The official Python SDK for Model Context Protocol servers and clients
This report summarizes scanner evidence for modelcontextprotocol/python-sdk, a Python project with 24,537 GitHub stars. SynthScan examined 270,733 lines of code across 1699 source files, recording 4504 pattern matches distributed across 22 syntactic categories. The legacy adjusted pattern signal is 21.4 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3432 finding(s).
Are imports declared and package/API names verified? 479 finding(s).
Are wrappers, guards, and repeated structures necessary? 3780 finding(s).
Which changes need focused human review? 4504 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 4504 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_examples.py | 64 | async def test_direct_call_tool_result_return(): | CODE |
| LOW | tests/test_types.py | 80 | async def test_method_initialization(): | CODE |
| LOW | tests/test_types.py | 165 | async def test_sampling_message_with_user_role(): | CODE |
| LOW | tests/test_types.py | 188 | async def test_sampling_message_with_assistant_role(): | CODE |
| LOW | tests/test_types.py | 218 | async def test_sampling_message_backward_compatibility(): | CODE |
| LOW | tests/test_types.py | 245 | async def test_create_message_request_params_with_tools(): | CODE |
| LOW | tests/test_types.py | 268 | async def test_create_message_result_with_tool_use(): | CODE |
| LOW | tests/test_types.py | 291 | async def test_create_message_result_basic(): | CODE |
| LOW | tests/test_types.py | 310 | async def test_client_capabilities_with_sampling_tools(): | CODE |
| LOW | tests/test_types.py | 396 | def test_concrete_wire_results_always_dump_result_type_complete(): | CODE |
| LOW | tests/test_types.py | 416 | def test_cacheable_results_default_to_immediately_stale_private(): | CODE |
| LOW⚡ | tests/test_types.py | 440 | def test_empty_result_dumps_no_fields_by_default(): | CODE |
| LOW⚡ | tests/test_types.py | 445 | def test_empty_result_dumps_result_type_only_when_explicitly_tagged(): | CODE |
| LOW⚡ | tests/test_types.py | 449 | def test_input_required_result_dumps_its_discriminating_tag(): | CODE |
| LOW⚡ | tests/test_types.py | 455 | def test_input_required_result_requires_at_least_one_of_input_requests_or_request_state(): | CODE |
| LOW | tests/test_types.py | 469 | def test_mcp_types_namespace_mirrors_mcp_types_exactly(): | CODE |
| LOW | tests/test_types.py | 483 | def test_mcp_types_submodules_mirror_mcp_types_submodules_exactly(mirror: ModuleType, source: ModuleType): | CODE |
| LOW | tests/test_types.py | 488 | def test_bare_import_mcp_binds_the_types_submodule(): | CODE |
| LOW⚡ | tests/types/test_version.py | 26 | def test_is_version_at_least_ordering(version: str, minimum: str, expected: bool) -> None: | CODE |
| LOW⚡ | tests/types/test_version.py | 32 | def test_is_version_at_least_unknown_version_is_false(version: str) -> None: | CODE |
| LOW⚡ | tests/types/test_version.py | 37 | def test_is_version_at_least_unknown_minimum_raises() -> None: | CODE |
| LOW⚡ | tests/types/test_version.py | 46 | def test_is_version_at_least_matches_lexicographic_for_known_versions(version: str, minimum: str) -> None: | CODE |
| LOW⚡ | tests/types/test_version.py | 52 | def test_supported_versions_are_known() -> None: | CODE |
| LOW⚡ | tests/types/test_version.py | 58 | def test_known_versions_are_strictly_ordered() -> None: | CODE |
| LOW⚡ | tests/types/test_methods.py | 577 | def test_cacheable_methods_mirror_the_cacheable_method_literal(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 582 | def test_input_required_methods_mirror_the_monolith_input_required_arms(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 587 | def test_is_input_required_matches_typed_and_wire_shapes(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 597 | def test_minimal_request_bodies_parse_through_every_request_row(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 606 | def test_minimal_notification_bodies_parse_through_every_notification_row(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 615 | def test_minimal_result_bodies_parse_through_every_result_row(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 624 | def test_non_file_root_uri_passes_the_surface_step_and_rejects_at_the_monolith_step(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 777 | def test_extension_map_rows_parse_through_the_same_functions(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 787 | def test_inconsistent_extension_maps_raise_runtime_error_after_the_surface_hit(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 794 | def test_input_required_unions_discriminate_identically_in_both_arm_orders(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 946 | def test_serialize_server_result_preserves_arbitrary_meta_value_identically(version: str): | CODE |
| LOW⚡ | tests/types/test_methods.py | 953 | def test_serialize_server_result_preserves_open_type_extras(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 963 | def test_serialize_server_result_drops_top_level_server_info_on_discover_but_keeps_the_meta_stamp(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 981 | def test_serialize_server_result_drops_an_unknown_nested_tool_field(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 987 | def test_serialize_server_result_raises_key_error_for_an_absent_row_and_value_error_for_an_unknown_version(): | CODE |
| LOW⚡ | tests/types/test_methods.py | 994 | def test_importing_the_module_builds_no_adapters_and_identical_rows_share_one(): | CODE |
| LOW | tests/types/test_methods.py | 422 | def test_maps_define_exactly_the_expected_methods_for_every_known_version(): | CODE |
| LOW | tests/types/test_methods.py | 438 | def test_spec_client_method_sets_are_the_client_direction_projection_of_the_surface_maps(): | CODE |
| LOW | tests/types/test_methods.py | 446 | def test_elicit_result_surface_accepts_null_content_values_at_every_version_that_defines_it(): | CODE |
| LOW | tests/types/test_methods.py | 457 | def test_discovery_capabilities_preserve_nested_json_values() -> None: | CODE |
| LOW | tests/types/test_methods.py | 473 | def test_elicit_request_surface_accepts_loose_property_schemas(): | CODE |
| LOW | tests/types/test_methods.py | 502 | def test_response_map_keys_mirror_the_request_map_keys(): | CODE |
| LOW | tests/types/test_methods.py | 507 | def test_response_row_values_match_the_pinned_classes_and_unions(): | CODE |
| LOW | tests/types/test_methods.py | 527 | def test_surface_keys_agree_with_their_classes_and_the_monolith_maps(): | CODE |
| LOW | tests/types/test_methods.py | 558 | def test_built_in_maps_are_immutable(): | CODE |
| LOW | tests/types/test_methods.py | 647 | def test_absent_map_keys_raise_key_error_for_every_gate_shape(): | CODE |
| LOW | tests/types/test_methods.py | 662 | def test_unknown_version_strings_raise_value_error_on_every_parse_function(): | CODE |
| LOW | tests/types/test_methods.py | 705 | def test_empty_result_body_parses_at_versions_that_define_it(): | CODE |
| LOW | tests/types/test_methods.py | 721 | def test_embedded_input_request_entries_without_method_reject_at_the_surface_step(): | CODE |
| LOW | tests/types/test_methods.py | 758 | def test_none_params_omit_the_key_so_required_params_reject(): | CODE |
| LOW | tests/types/test_methods.py | 765 | def test_snake_case_spellings_of_required_aliased_fields_reject_as_missing(): | CODE |
| LOW | tests/types/test_methods.py | 826 | def test_sampling_union_keeps_the_complete_arm_first_because_order_is_load_bearing(): | CODE |
| LOW | tests/types/test_methods.py | 849 | def test_validate_functions_accept_reject_and_gate_like_their_parse_siblings(): | CODE |
| LOW | tests/types/test_methods.py | 912 | def test_dumped_monolith_results_round_trip_through_serialize_server_result(method: str, version: str): | CODE |
| LOW⚡ | tests/types/test_request_name_param.py | 18 | def test_request_base_declares_no_name_param() -> None: | CODE |
| LOW⚡ | tests/types/test_request_name_param.py | 22 | def test_core_request_types_inherit_none() -> None: | CODE |
| 3094 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/transports/stdio/test_windows.py | 0 | opt out of the shared per-module event loop: this module parametrizes `anyio_backend`. | STRING |
