* fix(python): expose client capabilities to MCP servers
Add list_roots_callback support to Python connectors to properly
advertise the roots capability during MCP initialization handshake.
Previously, the Python library was not exposing any client capabilities
because the list_roots_callback was not being passed to ClientSession.
This fix ensures the roots capability is always advertised, bringing
the Python library in line with the TypeScript implementation.
Changes:
- Add roots and list_roots_callback params to BaseConnector
- Add get_roots() and set_roots() methods for managing roots
- Pass list_roots_callback to ClientSession in all connectors
- Export Root type from connectors module
- Update unit tests to expect list_roots_callback parameter
Closes MCP-1063
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(python): add roots and list_roots_callback params to connectors
- Add roots and list_roots_callback parameters to StdioConnector,
HttpConnector, and SandboxConnector constructors
- Add comprehensive unit tests for client capabilities exposure
- Tests verify roots capability, get_roots(), set_roots(), and
that all callbacks are correctly passed to ClientSession
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: fix import sorting and update API documentation
- Fix import sorting in test_client_capabilities.py (ruff)
- Regenerate API documentation for updated connector classes
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(python): add list_roots() method to server Context
Allow MCP servers to request the list of roots from connected clients
via ctx.list_roots(). This follows the same pattern as ctx.sample()
and ctx.elicit() for server-to-client requests.
* feat(python): add roots params to MCPClient and config
- Add roots and list_roots_callback parameters to MCPClient.__init__,
from_dict(), and from_config_file() methods
- Update create_connector_from_config() to pass roots params to all
connector types (Stdio, HTTP, Sandbox)
- Allows clients to configure roots at the MCPClient level and have
them propagate to all sessions
* test(python): add get_client_roots tool to primitive server
Add a tool that demonstrates the roots capability by requesting and
returning the list of roots from the connected client. Used for
integration testing of the roots feature.
* test(python): add integration tests for roots capability
Add comprehensive integration tests for the roots feature:
- test_roots_capability: Verify server can request/receive roots
- test_roots_empty_by_default: Verify empty roots when not provided
- test_roots_with_custom_callback: Verify custom callback precedence
- test_set_roots_updates_server_view: Verify dynamic root updates
* test(python): update unit tests for roots parameters
Update mock assertions in test_client.py to expect the new roots
and list_roots_callback parameters in create_connector_from_config
calls.
* ci(python): add roots to primitive tests and README badge
- Add roots to CI workflow primitive test matrix
- Add roots to PR comment report primitives list
- Add Roots badge to README Primitives row
* feat(docs): enhance MCP client and server documentation for roots feature
- Added `roots` and `list_roots_callback` parameters to MCP client initialization documentation.
- Updated `create_connector_from_config` documentation to include new parameters.
- Introduced `list_roots` method documentation in server context, detailing its usage and return values.
- Improved overall clarity and completeness of API reference for better developer guidance.
* feat(python): add get_client_roots tool to context example
- Introduced a new tool, `get_client_roots`, to the context example, demonstrating how to retrieve and display the list of roots exposed by the client.
- Updated documentation to include the new tool and its functionality, enhancing the example's coverage of context features.
* feat(docs): add roots documentation for client and server
- Introduced new documentation for the `roots` feature, detailing how clients can expose file system roots to MCP servers and how servers can access these roots.
- Added examples for configuring roots in the MCP client and using the `list_roots()` method in the server context.
- Enhanced overall clarity and usability of the documentation to support developers in implementing the roots functionality.
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: pietrozullo <pietro.zullo@gmail.com>
* feat: Add PRM in the metadata discovery
* fix: fallback anyway to PRM
* feat: Implement complete discovery logic
* feat: Final implementation of CIMD
* feat: Implement PKCE
* feat: Add scope from WWW-Authenticate
* feat: Add all URLs possible styles
* feat: Update tests and example
* docs: Update docs
* fix: linting
* docs: update API documentation
* fix: correct typos in OAuth metadata and error messages
- Updated the comment in ProtectedResourceMetadata to use the correct abbreviation (PRM).
- Fixed a typo in the OAuthAuthenticationError message regarding code challenge support.
- Corrected the comment for legacy client paths to use "pre-registered" instead of "pre-reggistered".
* feat: restructure authentication documentation and add new methods
- Updated the authentication section in to group authentication methods under a new Authentication category with an icon.
- Removed the old file and replaced it with new documentation files for Bearer Token, Custom Auth, and OAuth 2.1.
- Introduced an overview page for authentication methods, detailing usage and configuration for each method.
- Enhanced security best practices and examples for each authentication type to improve clarity and usability.
* refactor: improve debug logging for OAuth metadata discovery
- Updated debug messages to provide clearer context by specifying the issuer or host being queried during OAuth and OpenID Connect metadata discovery.
- Enhanced error logging to remove redundant information, focusing on the failure reason without repeating the URL.
* fix: correct abbreviation in ProtectedResourceMetadata documentation
- Updated the abbreviation from PRC to PRM in the ProtectedResourceMetadata section to ensure accuracy in the documentation.
* fix(oauth): correct RFC 8414 well-known URL construction for path-based issuers
The OAuth metadata discovery was incorrectly constructing .well-known URLs
by appending to the issuer instead of inserting between host and path.
RFC 8414 specifies that for an issuer like https://github.com/login/oauth,
the .well-known URL should be:
https://github.com/.well-known/oauth-authorization-server/login/oauth
We were incorrectly building:
https://github.com/login/oauth/.well-known/oauth-authorization-server
This fix:
- Implements correct RFC 8414 URL construction (insert between host/path)
- Supports OpenID Connect style as fallback (append to issuer)
- Removes GitHub-specific hardcode since discovery now works correctly
- Adds documentation comments explaining the two standards
Ref: https://www.rfc-editor.org/rfc/rfc8414.html#section-3
* chore: oauth examples
* docs: enhance OAuth endpoint discovery documentation
- Updated the OAuth documentation to clarify how `mcp-use` discovers OAuth endpoints using both OAuth 2.0 and OpenID Connect standards.
- Added a table detailing the URL construction methods for each standard.
- Included examples for better understanding and a note on fallback behavior when the issuer has no path.
* response to bs codeql
* fix: update API URL Updated the GitHub API URL in the configuration to the correct endpoint for OAuth operations.
---------
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: pietrozullo <pietro.zullo@gmail.com>
* feat: add verify parameter to MCPClient and connectors
- Introduced a new optional `verify` parameter in `MCPClient`, `HttpConnector`, and configuration functions to control SSL certificate verification.
- Updated relevant methods to utilize the `verify` parameter, ensuring consistent handling of SSL verification across the client and connectors.
- Enhanced the SSE and Streamable HTTP connection managers to accept a custom HTTPX client factory for improved flexibility in connection handling.
* fix: linting and docs
* fix: http connector test
* Update docs/python/api-reference/mcp_use_client_config.mdx
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com>
* fix: docs
---------
Signed-off-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com>
Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Luigi Pederzani