← Packages
python-mcp
Model Context Protocol SDK
- Current
- 2.0.0
- Candidate
- 2.3.0
- License
- MIT
RuntimeDeps
| Dependency | Observed source | Current requirement | Candidate requirement |
|---|---|---|---|
4.15.1 | |||
4.15.1 | |||
2.13.0 | |||
4.26.0 | |||
mcp-typesUnmapped | — | ||
1.44.0 | |||
2.12.5 | |||
2.14.0 | |||
0.0.32 | |||
pywin32Unmapped | — | ||
3.4.2 | |||
1.6.0 | |||
1.6.0 | |||
4.16.0 | |||
0.4.2 | |||
0.46.0 | |||
3.14.9 |
Optional RuntimeDeps
| Dependency | Observed source | Current requirement | Candidate requirement |
|---|---|---|---|
1.2.2 | |||
15.0.0 | |||
0.25.1 |
Dependency conditions
- Applies when (any)
- python_version < "3.14"
- Applies when (any)
- python_version >= "3.14"
- Applies when (any)
- sys_platform == "win32"
- Applies when (any)
- python_version < "3.14"
- Applies when (any)
- python_version >= "3.14"
- Applies when (any)
- sys_platform != "emscripten"
- Applies when (any)
- extra == "cli"
- Applies when (any)
- extra == "rich"
- Applies when (any)
- extra == "cli"
Advisory · 4
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverOSV
- Fixed events
- 1.30.0, 2.2.0OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.365%FIRST
- Returned advisory
- GHSA-w4fh-qvv9-3v23OSV
- Aliases
- GHSA-w4fh-qvv9-3v23OSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NOSV
- Summary
- Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesOSV
- Fixed events
- 1.30.0, 2.2.0OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.399%FIRST
- Returned advisory
- GHSA-5h93-6whr-6q8jOSV
- Aliases
- GHSA-5h93-6whr-6q8jOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NOSV
- Summary
- Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasOSV
- Fixed events
- 1.30.0, 2.2.0OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.337%FIRST
- Returned advisory
- GHSA-rwrf-2pqf-9j8jOSV
- Aliases
- GHSA-rwrf-2pqf-9j8jOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HOSV
- Summary
- MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionOSV
- Fixed events
- 1.30.0, 2.2.0OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.458%FIRST
- Returned advisory
- GHSA-84m7-p3x7-pcfvOSV
- Aliases
- GHSA-84m7-p3x7-pcfvOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOSV
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NOSV
Description
Python SDK for the Model Context Protocol (MCP), providing client and server components for MCP-based integrations.
Changelog
PR · 5
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Checked | ||
Checked | ||
Checked | ||
Checked | ||
Not configured No reliable monitor identity/configuration. | — | |
Checked Compared same-provider, same-project SPDX metadata for this version pair. | Last attempted | |
Checked | Last attempted | |
Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated. | Last attempted | |
Checked |