Typed Python functions become MCP tools and resources
The SDK handles both sides of the Model Context Protocol. A server can expose tools, resources, and prompts, while a client can discover and call those capabilities. Type hints become input schemas, so a small function and docstring can be enough to define a tool without hand-writing JSON Schema or request parsing. This keeps simple servers readable and gives advanced users lower-level protocol types when the convenience layer is insufficient.
The README demonstrates a server in 15 lines and a client in 10. Stdio works well for a host launching a trusted local process. Streamable HTTP is the deployment transport, and SSE remains supported for compatibility. A client can also receive a custom transport. This breadth makes the official package the sensible default for Python teams that need to test protocol behavior across local tools, remote services, and more than one MCP host.
V2 follows the 2026-07-28 specification
V2 is the current stable line and a major architectural rework. It supports the July 28, 2026 MCP specification and earlier revisions. The project keeps v1 on a separate branch for critical bug and security fixes, but pip install mcp now resolves to 2.x. Existing applications should either complete the migration guide or pin a range such as mcp>=1.28,<2 before refreshing an environment.
Release v2.1.1 arrived on August 25, 2026. Its single listed change directs old mcp.server.fastmcp imports to the migration guide, which is a small patch with a useful message: code written for the old convenience surface will not become v2 code through an accidental import fallback. The main documentation now separates getting started, v2 changes, migration, clients, and the API reference, making the version boundary hard to miss.
What happened when we ran it
Our sandbox installed 61 packages in 32 seconds and used 66 MB on disk. The build succeeded in another 6 seconds. Pip-audit reported 0 known vulnerabilities. We ran commit 56af447 in a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Python 3.12, and no secrets. The checkout itself contained 1,663 files, about 144,627 source lines, and 14.5 MB of data.
Tests stopped after 6 seconds with exit code 4, before pytest could collect any cases. tests/conftest.py imported CaptureLogfire, and Python raised ModuleNotFoundError: No module named 'logfire'. The log contains no failed assertion or test count, so it does not show a protocol defect. It shows that the dependency set installed by our standard source procedure was not enough to start the repository's test suite, despite the checkout having a tests directory and 10 CI workflows.
HTTP deployment needs normal service engineering
A local stdio tool can be genuinely small. A remote MCP endpoint is a network service with authentication, origin rules, request limits, timeouts, session cleanup, TLS, and logs. Active pull requests on August 26 addressed idle Streamable HTTP sessions, concurrent-session caps, same-origin redirect following, and authorization metadata validation. Those are healthy maintenance signals and a reminder that the 15-line example is an interface tutorial, not a production deployment plan.
Issue 1664 gives one specific integration trap. A custom User-Agent supplied to the Streamable HTTP transport was not forwarded into its authentication flow, which caused trouble with an AWS WAF baseline rule. The report says teams had to consider disabling that rule. If your auth path crosses a proxy or firewall, capture every discovery and token request in staging instead of checking only the final MCP call.
Empty servers and non-finite numbers expose edges
Issue 3384 reports that ClientSessionGroup mishandles a server exposing 0 tools, resources, and prompts. One connection route raises a raw KeyError; another forgets the exit stack and can leave the transport open until the whole group closes. Empty capability sets are plausible during rollout or permission filtering, so multi-server clients should include that case in connection and shutdown tests.
Issue 3385 finds a cross-language serialization bug. A tool without a return annotation can emit NaN or Infinity as bare tokens in a text block and still report success. Python's JSON loader accepts them by default, while JSON.parse in Node rejects them. Give tools explicit return types, reject non-finite numeric values at the boundary, and run fixtures through the actual languages used by clients rather than testing Python against Python only.
Official status makes it the default, not an exemption
GitHub showed 24,128 stars, 392 combined issues and pull requests, and a last push on August 26, 2026. The high combined count belongs to a fast-moving official implementation and includes active pull requests; it is not a count of confirmed bugs. Same-day work on authorization, redirects, sessions, pagination, and parsing shows maintainers dealing with protocol and deployment details rather than leaving them to downstream packages.
Choose this SDK for Python MCP work unless a higher-level framework solves a specific operational need. Its MIT license, current specification support, and server-client coverage reduce the risk of inventing protocol behavior yourself. The failed test startup in our sandbox means contributors need to verify the full development extras, while the open interoperability reports justify a focused contract suite around authentication, lifecycle cleanup, and JSON values.