| HIGH | tests/server/test_streamable_http_modern.py | 0 | opt out of the shared per-module event loop: this module parametrizes `anyio_backend`. | STRING |
| HIGH | tests/shared/test_request_clock.py | 0 | opt out of the shared per-module event loop: this module parametrizes `anyio_backend`. | STRING |
| HIGH | tests/shared/test_jsonrpc_dispatcher.py | 0 | opt out of the shared per-module event loop: this module parametrizes `anyio_backend`. | STRING |
| HIGH | tests/docs_src/test_subscriptions.py | 0 | opt out of the shared per-module event loop: this module parametrizes `anyio_backend`. | STRING |
| HIGH | tests/client/test_input_required.py | 0 | opt out of the shared per-module event loop: this module parametrizes `anyio_backend`. | STRING |
| HIGH | tests/interaction/auth/test_login_time.py | 0 | opt out of the shared per-module event loop: this module parametrizes `anyio_backend`. | STRING |
| HIGH | …sts/interaction/transports/test_hosting_http_modern.py | 0 | opt out of the shared per-module event loop: this module parametrizes `anyio_backend`. | STRING |
| HIGH | tests/interaction/lowlevel/test_timeouts.py | 0 | opt out of the shared per-module event loop: this module parametrizes `anyio_backend`. | STRING |
| HIGH | tests/server/test_session.py | 0 | a spec-method result that fails the per-version surface schema raises `validationerror` even when the caller's `result_t | STRING |
| HIGH | tests/server/test_connection.py | 0 | a spec-method result that fails the per-version surface schema raises `validationerror` even when the caller's `result_t | STRING |
| HIGH | tests/client/test_session.py | 0 | a spec-method result that fails the per-version surface schema raises `validationerror` even when the caller's `result_t | STRING |
| HIGH | tests/server/test_session.py | 0 | peer results validate alias-only; a snake_case key from the wire is ignored as extra, not populated by python field name | STRING |
| HIGH | tests/server/test_connection.py | 0 | peer results validate alias-only; a snake_case key from the wire is ignored as extra, not populated by python field name | STRING |
| HIGH | tests/shared/test_peer.py | 0 | peer results validate alias-only; a snake_case key from the wire is ignored as extra, not populated by python field name | STRING |
| HIGH | …s/server/mcpserver/resources/test_resource_template.py | 0 | sync prompt functions must run in a worker thread, not the event loop. | STRING |
| HIGH | …/server/mcpserver/resources/test_function_resources.py | 0 | sync prompt functions must run in a worker thread, not the event loop. | STRING |
| HIGH | tests/server/mcpserver/prompts/test_base.py | 0 | sync prompt functions must run in a worker thread, not the event loop. | STRING |
| HIGH | tests/interaction/transports/test_hosting_http.py | 0 | registered so the logging capability is advertised; the client never sets a level. | STRING |
| HIGH | tests/interaction/transports/_stdio_server.py | 0 | registered so the logging capability is advertised; the client never sets a level. | STRING |
| HIGH | tests/interaction/lowlevel/test_logging.py | 0 | registered so the logging capability is advertised; the client never sets a level. | STRING |
| HIGH | tests/interaction/lowlevel/test_flows.py | 0 | registered so the logging capability is advertised; the client never sets a level. | STRING |
| HIGH | tests/interaction/transports/test_hosting_http.py | 0 | registered so the resources capability is advertised; the client never lists resources. | STRING |
| HIGH | tests/interaction/lowlevel/test_resources.py | 0 | registered so the resources capability is advertised; the client never lists resources. | STRING |
| HIGH | tests/interaction/lowlevel/test_list_changed.py | 0 | registered so the resources capability is advertised; the client never lists resources. | STRING |
| HIGH | docs/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/zh-hant/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/ja/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/ru/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/pt/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/zh/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/uk/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/hi/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/de/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/ko/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/fr/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/es/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | i18n/tr/pages/deprecated.md | 0 | the user opened another folder: expose it through the roots callback, then tell the server. | STRING |
| HIGH | src/mcp-types/mcp_types/_types.py | 0 | a progress token, used to associate progress notifications with the original request. | STRING |
| HIGH | src/mcp-types/mcp_types/_v2026_07_28/__init__.py | 0 | a progress token, used to associate progress notifications with the original request. | STRING |
| HIGH | src/mcp-types/mcp_types/_v2025_11_25/__init__.py | 0 | a progress token, used to associate progress notifications with the original request. | STRING |
| HIGH | src/mcp-types/mcp_types/_types.py | 0 | the sender or recipient of messages and data in a conversation. | STRING |
| HIGH | src/mcp-types/mcp_types/_v2026_07_28/__init__.py | 0 | the sender or recipient of messages and data in a conversation. | STRING |
| HIGH | src/mcp-types/mcp_types/_v2025_11_25/__init__.py | 0 | the sender or recipient of messages and data in a conversation. | STRING |
| HIGH | src/mcp-types/mcp_types/_types.py | 0 | if specified, the caller is requesting out-of-band progress notifications for this request (as represented by notificati | STRING |
| HIGH | src/mcp-types/mcp_types/_v2026_07_28/__init__.py | 0 | if specified, the caller is requesting out-of-band progress notifications for this request (as represented by notificati | STRING |
| HIGH | src/mcp-types/mcp_types/_v2025_11_25/__init__.py | 0 | if specified, the caller is requesting out-of-band progress notifications for this request (as represented by notificati | STRING |
| HIGH | src/mcp-types/mcp_types/_types.py | 0 | an opaque token representing the current pagination position. if provided, the server should return results starting aft | STRING |
| HIGH | src/mcp-types/mcp_types/_v2026_07_28/__init__.py | 0 | an opaque token representing the current pagination position. if provided, the server should return results starting aft | STRING |
| HIGH | src/mcp-types/mcp_types/_v2025_11_25/__init__.py | 0 | an opaque token representing the current pagination position. if provided, the server should return results starting aft | STRING |
| HIGH | src/mcp-types/mcp_types/_types.py | 0 | an opaque token representing the pagination position after the last returned result. if present, there may be more resul | STRING |
| HIGH | src/mcp-types/mcp_types/_v2026_07_28/__init__.py | 0 | an opaque token representing the pagination position after the last returned result. if present, there may be more resul | STRING |
| HIGH | src/mcp-types/mcp_types/_v2025_11_25/__init__.py | 0 | an opaque token representing the pagination position after the last returned result. if present, there may be more resul | STRING |
| HIGH | src/mcp-types/mcp_types/_types.py | 0 | intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present). | STRING |
| HIGH | src/mcp-types/mcp_types/_v2026_07_28/__init__.py | 0 | intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present). | STRING |
| HIGH | src/mcp-types/mcp_types/_v2025_11_25/__init__.py | 0 | intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present). | STRING |
| HIGH | src/mcp-types/mcp_types/_types.py | 0 | intended for ui and end-user contexts — optimized to be human-readable and easily understood, even by those unfamiliar w | STRING |
| HIGH | src/mcp-types/mcp_types/_v2025_11_25/__init__.py | 0 | intended for ui and end-user contexts — optimized to be human-readable and easily understood, even by those unfamiliar w | STRING |
