Pull requests

• Bump the python-security group across 1 directory with 2 updates

  #3645·dependabot[bot] opened Oct 5, 2026Bot·

  ·

• Split the client SDK into a standalone mcp-client package

  #3583·Kludex opened Sep 25, 2026Member·

  ·
  60

• Close client SSE iterators explicitly when supported

  #3543·Kludex opened Sep 18, 2026Member·

  ·
  6

• Bound direct subscription cleanup without delaying remote exits

  #3542·Kludex opened Sep 18, 2026Member·

  ·
  6

• Buffer replay before network delivery and preserve the live handoff

  #3541·Kludex opened Sep 18, 2026Member·

  ·
  11

• Preserve request-stream ownership during server cleanup

  #3540·Kludex opened Sep 18, 2026Member·

  ·
  6

• Add an AMQP 0.9.1 transport example

  #3521·Kludex opened Sep 17, 2026Member·

  ·
  34

• Add an MQTT 5 transport example

  #3520·Kludex opened Sep 17, 2026Member·

  ·
  16

• Add a native gRPC transport example

  #3519·Kludex opened Sep 17, 2026Member·

  ·
  28

• Add extensible client and server transport APIs

  #3517·Kludex opened Sep 17, 2026Member·

  ·
  39

• feat(client): support HTTP auth in ClientSessionGroup

  #3516·musi22 opened Sep 17, 2026·

  ·
  1

  5

• Run the test suite on both AnyIO backends

  #3511·Kludex opened Sep 16, 2026Member·

  ·
  24

• Add Skills extension

  #3485·vijaydeepsinha opened Sep 9, 2026·9 tasks done·

  ·
  1

  29

• [v1.x] Preserve the exact OAuth resource indicator (backport #2925)

  #3462·pcarleton opened Sep 6, 2026Member·6 tasks done·

  ·

• Resolve dot-segments when deriving and matching OAuth resource URLs

  #3343·maxisbey opened Aug 20, 2026Contributor·6 of 9 tasks·

  ·
  1

  4

• Let a token verifier gate the server without AuthSettings

  #3292·maxisbey opened Aug 11, 2026Contributor·8 of 9 tasks·

  ·
  1

  7

• fix(client): surface HTTP errors on resumption GET and SSE message POST

  #3278·claude[bot] opened Aug 11, 2026Bot·

  ·
  1

  45

• fix(auth): include RFC 6750 scope attribute in WWW-Authenticate challenges

  #3277·claude[bot] opened Aug 11, 2026Bot·

  ·
  1

  7

• fix(client/auth): discard stored client registrations whose secret has expired

  #3264·claude[bot] opened Aug 7, 2026Bot·

  ·
  1

  28

• fix(client/auth): discover AS metadata before cold-start token refresh, with issuer-binding check

  #3263·claude[bot] opened Aug 7, 2026Bot·

  ·
  2

  14

• Cut import and startup cost with deferred model builds and lazy imports

  #3242·maxisbey opened Aug 3, 2026Contributor·7 of 9 tasks·

  ·
  1

• Delegate authorize-time scope policy to the provider

  #3222·maxisbey opened Jul 30, 2026Contributor·8 of 9 tasks·

  ·
  2

  2

• [experimental - do not merge] Cut startup cost: lazy exports, pay-for-what-you-use imports, deferred model builds

  #3220·maxisbey opened Jul 30, 2026Contributor·7 of 9 tasks·

  ·
  1

• Deprecate the legacy HTTP+SSE transport

  #3204·maxisbey opened Jul 28, 2026Contributor·6 of 9 tasks·

  ·
  10

• Rebuild the streamable HTTP server transport around per-request dispatch

  #3192·maxisbey opened Jul 27, 2026Contributor·8 of 9 tasks·

  ·
  22