The Model Context Protocol (MCP) Python SDK v2.2.0 introduces significant security and resource management changes, primarily restricting HTTP client redirects to the endpoint's origin and enforcing expiration for idle Streamable HTTP sessions.
- HTTP clients now follow redirects only if they remain within the same scheme, host, and port, rejecting cross-origin redirections with an MCPError.
- Idle Streamable HTTP sessions are automatically closed after 30 minutes of inactivity, and servers cap concurrent sessions at 10,000 to prevent resource exhaustion.
- OAuth validation now checks the authorization server's issuer on all discovery paths, rejecting mismatches to prevent unauthorized access.
- New configuration options allow setting `session_idle_timeout` and `max_sessions`, while deprecation warnings alert users to required `issuer` parameters for future versions.
These updates improve security by preventing open redirect vulnerabilities and enhance stability by ensuring server resources are reclaimed from inactive connections.