| HIGH | src/mcp-types/mcp_types/_v2026_07_28/__init__.py | 0 | intended for ui and end-user contexts — optimized to be human-readable and easily understood, even by those unfamiliar w | STRING |
| HIGH | src/mcp-types/mcp_types/_types.py | 0 | an optional url of the website for this implementation. | STRING |
| 194 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/types/test_parity.py | 3 | CODE | |
| LOW | tests/server/mcpserver/test_func_metadata.py | 23 | CODE | |
| LOW | tests/shared/test_streamable_http.py | 7 | CODE | |
| LOW | tests/shared/test_otel.py | 1 | CODE | |
| LOW | tests/examples/conftest.py | 13 | CODE | |
| LOW | tests/examples/test_stories.py | 3 | CODE | |
| LOW | tests/examples/test_stories_smoke.py | 17 | CODE | |
| LOW | tests/examples/test_story_shape.py | 8 | CODE | |
| LOW | tests/client/test_probe.py | 14 | CODE | |
| LOW | tests/client/test_probe.py | 39 | CODE | |
| LOW | tests/client/test_session.py | 1 | CODE | |
| LOW | tests/client/test_client.py | 3 | CODE | |
| LOW | tests/interaction/transports/__init__.py | 7 | CODE | |
| LOW | examples/snippets/clients/url_elicitation_client.py | 23 | CODE | |
| LOW | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 1 | CODE | |
| LOW | …ents/simple-auth-client/mcp_simple_auth_client/main.py | 8 | CODE | |
| LOW | examples/stories/_hosting.py | 8 | CODE | |
| LOW | examples/stories/_hosting.py | 12 | CODE | |
| LOW | examples/stories/_harness.py | 9 | CODE | |
| LOW | examples/stories/_harness.py | 24 | CODE | |
| LOW | examples/stories/_harness.py | 26 | CODE | |
| LOW | examples/stories/_harness.py | 27 | CODE | |
| LOW | examples/stories/_shared/auth.py | 6 | CODE | |
| LOW | scripts/gen_surface_types.py | 12 | CODE | |
| LOW | scripts/docs/llms_txt.py | 23 | CODE | |
| LOW | scripts/docs/gen_ref_pages.py | 13 | CODE | |
| LOW | scripts/docs/translations.py | 37 | CODE | |
| LOW | scripts/docs/build_config.py | 21 | CODE | |
| LOW | scripts/docs/check_crossrefs.py | 29 | CODE | |
| LOW | scripts/docs/check_render_order.py | 37 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| LOW | src/mcp/__init__.py | 1 | CODE | |
| 391 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/server/test_lifespan.py | 43 | # Create a tool that accesses lifespan context | COMMENT |
| MEDIUM | tests/server/auth/test_protected_resource.py | 18 | # Create the protected resource routes | COMMENT |
| MEDIUM | tests/server/auth/middleware/test_auth_context.py | 53 | # Create an authenticated user | COMMENT |
| MEDIUM | tests/server/auth/middleware/test_bearer_auth.py | 384 | # Create a user with read/write scopes but not admin | COMMENT |
| MEDIUM | tests/server/auth/middleware/test_bearer_auth.py | 413 | # Create a user with read/write scopes | COMMENT |
| MEDIUM | tests/server/auth/middleware/test_bearer_auth.py | 441 | # Create a user with read/write scopes | COMMENT |
| MEDIUM | tests/server/auth/middleware/test_bearer_auth.py | 466 | # Create a user with read/write scopes | COMMENT |
| MEDIUM | tests/server/auth/middleware/test_bearer_auth.py | 491 | # Create a user with read/write scopes | COMMENT |
| MEDIUM | tests/server/mcpserver/test_func_metadata.py | 371 | # Create a copy of the actual schema to normalize | COMMENT |
| MEDIUM⚡ | tests/server/mcpserver/test_server.py | 461 | # Create a test image | COMMENT |
| MEDIUM⚡ | tests/server/mcpserver/test_server.py | 465 | # Create a test audio | COMMENT |
| MEDIUM | tests/server/mcpserver/test_server.py | 369 | # Create a test image | COMMENT |
| MEDIUM | tests/server/mcpserver/test_server.py | 389 | # Create a test audio | COMMENT |
| MEDIUM | tests/server/mcpserver/test_server.py | 425 | # Create a test audio file with the specific extension | COMMENT |
| MEDIUM | tests/server/mcpserver/test_server.py | 847 | # Create a text file | COMMENT |
| MEDIUM | tests/server/mcpserver/test_server.py | 863 | # Create a binary file | COMMENT |
| MEDIUM | tests/server/mcpserver/test_elicitation.py | 67 | # Create a custom handler for elicitation requests | COMMENT |
| MEDIUM | tests/server/mcpserver/auth/test_auth_integration.py | 107 | # Create a RefreshToken object that matches what is expected in later code | COMMENT |
| MEDIUM | tests/server/mcpserver/auth/test_auth_integration.py | 370 | # Create an auth code for the registered client | COMMENT |
| MEDIUM | tests/server/mcpserver/auth/test_auth_integration.py | 838 | # Create a test client with the token | COMMENT |
| MEDIUM | …s/server/mcpserver/resources/test_resource_template.py | 404 | # Create a resource from the template | COMMENT |
| MEDIUM | …s/server/mcpserver/resources/test_resource_template.py | 454 | # Create a resource from the template | COMMENT |
| MEDIUM⚡ | tests/shared/test_streamable_http.py | 1706 | # Create a mock SSE event with empty data (keep-alive ping) | COMMENT |
| MEDIUM⚡ | tests/shared/test_streamable_http.py | 1709 | # Create a context-aware stream writer (matches StreamWriter type alias) | COMMENT |
| MEDIUM⚡ | tests/shared/test_streamable_http.py | 1731 | # Create a transport with an event store | COMMENT |
| MEDIUM⚡ | tests/shared/test_streamable_http.py | 1737 | # Create a mock message and request | COMMENT |
| MEDIUM | tests/shared/test_streamable_http.py | 2163 | # Create a client with custom headers | COMMENT |
| MEDIUM | tests/issues/test_152_resource_mime_type.py | 25 | # Create a small test image as bytes | COMMENT |
| MEDIUM | tests/issues/test_152_resource_mime_type.py | 70 | # Create a small test image as bytes | COMMENT |
| MEDIUM | tests/issues/test_355_type_error.py | 20 | # Create a named server | COMMENT |
| MEDIUM | …sts/issues/test_1363_race_condition_streamable_http.py | 77 | # Create a new event loop for this thread | COMMENT |
| MEDIUM | tests/client/test_auth.py | 411 | # Create a test request | COMMENT |
| MEDIUM | tests/client/test_auth.py | 1259 | # Create a test request | COMMENT |
| MEDIUM | tests/client/test_auth.py | 1284 | # Create a test request | COMMENT |
| MEDIUM | tests/client/test_auth.py | 1437 | # Create a test request | COMMENT |
| MEDIUM | tests/client/test_auth.py | 2137 | # Create a test request | COMMENT |
| MEDIUM | tests/client/test_session.py | 126 | # Create a message handler to catch exceptions | COMMENT |
| MEDIUM | tests/client/test_logging_callback.py | 27 | # Create a simple test tool | COMMENT |
| MEDIUM | tests/client/test_logging_callback.py | 33 | # Create a function that can send a log notification | COMMENT |
| MEDIUM | tests/client/test_logging_callback.py | 56 | # Create a message handler to catch exceptions | COMMENT |
| MEDIUM | examples/snippets/clients/streamable_basic.py | 14 | # Create a session using the client streams | COMMENT |
| MEDIUM | …s/snippets/servers/streamable_http_multiple_servers.py | 31 | # Create a combined lifespan to manage both session managers | COMMENT |
| MEDIUM | …les/snippets/servers/streamable_http_basic_mounting.py | 24 | # Create a lifespan context manager to run the session manager | COMMENT |
| MEDIUM | …ples/snippets/servers/streamable_http_host_mounting.py | 24 | # Create a lifespan context manager to run the session manager | COMMENT |
| MEDIUM⚡ | examples/snippets/servers/streamable_starlette_mount.py | 12 | # Create the Echo server | COMMENT |
| MEDIUM⚡ | examples/snippets/servers/streamable_starlette_mount.py | 22 | # Create the Math server | COMMENT |
| MEDIUM⚡ | examples/snippets/servers/streamable_starlette_mount.py | 32 | # Create a combined lifespan to manage both session managers | COMMENT |
| MEDIUM⚡ | examples/snippets/servers/streamable_starlette_mount.py | 41 | # Create the Starlette app and mount the MCP servers | COMMENT |
| MEDIUM | examples/snippets/servers/mcpserver_quickstart.py | 9 | # Create an MCP server | COMMENT |
| MEDIUM | …amples/snippets/servers/streamable_http_path_config.py | 12 | # Create a simple MCPServer server | COMMENT |
| MEDIUM | examples/mcpserver/readme-quickstart.py | 3 | # Create an MCP server | COMMENT |
| MEDIUM | src/mcp/server/models.py | 1 | """This module provides simplified types to use with the server for managing prompts | STRING |
| MEDIUM | src/mcp/server/sse.py | 7 | # Create an SSE transport at an endpoint | STRING |
