python-mcp - Debian Package Tracker

general

source: python-mcp (main)
version: 1.28.1-1
maintainer: Debian Python Team (DMD)
uploaders: Pieter Lenaerts [DMD] [DM]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

unstable: 1.28.1-1

versioned links

1.28.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python3-mcp (1 bugs: 1, 0, 0, 0)

action needed

A new upstream version is available: 2.3.0 high

A new upstream version 2.3.0 is available, you should consider packaging it.

Created: 2026-07-29 Last update: 2026-10-25 15:20

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-59951: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.
CVE-2026-109527: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.

Created: 2026-10-16 Last update: 2026-10-16 15:30

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-09-18 Last update: 2026-10-25 15:19

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-25 15:17

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.3.0-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit b076c07c64af00364a0198b19a0813e147a348c4
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sun Oct 25 07:43:49 2026 +0100

    d/control: split b-deps to b-deps-indep, salsa-ci.yml profs

commit 89b8c5524c38da1bf9610b76811c275785544c0b
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 24 21:01:24 2026 +0200

    d/changelog: wrap line

commit c92ddfe72d4ac6b0319e68f009f59164d09c9387
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 24 20:48:42 2026 +0200

    d/changelog: update

commit a55692f9236c92d60ccc62c7755bd1f775a8159e
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 24 19:10:26 2026 +0200

    d/copyright: set fields right

commit d1e9b2aba8c93ec1e9e232fc7cc626dc1d95af8f
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 24 19:07:35 2026 +0200

    d/mcp.1*, d/s/lintian-overrides, README.Debian: update man page

commit 5cbd8a7c638b47c65998162065aa4f4de0b2bda7
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 24 15:29:41 2026 +0200

    d/pybuild.testfiles, d/rules: prevent cache files from being installed

commit e200a4f82398ff286a196bdcf59a853943f48a56
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 24 14:36:17 2026 +0200

    d/control: add dependencies, they are not detected due to the dynamic versioning in pyproject.toml

commit 68c157469e7b4f15c549c0c4ab1f4ae854a914e6
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 24 09:34:06 2026 +0200

    d/rules: don't test for 3.15, upstream will fix and pydantic-core should support 3.15

commit 7bf0426ee9326fb5bd1567526ffeae14da11567d
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 24 08:39:30 2026 +0200

    d/patches: allow os.stat in blockbuster rules

commit bb28140289aca05671015fc68de3abe0d53b6572
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 24 08:12:26 2026 +0200

    d/pybuild.testfiles: add docs, README.md

commit 41b3730944a96262d89d5b0391b12e7694faac95
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Fri Oct 23 20:07:32 2026 +0200

    d/rules: disable tests_translations.py - no zensical

commit 42cef184801d7b1fb7b16ec6441a3fc8ff869234
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Fri Oct 23 19:09:46 2026 +0200

    d/control: add build-deps

commit 0c6f405b732790dfff805cba85c85fddb5af0385
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Fri Oct 23 19:08:12 2026 +0200

    d/patches: add examples to sys.path for pytests

commit 6eb694577d5b5b8c365d338a22d954de7ce83100
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Tue Oct 20 21:53:51 2026 +0200

    d/pybuild.testfiles added

commit 6f476ee765e78aaddb85fbe9311b5c351177b719
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Tue Oct 20 21:41:27 2026 +0200

    d/control: more build deps

commit 6dda0f6e7414430c982fc60cc86633cb5328b5dd
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Tue Oct 20 21:17:58 2026 +0200

    d/patches: Add mcp_types to hatchling config for wheel

commit 2100c3fb411deef803052988fff07beefa648690
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Tue Oct 20 19:45:18 2026 +0200

    d/control: add new build-deps

commit fe756c8918a708bce15fab081f495a3401368cce
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Tue Oct 20 19:41:22 2026 +0200

    d/patches: refresh & stop disabling examples tests

commit a03cffd214433db68a577180282d20d361b505cd
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Tue Oct 20 19:24:56 2026 +0200

    d/changelog: bump to 2.3.0

commit 7d51e03fc95bccd4c154b27d6ffb6138ea5f4072
Merge: ece8ee3 c58ad9a
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sun Oct 18 12:36:31 2026 +0200

