Framework
Official Python implementation of the Model Context Protocol, used to build MCP-compliant servers and clients connecting AI agents to tools and data.
HISTOR started 12,915 npm and PyPI MCP servers in a sandbox, and 5,259 (41%) never answered, according to its own post. About 24% were broken or not stdio servers at all. Another 16% depended on keys, flags or runtimes a client config can supply.
Reality
MCP Python SDK maintainers rated a flaw that let a connected server choose where OAuth secrets were sent High, at 7.5. For its two machine-to-machine providers, upgrading changes nothing until the client names the issuer it expects.
Reality
MCP Python SDK releases 1.30.0 and 2.2.0 leave a credential-theft bug open for two OAuth providers unless their constructors pass an issuer. For unattended MCP clients the fix is a one-argument code change, and each team has to find and make it in its own source.
Reality
MCP Python SDK maintainers fixed a flaw rated up to 7.5 that lets malicious servers steal OAuth client secrets, in versions 1.30.0 and 2.2.0. Two of the affected providers stay exposed after upgrading until the calling code passes issuer=.
Reality
A consultancy's account of production MCP work on Django client apps calls the protocol a transport layer. Its sample server calls django.setup(), imports the Order model, and dispatches tool calls on a string.
Reality
Mike Moore's harness shows MCP's server-authored instructions field placing hostile prose in an agent's context, and a caching proxy passing it to a second caller. The harness measures where the text lands, with no model in the loop.
Reality
The Python SDK's v2.0.0 moved mcp.server.fastmcp wholesale on July 28 and shipped no shim, so any project that wrote mcp>=1.0 pulls 2.x on the next fresh install. A second default quietly changed the name clients see.
Reality
The MCP Python SDK renamed FastMCP in 2.x. Gemini's Interactions API stopped accepting the schema google-genai 1.x sends. Both arrived on a fresh install of unchanged code, and the mocked unit tests never noticed.
Reality
The official mcp package hit 2.0.0 on 28 July with renamed imports and a shorter context-manager yield, so wrappers that declared no upper bound now fail at runtime on a fresh install of code nobody touched.
Reality
An AWS EC2 rig with mcp unbounded in requirements.txt picked up mcp 2.2.0 and stopped importing. The server edit is two lines; the pip resolver and the test suite's camelCase attribute reads are where the work sits.
Reality
A duplicate method name raises ValueError while MCPServer is being constructed. That puts the failure inside whatever code assembles your extensions, and it is why a collision test cannot live in either extension's own package.
Reality
A standing measurement of 14 MCP servers finds Claude's tokenizer counts schema text a median 64.1 percent above tiktoken, the counter every published cost study uses.
Reality