| MEDIUM | src/mcp/server/streamable_http.py | 781 | # Create a standalone message stream for server-initiated messages | COMMENT |
| MEDIUM | src/mcp/server/streamable_http.py | 958 | # Define an async callback for sending events | COMMENT |
| MEDIUM | src/mcp/server/streamable_http.py | 1042 | # Create the memory streams for this connection | COMMENT |
| MEDIUM | src/mcp/server/streamable_http.py | 1055 | # Create a message router that distributes messages to request streams | COMMENT |
| MEDIUM | src/mcp/server/auth/middleware/auth_context.py | 8 | # Create a contextvar to store the authenticated user | COMMENT |
| MEDIUM | src/mcp/server/lowlevel/server.py | 773 | # Create the ASGI handler | COMMENT |
| MEDIUM | src/mcp/client/session_group.py | 378 | # Create a reverse index so we can find all prompts, resources, and | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/server/mcpserver/resources/test_file_resources.py | 25 | except FileNotFoundError: # pragma: lax no cover | CODE |
| HIGH | tests/shared/test_streamable_http.py | 1686 | except Exception: | CODE |
| HIGH | tests/client/test_auth.py | 1689 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 3590 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 3668 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 513 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 1273 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 1376 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 1420 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 1529 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 1626 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 1963 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 2064 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 2204 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 2553 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 2639 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 2888 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_auth.py | 2993 | except StopAsyncIteration: | CODE |
| HIGH | tests/client/test_scope_bug_1630.py | 168 | except StopAsyncIteration: | CODE |
| HIGH | docs_src/subscriptions/tutorial005.py | 16 | except SubscriptionLost: | CODE |
| HIGH | src/mcp/server/transport_security.py | 143 | except ValueError: | CODE |
| HIGH | src/mcp/server/subscriptions.py | 208 | except anyio.ClosedResourceError: | CODE |
| HIGH | src/mcp/server/session.py | 120 | except KeyError: | CODE |
| HIGH | src/mcp/server/connection.py | 396 | except KeyError: | CODE |
| HIGH | src/mcp/server/streamable_http.py | 799 | except anyio.ClosedResourceError: | CODE |
| HIGH | src/mcp/server/auth/handlers/authorize.py | 110 | except (ValidationError, InvalidRedirectUriError): | CODE |
| HIGH | src/mcp/server/mcpserver/resources/types.py | 174 | except UnicodeError: | CODE |
| HIGH | src/mcp/server/mcpserver/utilities/logging.py | 33 | except ImportError: # pragma: no cover | CODE |
| HIGH | src/mcp/shared/dispatcher.py | 65 | except ValueError: | CODE |
| HIGH | src/mcp/shared/jsonrpc_dispatcher.py | 717 | except (anyio.WouldBlock, anyio.BrokenResourceError, anyio.ClosedResourceError): | CODE |
| HIGH | src/mcp/os/posix/utilities.py | 61 | except PermissionError: | CODE |
| HIGH | src/mcp/os/win32/utilities.py | 284 | except OSError: | CODE |
| HIGH | src/mcp/client/session.py | 592 | except KeyError: | CODE |
| HIGH | src/mcp/client/streamable_http.py | 414 | except (httpx2.StreamError, ValidationError): | CODE |
| HIGH | src/mcp/client/stdio.py | 161 | except anyio.ClosedResourceError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/client/test_stdio.py | 59 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/client/test_stdio.py | 61 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/client/test_stdio.py | 1030 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/client/test_stdio.py | 1032 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/client/test_stdio.py | 1163 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/client/test_stdio.py | 1165 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/client/test_client.py | 757 | # ── SEP-2322 multi-round-trip auto-loop ──────────────────────────────────────── | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 171 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 173 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 477 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 479 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 814 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 816 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 956 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 958 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1091 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1093 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1122 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1124 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1303 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1305 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1352 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1354 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1418 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1420 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1458 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1460 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1504 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1506 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1596 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1598 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1803 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 1805 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2052 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2054 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2129 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2131 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2181 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2183 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2202 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2204 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2531 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2533 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2594 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2596 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2731 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2733 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2844 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 2846 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 3039 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 3041 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 3112 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 3114 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 3416 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 3418 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 3671 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 3673 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 4054 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 4056 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/interaction/_requirements.py | 4109 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| 15 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/server/test_runner.py | 731 | async def set_level(ctx: Ctx, params: SetLevelRequestParams) -> None: | CODE |
| LOW | tests/server/test_sse_security.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/shared/conftest.py | 61 | __all__ = ["PairFactory", "direct_pair", "jsonrpc_pair"] | CODE |
| LOW | tests/cli/test_utils.py | 12 | def _set_mcp_version(monkeypatch: pytest.MonkeyPatch, version: str) -> None: | CODE |
| LOW | tests/cli/test_claude.py | 13 | def _set_mcp_version(monkeypatch: pytest.MonkeyPatch, version: str) -> None: | CODE |
| LOW | tests/client/test_auth.py | 58 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | tests/client/test_auth.py | 64 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | tests/client/test_session.py | 796 | def _set_negotiated_version(session: ClientSession, version: str) -> None: | CODE |
