Issues

`TransportSecuritySettings.allowed_hosts=[]` (default) silently rejects external Host headers with HTTP 421

#2688

· ptrhrsch-arch opened

on May 26, 2026

`OAuthClientInformationFull.redirect_uris`: pydantic strict-type-equality breaks `AnyUrl(x) != AnyHttpUrl(x)` round-trip

#2687

· ptrhrsch-arch opened

on May 26, 2026

FastMCP/stdio: in-flight tool responses dropped on stdin EOF when input is bash-redirected from a file

#2678

· theone139344 opened

on May 25, 2026

ClientSession receive loop swallows callback exceptions, replying "Invalid request parameters" to the server instead of propagating to the call_tool awaiter

#2673

· danielgshea opened

on May 24, 2026

FastMCP.run(transport="stdio") produces noisy traceback on KeyboardInterrupt instead of clean exit

#2663

· MikeNjoroge opened

on May 22, 2026

Streamable HTTP server silently drops in-flight request when client reuses a JSON-RPC id

#2655

· dexteradeus opened

on May 21, 2026

mcp.server.fastmcp.FastMCP HTTP transport deadlocks after ~5 sequential client sessions on Windows (companion to PrefectHQ/fastmcp#4192)

#2653

· colinlabrooy opened

on May 21, 2026

Add `invalid_target` to `AuthorizationErrorCode` (RFC 8707)

#2641

· stephaneberle9 opened

on May 18, 2026

DCR registration accepts redirect_uris with non-HTTPS / non-loopback / fragmented schemes

#2629

· CrypticCortex opened

on May 18, 2026

Add option to skip output validation for mcp client

#2626

· germanbecker opened

on May 17, 2026

Streamable HTTP server accepts mismatched `MCP-Protocol-Version` header and body `protocolVersion` on `initialize`

#2618

· cclabadmin opened

on May 16, 2026

docs/examples: add a tool-response detection middleware sample?

#2617

· eeee2345 opened