python-sdk

Summary keep / balance validation strict split the missing-follow-up case into a clearer add a direct regression test for an assistant followed by user text instead of Related to #2960. This PR does not relax the balance rule; it only makes the diagnostic distinguish a missing from an ID mismatch when a is followed by a non-result message. Tests

Release line 2.x (), observed at b2025ab8 and on #3331. Bug description When an MCPServer tool's return type is self-referential, pydantic emits the output schema as with no root . That's fine on 2026-07-28 sessions, but the 2025-11-25 shape requires at the root, so serializing the result for a legacy-negotiated client fails validation and the client gets an error for the entire listing, not just that tool. On this affects recursive return types. #3331 hands returns to pydantic natively, so recursive s join them (previously the hand-built mirror model happened to inline the root). Steps to reproduce Server log on the legacy session: Expected behaviour succeeds on both protocol versions; the recursive tool's schema has an object root (e.g. inline the root , or wrap it as ). Separately, it seems worth deciding whether one tool's unrepresentable schema should fail the whole listing on a legacy session or just drop/degrade that tool. AI Disclaimer

Description Summary MCP tools and resources built with the Python SDK can, by default, access the full file system, network, and environment of the host process. This is powerful but risky, especially when: servers are installed from third parties, or LLM agents can call tools based on prompt-injected instructions. The SDK should clearly document this and provide hooks/patterns for limiting capabilities. Proposal 1. Document security considerations Add a “Security considerations” section explicitly calling out: file system access, network access, environment variables and credentials. 2. Provide capability hooks Offer configuration points or helper utilities to: restrict file access to specific directories (allowlist), restrict outbound network calls to certain hosts/domains, prevent access to environment variables by default. 3. Encourage process-level sandboxing Provide guidance on running MCP servers in: containers with minimal privileges, separate processes with limited OS capabilities. Why this matters Defense in depth: Even if application code is careful, configuration mistakes or third-party code can introduce risk. Prompt-injection mitigation: Restricting what tools can do reduces the impact of malicious prompts. Operational guidance:** Many users are new to MCP and benefit from clear security best practices. Acceptance criteria [ ] Documentation clearly describes the security implications of running MCP servers and tools. [ ] There are example patterns for restricting file and network access. [ ] Where feasible, the SDK exposes hooks or configuration points for capability control. References _No response_