| LOW | tests/client/test_scope_bug_1630.py | 32 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | tests/client/test_scope_bug_1630.py | 38 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | tests/client/auth/extensions/test_client_credentials.py | 35 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | tests/client/auth/extensions/test_client_credentials.py | 41 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: # pragma: no cover | CODE |
| LOW | tests/client/auth/extensions/test_identity_assertion.py | 33 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | tests/client/auth/extensions/test_identity_assertion.py | 39 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | tests/interaction/auth/_harness.py | 119 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | tests/interaction/auth/_harness.py | 125 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | tests/interaction/transports/__init__.py | 9 | __all__ = ["StreamingASGITransport"] | CODE |
| LOW | examples/snippets/clients/oauth_client.py | 32 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | examples/snippets/clients/oauth_client.py | 40 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | examples/snippets/clients/identity_assertion_client.py | 37 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | examples/snippets/clients/identity_assertion_client.py | 43 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | …ents/simple-auth-client/mcp_simple_auth_client/main.py | 40 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | …ents/simple-auth-client/mcp_simple_auth_client/main.py | 46 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | examples/stories/serve_one/server.py | 28 | __all__ = ["SingleExchangeContext", "build_server", "handle_one"] | CODE |
| LOW | examples/stories/_shared/auth.py | 41 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | examples/stories/_shared/auth.py | 47 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | …vers/everything-server/mcp_everything_server/server.py | 51 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ple-streamablehttp/mcp_simple_streamablehttp/server.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | …treamablehttp/mcp_simple_streamablehttp/event_store.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | …tateless/mcp_simple_streamablehttp_stateless/server.py | 10 | logger = logging.getLogger(__name__) | CODE |
| LOW | examples/servers/simple-auth/mcp_simple_auth/server.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | …les/servers/simple-auth/mcp_simple_auth/auth_server.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ervers/simple-auth/mcp_simple_auth/legacy_as_server.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | …/servers/simple-auth/mcp_simple_auth/token_verifier.py | 9 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ervers/sse-polling-demo/mcp_sse_polling_demo/server.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | …s/sse-polling-demo/mcp_sse_polling_demo/event_store.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | .github/actions/conformance/client.py | 67 | logger = logging.getLogger(__name__) | CODE |
| LOW | .github/actions/conformance/client.py | 132 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | .github/actions/conformance/client.py | 138 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | docs_src/middleware/tutorial001.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | docs_src/extensions/tutorial005.py | 9 | logger = logging.getLogger(__name__) | CODE |
| LOW | docs_src/oauth_clients/tutorial002.py | 17 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | docs_src/oauth_clients/tutorial002.py | 23 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | docs_src/oauth_clients/tutorial001.py | 20 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | docs_src/oauth_clients/tutorial001.py | 26 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | docs_src/identity_assertion/tutorial001.py | 23 | async def set_tokens(self, tokens: OAuthToken) -> None: | CODE |
| LOW | docs_src/identity_assertion/tutorial001.py | 29 | async def set_client_info(self, client_info: OAuthClientInformationFull) -> None: | CODE |
| LOW | docs_src/logging/tutorial001.py | 5 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/mcp/__init__.py | 74 | __all__ = [ | CODE |
| LOW | src/mcp/server/runner.py | 75 | __all__ = [ | CODE |
| LOW | src/mcp/server/runner.py | 87 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/mcp/server/_streamable_http_modern.py | 77 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/mcp/server/transport_security.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/mcp/server/request_state.py | 34 | __all__ = [ | CODE |
| LOW | src/mcp/server/request_state.py | 43 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/mcp/server/subscriptions.py | 57 | __all__ = [ | CODE |
| LOW | src/mcp/server/subscriptions.py | 69 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/mcp/server/session.py | 24 | __all__ = ["ServerSession"] | CODE |
| LOW | src/mcp/server/session.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | src/mcp/server/__init__.py | 7 | __all__ = ["CacheHint", "Server", "ServerRequestContext", "MCPServer", "NotificationOptions", "InitializationOptions"] | CODE |
| 59 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/shared/test_streamable_http.py | 1686 | except Exception: | CODE |
| LOW | tests/interaction/transports/_bridge.py | 148 | except Exception as exc: # The bridge is the application's outermost boundary: a crash | CODE |
| MEDIUM | docs/migration.md | 570 | print(f"Error: {e.error.message}") | CODE |
| MEDIUM | docs/migration.md | 581 | print(f"Error: {e.message}") | CODE |
| LOW | docs/migration.md | 1514 | except Exception as e: | CODE |
| MEDIUM | docs/migration.md | 1511 | def handle_call_tool(ctx, params) -> CallToolResult: | CODE |
| MEDIUM | examples/snippets/clients/url_elicitation_client.py | 78 | print("Error: No URL provided in elicitation request") | CODE |
| LOW | examples/snippets/clients/url_elicitation_client.py | 119 | except Exception as e: | CODE |
| LOW | examples/snippets/clients/url_elicitation_client.py | 133 | except Exception: | CODE |
| LOW | examples/snippets/clients/url_elicitation_client.py | 306 | except Exception as e: | CODE |
| MEDIUM | examples/snippets/clients/parsing_tool_results.py | 53 | print(f"Error: {content.text}") | CODE |
| MEDIUM | examples/snippets/servers/__init__.py | 36 | print(f"Error: Server '{server_name}' not found") | CODE |
| LOW | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 93 | except Exception as e: | CODE |
| LOW | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 152 | except Exception as e: | CODE |
| LOW | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 169 | except Exception as e: | CODE |
| LOW | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 279 | except Exception as e: | CODE |
| LOW | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 319 | except Exception as e: | CODE |
| LOW | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 335 | except Exception as e: | CODE |
| LOW | …ents/simple-auth-client/mcp_simple_auth_client/main.py | 245 | except Exception as e: | CODE |
| LOW | …ents/simple-auth-client/mcp_simple_auth_client/main.py | 286 | except Exception as e: | CODE |
| LOW | …ents/simple-auth-client/mcp_simple_auth_client/main.py | 306 | except Exception as e: | CODE |
| LOW | examples/stories/_harness.py | 200 | except Exception: | CODE |
| LOW | …vers/everything-server/mcp_everything_server/server.py | 212 | except Exception as e: | CODE |
| LOW | …vers/everything-server/mcp_everything_server/server.py | 234 | except Exception as e: | CODE |
| LOW | …vers/everything-server/mcp_everything_server/server.py | 266 | except Exception as e: | CODE |
| LOW | …vers/everything-server/mcp_everything_server/server.py | 325 | except Exception as e: | CODE |
| LOW | examples/servers/simple-auth/mcp_simple_auth/server.py | 156 | except Exception: | CODE |
| LOW | …/servers/simple-auth/mcp_simple_auth/token_verifier.py | 88 | except Exception as e: | CODE |
