.3.0","github.com/modelcontextprotocol/python-sdk/releases","redirect.github.com/modelcontextprotocol/python-sdk/issues/3510","redirect.github.com/modelcontextprotocol/python-sdk/issues/3600","redirect.github.com/modelcontextprotocol/python-sdk/issues/3607","redirect.github.com/modelcontextprotocol/python-sdk/issues/3614","redirect.github.com/modelcontextprotocol/python-sdk/issues/3620","redirect.github.com/modelcontextprotocol/python-sdk/issues/3621","redirect.github.com/modelcontextprotocol/python-sdk/issues/3623","redirect.github.com/modelcontextprotocol/python-sdk/issues/3624","redirect.github.com/modelcontextprotocol/python-sdk/issues/3626","redirect.github.com/modelcontextprotocol/python-sdk/issues/3627","redirect.github.com/modelcontextprotocol/python-sdk/issues/3628","redirect.github.com/modelcontextprotocol/python-sdk/issues/3629","redirect.github.com/modelcontextprotocol/python-sdk/issues/3630","redirect.github.com/modelcontextprotocol/python-sdk/issues/3632","redirect.github.com/modelcontextprotocol/python-sdk/issues/3633","redirect.github.com/modelcontextprotocol/python-sdk/issues/3634","redirect.github.com/modelcontextprotocol/python-sdk/issues/3635","redirect.github.com/modelcontextprotocol/python-sdk/issues/3636"],"runtime_dependencies":1},"schema":"subactor.ticket-radar/v1","score":84,"split":{"parts":[{"estimated_minutes":20,"name":"Define contract and acceptance boundary","scope":["github.com/modelcontextprotocol/python-sdk/commit/0acea605135759a2228a33eaa7d792fea2c2282b","github.com/modelcontextprotocol/python-sdk/commit/0b2fd3ea60efb16b349e8c887cf91bf2f9f773fc","github.com/modelcontextprotocol/python-sdk/commit/2118f14f8a19bc158d8a1cf90af58d85d187f849","github.com/modelcontextprotocol/python-sdk/commit/4d29994023576e4b04e06c9ff2f32757abc50463","github.com/modelcontextprotocol/python-sdk/commit/9afccae3d0bff4062add01b7fb746634b9aad2a7","github.com/modelcontextprotocol/python-sdk/commit/c15566c9dd4828b8082fb7693060e3a0fd67e657","github.com/modelcontextprotocol/python-sdk/commit/c54075ccb8793e9b0d37f0c9e2c58dfd0256c23d","github.com/modelcontextprotocol/python-sdk/commit/cafa33b3530b0af2e4a8467d11f92bc1cb00368e","github.com/modelcontextprotocol/python-sdk/commit/d5cebd13defe97bf5bacb93496f132d4173cda23","github.com/modelcontextprotocol/python-sdk/commit/ed9b2d61823b3800de4c48abb23b951ad3a50834","github.com/modelcontextprotocol/python-sdk/compare/v2.2.0...v2.3.0","github.com/modelcontextprotocol/python-sdk/releases","redirect.github.com/modelcontextprotocol/python-sdk/issues/3510","redirect.github.com/modelcontextprotocol/python-sdk/issues/3600","redirect.github.com/modelcontextprotocol/python-sdk/issues/3607","redirect.github.com/modelcontextprotocol/python-sdk/issues/3614","redirect.github.com/modelcontextprotocol/python-sdk/issues/3620","redirect.github.com/modelcontextprotocol/python-sdk/issues/3621","redirect.github.com/modelcontextprotocol/python-sdk/issues/3623","redirect.github.com/modelcontextprotocol/python-sdk/issues/3624","redirect.github.com/modelcontextprotocol/python-sdk/issues/3626","redirect.github.com/modelcontextprotocol/python-sdk/issues/3627","redirect.github.com/modelcontextprotocol/python-sdk/issues/3628","redirect.github.com/modelcontextprotocol/python-sdk/issues/3629","redirect.github.com/modelcontextprotocol/python-sdk/issues/3630","redirect.github.com/modelcontextprotocol/python-sdk/issues/3632","redirect.github.com/modelcontextprotocol/python-sdk/issues/3633","redirect.github.com/modelcontextprotocol/python-sdk/issues/3634","redirect.github.com/modelcontextprotocol/python-sdk/issues/3635","redirect.github.com/modelcontextprotocol/python-sdk/issues/3636"]},{"estimated_minutes":30,"name":"Implement github.com","scope":["github.com"]},{"estimated_minutes":30,"name":"Implement llm-agent","scope":["llm-agent"]},{"estimated_minutes":30,"name":"Implement mcp-skills","scope":["mcp-skills"]},{"estimated_minutes":30,"name":"Implement redirect.github.com","scope":["redirect.github.com"]},{"estimated_minutes":30,"name":"Implement server","scope":["server"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-021"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-021: chore(deps): update mcp requirement from &gt;=2.2.0 to &gt;=2.3.0</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,21 105,51 79,85 49,85 23,51" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 240m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-021-5371
TICKET ticket-021
HEAD_SHA a1ae6bdd8892ad97d3c2493f29dfa6699549812c
CORRELATION_ID mcp-021-dep33
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "dependabot[bot]"
INPUT observed_checks = ["verify=PASS","governance / remote lifecycle=PASS","governance / enforce=PASS"]
INPUT required_checks = ["governance / enforce","governance / remote lifecycle","verify"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT semantic_review_assessment = {"schema":"subactor.validator/semantic-review-assessment/v1","subject":{"repository":"semcod/mcp","pull_request":33,"head_sha":"a1ae6bdd8892ad97d3c2493f29dfa6699549812c","base_sha":"2a8429ede77fb2f26e2ab4d29550a4bf8a012a33","diff_sha256":"9dfef771586a0971877dc119452323660a413ea51748c93bbdf7931ef114718a"},"policy":{"policy_schema":"subactor.validator/semantic-review-policy/v1","policy_version":1,"policy_sha256":"676cb4516bbfed2a000e40b9b1b6e4a430ecc761ec546aeb53d721a1905cfdd7","required":false,"critical_paths":[],"observed_paths":["llm-agent/requirements.txt","mcp-skills/requirements.txt"]},"grounding":"full-diff-not-per-finding-proof","execution_authority":false,"status":"not_required","reason":null,"review_sha256":null,"unresolved":[]}
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"2a8429ede77fb2f26e2ab4d29550a4bf8a012a33","head_sha":"a1ae6bdd8892ad97d3c2493f29dfa6699549812c","change_digest":"35c690132370a370837f770a63cb60045526346d9a4d6fdea4bfe0453756cb47","score":84,"complexity":"L","estimated_minutes":240,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "gemini/gemini-3.8-flash"
ASSERT VERDICT_AUTHORITY != "ADVISORY"