    Update upstream source from tag 'upstream/2.3.0'
    
    Update to upstream version '2.3.0'
    with Debian dir 5ddf22faa977fc84e00c9ca68a656cd5c93029c9

commit c58ad9a41383c5156acc1fc3fbbf9912112aaf23
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sun Oct 18 12:36:17 2026 +0200

    New upstream version 2.3.0

commit ece8ee38e87a70aa49b1130acba3b4414c8bb0ad
Merge: e0c25f6 5a2aeb3
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Fri Oct 2 07:01:02 2026 +0200

    Update upstream source from tag 'upstream/2.2.0'
    
    Update to upstream version '2.2.0'
    with Debian dir 5ddf22faa977fc84e00c9ca68a656cd5c93029c9

commit 5a2aeb3f1886ca0b85d8a0757d9d093ceaf95b3e
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Fri Oct 2 07:00:48 2026 +0200

    New upstream version 2.2.0

commit e0c25f6386bff90e08010acde8b278506bfdaa86
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Thu Jul 30 19:21:23 2026 +0200

    Disable salsa for now. Build is broken.

commit f91dc9d7b60ff76285686cef4046e82a1402a6a8
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Thu Jul 30 19:18:03 2026 +0200

    Add missing build-dep logfire.

commit f9b37ff0ccaeb7d922d75b544c0f935c8baa5002
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Thu Jul 30 19:17:44 2026 +0200

    Disable examples

commit ba1f6b253e76d76c577541435170c36e4ed6f0f8
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Thu Jul 30 09:32:04 2026 +0200

    Rediff patches
    
    Drop skip_broken_tests: need to review with new version
    Drop build_dir_in_python_path_for_test_process: need to review with new
    version

commit 58e4cf298b96120c31083a77379946a7b5bf6bc7
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Thu Jul 30 09:15:21 2026 +0200

    Update changelog

commit 17d4abfc7d59230baff6b90d72a35a3714cc3ef4
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Thu Jul 30 09:11:24 2026 +0200

    d/control: update build-deps

commit 6357531e5ea3e1e5a1781f681a7ffacb51f7419c
Merge: f429b92 c78e31e
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Thu Jul 30 08:52:09 2026 +0200

    Update upstream source from tag 'upstream/2.0.0'
    
    Update to upstream version '2.0.0'
    with Debian dir 964d442002a5722a669b7bbf4575bebe2270fb2b

commit c78e31eb7dab2334e3853d6d013b2b6b4e7af9b8
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Thu Jul 30 08:52:02 2026 +0200

    New upstream version 2.0.0

Created: 2026-07-30 Last update: 2026-10-25 10:50

testing migrations

excuses:
- Migration status for python-mcp (- to 1.28.1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating python-mcp would introduce bugs in testing: #1143624, #1145925, #1151047
- ∙ ∙ Autopkgtest for python-mcp/1.28.1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Failed ♻, ppc64el: Pass, riscv64: Failed ♻, s390x: Failed ♻
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/python-mcp.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 89 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-09-19] python-mcp REMOVED from testing (Debian testing watch)
[2026-08-04] python-mcp 1.28.1-1 MIGRATED to testing (Debian testing watch)
[2026-07-28] Accepted python-mcp 1.28.1-1 (source) into unstable (Pieter Lenaerts) (signed by: Jeroen Ploemen)
[2026-07-19] Accepted python-mcp 1.28.0-1 (source all) into unstable (Debian FTP Masters) (signed by: Mo Zhou)

bugs [bug history graph]

all: 5
RC: 3
I&N: 1
M&W: 1
F&P: 0
patch: 2

links

homepage
lintian
buildd: logs
popcon
browse source code
other distros
security tracker
debian patches
debci