| MEDIUM | scripts/update_readme_snippets.py | 99 | print(f"Error: README file not found: {readme_path}") | CODE |
| LOW | scripts/docs/check_render_order.py | 98 | except Exception: | CODE |
| LOW | .github/actions/conformance/client.py | 367 | except Exception: | CODE |
| LOW | .github/actions/conformance/client.py | 395 | except Exception: | CODE |
| LOW | .github/actions/conformance/client.py | 612 | except Exception as e: | CODE |
| LOW | src/mcp/server/_otel.py | 56 | except Exception as e: | CODE |
| LOW | src/mcp/server/runner.py | 139 | except Exception: | CODE |
| LOW | src/mcp/server/runner.py | 286 | except Exception: | CODE |
| LOW | src/mcp/server/runner.py | 796 | except Exception as exc: | CODE |
| LOW | src/mcp/server/_streamable_http_modern.py | 141 | except Exception as exc: | CODE |
| LOW | src/mcp/server/_streamable_http_modern.py | 312 | except Exception: | CODE |
| LOW | src/mcp/server/_streamable_http_modern.py | 366 | except Exception: | CODE |
| LOW | src/mcp/server/request_state.py | 318 | except Exception: # deny-on-error: a raising principal binding must fail closed | CODE |
| LOW | src/mcp/server/request_state.py | 374 | except Exception: # deny-on-error: a buggy custom codec must fail closed | CODE |
| LOW | src/mcp/server/request_state.py | 452 | except Exception: # deny-on-error: a raising custom codec must not leak its failure | CODE |
| LOW | src/mcp/server/subscriptions.py | 113 | except Exception: # fan-out boundary: isolate listeners from each other | CODE |
| LOW | src/mcp/server/subscriptions.py | 137 | except Exception: # fan-out boundary: a raising bus must not skip stream cleanup | CODE |
| MEDIUM | src/mcp/server/streamable_http.py | 779 | def standalone_sse_writer(): | CODE |
| MEDIUM | src/mcp/server/streamable_http.py | 955 | def replay_sender(): | CODE |
| MEDIUM | src/mcp/server/streamable_http.py | 1056 | def message_router(): | CODE |
| LOW | src/mcp/server/streamable_http.py | 374 | except Exception: # pragma: lax no cover | CODE |
| LOW | src/mcp/server/streamable_http.py | 467 | except Exception: # pragma: no cover | CODE |
| LOW | src/mcp/server/streamable_http.py | 710 | except Exception: # pragma: lax no cover | CODE |
| LOW | src/mcp/server/streamable_http.py | 717 | except Exception as err: | CODE |
| LOW | src/mcp/server/streamable_http.py | 802 | except Exception: | CODE |
| LOW | src/mcp/server/streamable_http.py | 818 | except Exception: # pragma: lax no cover | CODE |
| LOW | src/mcp/server/streamable_http.py | 875 | except Exception as e: # pragma: no cover | CODE |
| LOW | src/mcp/server/streamable_http.py | 997 | except Exception: # pragma: lax no cover | CODE |
| LOW | src/mcp/server/streamable_http.py | 1009 | except Exception: # pragma: lax no cover | CODE |
| LOW | src/mcp/server/streamable_http.py | 1015 | except Exception: # pragma: lax no cover | CODE |
| LOW | src/mcp/server/streamable_http.py | 1113 | except Exception: # pragma: lax no cover | CODE |
| LOW | src/mcp/server/streamable_http.py | 1133 | except Exception as e: # pragma: no cover | CODE |
| 49 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | tests/server/test_request_state.py | 427 | '["client-123",null,null]', | CODE |
| HIGH⚡ | tests/server/test_request_state.py | 432 | '["client-123",null,"alice"]', | CODE |
| HIGH | tests/server/test_sse_security.py | 253 | body = b'{"jsonrpc": "2.0", "id": 1, "method": "ping", "params": null}' | CODE |
| HIGH | tests/server/test_streamable_http_modern.py | 834 | null, so header validation still runs and a mismatched header is still rejected.""" | STRING |
| HIGH | tests/server/mcpserver/test_func_metadata.py | 830 | # An optional key the tool leaves out is absent, not null, so it validates against the schema above | COMMENT |
| HIGH | tests/server/mcpserver/test_func_metadata.py | 155 | "my_model_b": '{"how_many_shrimp": 5, "ok": {"x": 1}, "y": null}', | CODE |
| HIGH | tests/server/mcpserver/test_tool_manager.py | 312 | {"tank": '{"x": null, "shrimp": [{"name": "rex"}, {"name": "gertrude"}]}'}, | CODE |
| HIGH⚡ | tests/shared/test_sse.py | 356 | json_message = '{"jsonrpc": "2.0", "id": "123", "method": "ping", "params": null}' | CODE |
| HIGH⚡ | tests/shared/test_sse.py | 360 | json_message = '{"jsonrpc": "2.0", "id": 123, "method": "ping", "params": null}' | CODE |
| HIGH | tests/shared/test_auth.py | 135 | # would send (an unregistered application_type, an explicit null, an auth method the SDK | COMMENT |
| HIGH⚡ | tests/shared/test_auth.py | 185 | """A server that dumps unset members as null, or echoes them as "", still yields a | STRING |
| HIGH⚡ | tests/shared/test_jsonrpc_dispatcher.py | 2031 | """Parse-error responses (id=null) have no waiter; they're dropped and the read loop stays healthy.""" | STRING |
| HIGH⚡ | tests/client/test_auth.py | 134 | b'"scopes_supported": null}' | CODE |
| HIGH | tests/client/test_auth.py | 1112 | b'"application_type": "confidential", "redirect_uris": null, ' | CODE |
| HIGH | examples/snippets/clients/url_elicitation_client.py | 289 | print("(Start server with: cd examples/snippets && uv run server elicitation sse)") | CODE |
| HIGH | examples/snippets/clients/url_elicitation_client.py | 305 | print(" cd examples/snippets && uv run server elicitation sse") | CODE |
| HIGH | src/mcp/shared/auth.py | 152 | # servers echo other strings or an explicit null; the value is informational here. | COMMENT |
| HIGH | src/mcp/shared/auth.py | 168 | # Servers dump unset members of their client record as null, or echo them as "", | COMMENT |
| HIGH | src/mcp/shared/uri_template.py | 233 | (RFC 6570 §2.3); if all are undefined, the expression contributes | STRING |
| HIGH | src/mcp-types/mcp_types/_v2026_07_28/__init__.py | 2972 | This can be any JSON value (object, array, string, number, boolean, or null). | STRING |
| HIGH | src/mcp-types/mcp_types/_v2026_07_28/__init__.py | 3026 | This can be any JSON value (object, array, string, number, boolean, or null) | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/interaction/transports/test_streamable_http.py | 221 | # Bounded because a harness regression here historically meant deadlock, not failure. | COMMENT |
| MEDIUM | examples/stories/manifest.toml | 84 | # A per-client fresh target over a real ASGI transport is harness machinery, not user | COMMENT |
| MEDIUM⚡ | .github/workflows/conformance.yml | 17 | # Pinned conformance harness package spec (passed verbatim to `npx --yes`). | COMMENT |
| MEDIUM⚡ | .github/workflows/conformance.yml | 23 | # `--spec-version <rev>` legs run every scenario the pinned harness marks | COMMENT |
| MEDIUM⚡ | .github/workflows/conformance.yml | 30 | # every shipped scenario at whichever wire the harness defaults it to; it is | COMMENT |
| MEDIUM | .github/workflows/conformance.yml | 102 | # The harness runs a leg's scenarios via unbounded Promise.all; under | COMMENT |
| MEDIUM | .github/actions/conformance/run-client.sh | 28 | # If the harness's summary wording changes, the list comes up empty and the | COMMENT |
| MEDIUM⚡ | .github/actions/conformance/client.py | 69 | #: Spec version the harness is running this scenario at (e.g. "2025-11-25", | COMMENT |
| MEDIUM⚡ | .github/actions/conformance/client.py | 70 | #: "2026-07-28"). The harness always sets this (when --spec-version is omitted | COMMENT |
| MEDIUM⚡ | .github/actions/conformance/client.py | 73 | #: outside the harness. | COMMENT |
| MEDIUM | .github/actions/conformance/client.py | 515 | # The harness does not put the issuer in context, so for conformance we | COMMENT |
| MEDIUM | .github/actions/conformance/client.py | 516 | # learn it from the harness's PRM document (RFC 9728); production | COMMENT |
| MEDIUM⚡ | …b/actions/conformance/expected-failures.2026-07-28.yml | 3 | # harness marks applicable at 2026-07-28, run stateless with per-request _meta. | COMMENT |
| MEDIUM⚡ | …b/actions/conformance/expected-failures.2026-07-28.yml | 12 | # keyed by scenario name only: a scenario that passes at the harness default | COMMENT |
| MEDIUM⚡ | …b/actions/conformance/expected-failures.2026-07-28.yml | 17 | # Baseline established against the harness pinned via CONFORMANCE_PKG in | COMMENT |
