MCP Python SDK 2.0.0

The two reference SDKs made opposite default choices at version 2.0.0, and this is the half that defaults to the current revision. It's also the only row here with a yes in the issuer-validation column.

Client type: Reference SDK, 2.x line
Protocol revision: 2026-07-28

Support

stdio: Yes
Streamable HTTP: Yes
Legacy SSE: Yes
Revision: 2026-07-28
OAuth flow: Yes
Registration: Yes
Metadata doc: Yes
Client ID: Yes
resource: Yes
iss: Yes
Headers: Yes

Protocol revision: 2026-07-28. Its LATEST_PROTOCOL_VERSION is the current revision, and Client defaults to a mode that lands there.

Caveats and sources

Each one names the column it qualifies and cites the page it comes from, which is often not the page in the row's primary source.

Validates iss (RFC 9207): Source-verified present: the current client auth module carries an explicit RFC 9207 issuer check, sends resource on the authorization request, the token request, and the refresh, and validates protected resource metadata against the server URL. None of that is in 1.29.0. Source
Protocol revision: Client defaults to mode='auto', which probes server/discover on enter and falls back to the initialize handshake — so against a version 2 server it lands on 2026-07-28 on every transport, where server-initiated requests are refused. A version 1 test that drove elicitation, sampling, or a roots listing now fails with NoBackChannelError. Frameworks that use the low-level session path instead don't reach the current revision. Source
Tasks extension: The 2026-07-28 revision reintroduces tasks as an official extension, and this SDK doesn't implement it. Source

Primary source

This row was last verified July 31, 2026 against the 2026-07-28 revision.