| MEDIUM⚡ | …b/actions/conformance/expected-failures.2025-11-25.yml | 3 | # harness marks applicable at 2025-11-25, run over the stateful handshake. | COMMENT |
| MEDIUM⚡ | …b/actions/conformance/expected-failures.2025-11-25.yml | 12 | # legs currently run these same scenarios at 2025-11-25 too: the harness's | COMMENT |
| MEDIUM⚡ | …b/actions/conformance/expected-failures.2025-11-25.yml | 16 | # re-verification off the harness's baseline output. | COMMENT |
| MEDIUM⚡ | …b/actions/conformance/expected-failures.2025-11-25.yml | 18 | # Baseline established against the harness pinned via CONFORMANCE_PKG in | COMMENT |
| MEDIUM | .github/actions/conformance/expected-failures.yml | 3 | # pinned harness, each at the harness's default wire for it). CI exits 0 if only | COMMENT |
| MEDIUM | .github/actions/conformance/expected-failures.yml | 10 | # Baseline established against the harness pinned via CONFORMANCE_PKG in | COMMENT |
| MEDIUM | .github/actions/conformance/expected-failures.yml | 43 | # `tasks-status-notifications` is intentionally NOT listed: the harness | COMMENT |
| LOW | src/mcp/server/auth/handlers/authorize.py | 111 | # if the redirect URI is invalid, ignore it & just return the | COMMENT |
| LOW | src/mcp/server/auth/handlers/revoke.py | 74 | # if token is not found, just return HTTP 200 per the RFC | COMMENT |
| LOW | src/mcp/server/mcpserver/utilities/func_metadata.py | 324 | # This raise could perhaps be skipped, and we (MCPServer) just call | COMMENT |
| LOW | src/mcp/cli/cli.py | 53 | return "npx" # On Unix-like systems, just use npx | CODE |
| MEDIUM | src/mcp/client/session_group.py | 315 | # Create read and write streams that facilitate io with the server. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 35 | Load server configuration from JSON file. Args: file_path: Path to the JSON configuration file. | STRING |
| HIGH | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 126 | Execute a tool with retry mechanism. Args: tool_name: Name of the tool to execute. argu | STRING |
| HIGH | src/mcp/server/session.py | 257 | Send a sampling/create_message request. Args: messages: The conversation messages to send. | STRING |
| HIGH | src/mcp/server/session.py | 357 | Send a form mode elicitation/create request. Args: message: The message to present to the user. | STRING |
| HIGH | src/mcp/server/session.py | 389 | Send a URL mode elicitation/create request. This directs the user to an external URL for out-of-band interactio | STRING |
| HIGH | src/mcp/server/auth/provider.py | 174 | Handle the /authorize endpoint and return a URL that the client will be redirected to. Many MCP impleme | STRING |
| HIGH | src/mcp/server/auth/provider.py | 233 | Exchanges an authorization code for an access token and refresh token. Args: client: The client exc | STRING |
| HIGH | src/mcp/server/auth/provider.py | 265 | Exchanges a refresh token for an access token and refresh token. Implementations SHOULD rotate both the access | STRING |
| HIGH | src/mcp/server/auth/provider.py | 313 | Exchanges an Identity Assertion Authorization Grant (ID-JAG) for an access token. This is leg 2 of SEP-990: the | STRING |
| HIGH | src/mcp/server/auth/middleware/client_auth.py | 40 | Authenticate a client from an HTTP request. Extracts client credentials from the appropriate location based on | STRING |
| HIGH | src/mcp/server/mcpserver/context.py | 159 | Read a resource by URI. This is a content reader: an `InputRequiredResult` returned by a resource templ | STRING |
| HIGH | src/mcp/shared/path_security.py | 122 | Join path components onto a base, rejecting escapes. Resolves the joined path and verifies it remains within ``base | STRING |
| HIGH | src/mcp/shared/uri_template.py | 401 | Expand the template by substituting variable values. String values are percent-encoded according to their opera | STRING |
| HIGH | src/mcp/client/client.py | 638 | Read a resource from the server. If the server returns an `InputRequiredResult`, the embedded input req | STRING |
| HIGH | src/mcp/client/client.py | 767 | Call a tool on the server. If the server returns an `InputRequiredResult`, the embedded input requests | STRING |
| HIGH | src/mcp/client/client.py | 878 | Get a prompt from the server. If the server returns an `InputRequiredResult`, the embedded input reques | STRING |
| HIGH | src/mcp/client/auth/oauth2.py | 238 | Prepare authentication for token requests. Args: data: The form data to send headers: O | STRING |
| HIGH | src/mcp/client/auth/utils.py | 424 | Parse and validate a token response. Parses token response JSON. Callers should check response.status_code before c | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/transports/stdio/test_windows.py | 39 | CODE | |
| LOW | tests/server/test_stdio.py | 218 | CODE | |
| LOW | tests/server/test_stdio.py | 444 | CODE | |
| LOW | tests/server/test_streamable_http_manager.py | 213 | CODE | |
| LOW | tests/server/test_streamable_http_manager.py | 269 | CODE | |
| LOW | tests/server/mcpserver/test_integration.py | 63 | CODE | |
| LOW | tests/shared/test_streamable_http.py | 210 | CODE | |
| LOW | tests/shared/test_uri_template.py | 934 | CODE | |
| LOW | tests/examples/test_story_shape.py | 39 | CODE | |
| LOW | tests/client/test_session_group.py | 322 | CODE | |
| LOW | examples/snippets/clients/url_elicitation_client.py | 236 | CODE | |
| LOW | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 282 | CODE | |
| LOW | …ples/clients/simple-chatbot/mcp_simple_chatbot/main.py | 329 | CODE | |
| LOW | …ents/simple-auth-client/mcp_simple_auth_client/main.py | 269 | CODE | |
| LOW | …ents/simple-auth-client/mcp_simple_auth_client/main.py | 289 | CODE | |
| LOW | …ents/simple-auth-client/mcp_simple_auth_client/main.py | 309 | CODE | |
| LOW | …ervers/sse-polling-demo/mcp_sse_polling_demo/server.py | 60 | CODE | |
| LOW | scripts/update_readme_snippets.py | 31 | CODE | |
| LOW | scripts/docs/llms_txt.py | 123 | CODE | |
| LOW | scripts/docs/translations.py | 955 | CODE | |
| LOW | scripts/docs/check_render_order.py | 72 | CODE | |
| LOW | src/mcp/server/runner.py | 662 | CODE | |
| LOW | src/mcp/server/_streamable_http_modern.py | 264 | CODE | |
| LOW | src/mcp/server/_streamable_http_modern.py | 375 | CODE | |
| LOW | src/mcp/server/streamable_http.py | 558 | CODE | |
| LOW | src/mcp/server/streamable_http.py | 930 | CODE | |
| LOW | src/mcp/server/streamable_http.py | 1025 | CODE | |
| LOW | src/mcp/server/streamable_http.py | 955 | CODE | |
| LOW | src/mcp/server/streamable_http.py | 1056 | CODE | |
| LOW | src/mcp/server/auth/handlers/authorize.py | 66 | CODE | |
| LOW | src/mcp/server/mcpserver/resolve.py | 516 | CODE | |
| LOW | src/mcp/server/mcpserver/utilities/func_metadata.py | 480 | CODE | |
| LOW | src/mcp/server/mcpserver/utilities/context_injection.py | 13 | CODE | |
| LOW | src/mcp/server/mcpserver/prompts/base.py | 158 | CODE | |
| LOW | src/mcp/shared/jsonrpc_dispatcher.py | 319 | CODE | |
| LOW | src/mcp/shared/jsonrpc_dispatcher.py | 721 | CODE | |
| LOW | src/mcp/shared/uri_template.py | 228 | CODE | |
| LOW | src/mcp/shared/uri_template.py | 611 | CODE | |
| LOW | src/mcp/shared/uri_template.py | 878 | CODE | |
| LOW | src/mcp/shared/uri_template.py | 924 | CODE | |
| LOW | src/mcp/shared/uri_template.py | 969 | CODE | |
| LOW | src/mcp/shared/uri_template.py | 459 | CODE | |
| LOW | src/mcp/shared/inbound.py | 120 | CODE | |
| LOW | src/mcp/shared/_httpx_utils.py | 206 | CODE | |
| LOW | src/mcp/shared/direct_dispatcher.py | 233 | CODE | |
| LOW | src/mcp/cli/cli.py | 119 | CODE | |
| LOW | src/mcp/cli/cli.py | 361 | CODE | |
| LOW | src/mcp/client/streamable_http.py | 363 | CODE | |
| LOW | src/mcp/client/streamable_http.py | 609 | CODE | |
| LOW | src/mcp/client/_probe.py | 52 | CODE | |
| LOW | src/mcp/client/stdio.py | 115 | CODE | |
| LOW | src/mcp/client/stdio.py | 142 | CODE | |
| LOW | src/mcp/client/auth/oauth2.py | 604 | CODE | |
| LOW | src/mcp/client/auth/extensions/identity_assertion.py | 163 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/server/mcpserver/auth/test_auth_integration.py | 124 | # Check if refresh token exists | COMMENT |
| LOW⚡ | tests/server/mcpserver/auth/test_auth_integration.py | 129 | # Check if the access token exists | COMMENT |
| LOW⚡ | tests/server/mcpserver/auth/test_auth_integration.py | 132 | # Check if the token was issued to this client | COMMENT |
| LOW | tests/server/mcpserver/auth/test_auth_integration.py | 167 | # Check if token is expired | COMMENT |
| LOW | examples/snippets/clients/url_elicitation_client.py | 155 | # Check if the tool returned an error in the result | COMMENT |
| LOW | examples/snippets/clients/url_elicitation_client.py | 163 | # Check if this is a URL elicitation required error | COMMENT |
| LOW | examples/snippets/clients/pagination_client.py | 29 | # Check if there are more pages | COMMENT |
| LOW | examples/snippets/servers/elicitation.py | 35 | # Check if date is available | COMMENT |
| LOW | …rs/simple-auth/mcp_simple_auth/simple_auth_provider.py | 248 | # Check if expired | COMMENT |
| LOW | src/mcp/server/transport_security.py | 65 | # Check if the actual host starts with base host and has a port | COMMENT |
| LOW | src/mcp/server/transport_security.py | 87 | # Check if the actual origin starts with base origin and has a port | COMMENT |
| LOW⚡ | src/mcp/server/streamable_http.py | 598 | # Check if this is an initialization request | COMMENT |
| LOW⚡ | src/mcp/server/streamable_http.py | 602 | # Check if the server already has an established session | COMMENT |
| LOW⚡ | src/mcp/server/streamable_http.py | 604 | # Check if request has a session ID | COMMENT |
| LOW | src/mcp/server/streamable_http.py | 767 | # Check if we already have an active GET stream | COMMENT |
| LOW | src/mcp/server/streamable_http.py | 1062 | # Check if this is a response with a known request id. | COMMENT |
| LOW | src/mcp/server/mcpserver/server.py | 718 | # Check if user passed function directly instead of calling decorator | COMMENT |
| LOW | src/mcp/server/mcpserver/server.py | 859 | # Check if user passed function directly instead of calling decorator | COMMENT |
| LOW | src/mcp/server/mcpserver/server.py | 1017 | # Check if user passed function directly instead of calling decorator | COMMENT |
| LOW | src/mcp/server/mcpserver/utilities/func_metadata.py | 342 | # Check if the parameter name conflicts with BaseModel attributes | COMMENT |
| LOW | src/mcp/client/streamable_http.py | 632 | # Check if this is a resumption request | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/client/test_stdio.py | 142 | CODE | |
| LOW | tests/client/test_caching.py | 303 | CODE | |
| LOW | tests/interaction/_connect.py | 82 | CODE | |
| LOW | tests/interaction/_connect.py | 119 | CODE | |
| LOW | tests/interaction/_connect.py | 183 | CODE | |
| LOW | tests/interaction/_connect.py | 364 | CODE | |
| LOW | tests/interaction/_connect.py | 64 | CODE | |
| LOW | tests/interaction/auth/_harness.py | 408 | CODE | |
| LOW | src/mcp/server/session.py | 183 | CODE | |
| LOW | src/mcp/server/session.py | 203 | CODE | |
| LOW | src/mcp/server/session.py | 223 | CODE | |
| LOW | src/mcp/server/session.py | 242 | CODE | |
| LOW | src/mcp/server/streamable_http_manager.py | 86 | CODE | |
| LOW | src/mcp/server/lowlevel/server.py | 131 | CODE | |
| LOW | src/mcp/server/lowlevel/server.py | 215 | CODE | |
| LOW | src/mcp/server/lowlevel/server.py | 308 | CODE | |
| LOW | src/mcp/server/lowlevel/server.py | 732 | CODE | |
| LOW | src/mcp/server/mcpserver/server.py | 158 | CODE | |
| LOW | src/mcp/server/mcpserver/server.py | 387 | CODE | |
| LOW | src/mcp/server/mcpserver/server.py | 788 | CODE | |
| LOW | src/mcp/server/mcpserver/server.py | 1113 | CODE | |
| LOW | src/mcp/server/mcpserver/server.py | 1288 | CODE | |
| LOW | src/mcp/server/mcpserver/resolve.py | 131 | CODE | |
| LOW | src/mcp/server/mcpserver/tools/base.py | 65 | CODE | |
| LOW | src/mcp/server/mcpserver/resources/resource_manager.py | 60 | CODE | |
| LOW | src/mcp/server/mcpserver/resources/templates.py | 122 | CODE | |
| LOW | src/mcp/shared/peer.py | 89 | CODE | |
| LOW | src/mcp/shared/peer.py | 107 | CODE | |
| LOW | src/mcp/shared/peer.py | 125 | CODE | |
| LOW | src/mcp/shared/peer.py | 142 | CODE | |
| LOW | src/mcp/client/session.py | 404 | CODE | |
| LOW | src/mcp/client/session.py | 993 | CODE | |
| LOW | src/mcp/client/session.py | 1052 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/server/mcpserver/auth/test_auth_integration.py | 561 | # Step 1: First, let's create a token and refresh token at the current time | COMMENT |
| LOW | tests/server/mcpserver/auth/test_auth_integration.py | 580 | # Step 2: Time travel forward 4 hours (tokens expire in 1 hour by default) | COMMENT |
| LOW | .claude/commands/review-pr.md | 5 | ## Step 1: Resolve the PR | COMMENT |
| LOW | .claude/commands/review-pr.md | 20 | ## Step 2: Gather the diff | COMMENT |
| LOW | .claude/commands/review-pr.md | 30 | ## Step 3: Collect PR discussion context | COMMENT |
| LOW | .claude/commands/review-pr.md | 47 | ## Step 4: Find and read linked issues | COMMENT |
| LOW | .claude/commands/review-pr.md | 63 | ## Step 5: Analyze and validate | COMMENT |
| LOW | .claude/commands/review-pr.md | 75 | ## Step 6: Produce the review summary | COMMENT |
| LOW | examples/servers/simple-auth/README.md | 9 | ### Step 1: Start Authorization Server | COMMENT |
| LOW | examples/servers/simple-auth/README.md | 27 | ### Step 2: Start Resource Server (MCP Server) | COMMENT |
| LOW | examples/servers/simple-auth/README.md | 41 | ### Step 3: Test with Client | COMMENT |
| LOW⚡ | src/mcp/client/auth/oauth2.py | 784 | # Step 5: Perform authorization and complete token exchange | COMMENT |
| LOW | src/mcp/client/auth/oauth2.py | 645 | # Step 1: Discover protected resource metadata (SEP-985 with fallback support) | COMMENT |
| LOW | src/mcp/client/auth/oauth2.py | 700 | # Step 2: Discover OAuth Authorization Server Metadata (OASM) (with fallback for legacy servers) | COMMENT |
| LOW | src/mcp/client/auth/oauth2.py | 722 | # Step 3: Apply scope selection strategy | COMMENT |
| LOW | src/mcp/client/auth/oauth2.py | 738 | # Step 4: Register client or use URL-based client ID (CIMD) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | pyproject.toml | 81 | ] | COMMENT |
| LOW | tests/shared/test_uri_template.py | 681 | ("file://{+path}", "http://x"), | COMMENT |
| LOW | tests/shared/test_uri_template.py | 881 | # The two tests below generate template strings instead of enumerating | COMMENT |
| LOW | examples/snippets/servers/streamable_config.py | 21 | mcp.run(transport="streamable-http", stateless_http=True, json_response=True) | COMMENT |
| LOW | scripts/build-docs.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/serve-docs.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/docs/llms_txt.py | 41 | "mcp-types API reference", | COMMENT |
| LOW | scripts/docs/llms_txt.py | 61 | # Block HTML comments are inert in rendered output: python-markdown passes | COMMENT |
| LOW | scripts/docs/gen_ref_pages.py | 21 | # A MkDocs/Zensical nav is a list of entries, each either `{title: url}` for a | COMMENT |
| LOW | scripts/docs/build.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/docs/build.sh | 41 | uv run --frozen --no-sync zensical build -f mkdocs.gen.yml --strict | COMMENT |
| LOW | .github/workflows/require-linked-issue.yml | 1 | # PR intake gate — see CONTRIBUTING.md ("How pull requests get in") for the | COMMENT |
| LOW | .github/workflows/conformance.yml | 21 | COMMENT | |
| LOW | .github/workflows/docs-preview.yml | 1 | name: Docs Preview | COMMENT |
| LOW | .github/scripts/pr_intake_gate.js | 1 | // PR intake gate. The policy lives in CONTRIBUTING.md ("How pull requests get | COMMENT |
| LOW | …b/actions/conformance/expected-failures.2026-07-28.yml | 1 | # Expected failures at the 2026-07-28 wire, read by the `--suite all | COMMENT |
| LOW | …b/actions/conformance/expected-failures.2025-11-25.yml | 1 | # Expected failures at the 2025-11-25 wire, read by the `--suite all | COMMENT |
| LOW | .github/actions/conformance/expected-failures.yml | 1 | # Conformance scenarios not yet passing against the Python SDK on main, read by | COMMENT |
| LOW | src/mcp/server/runner.py | 221 | # Shape for the wire inside the chain so the OpenTelemetry span (the | COMMENT |
| LOW | src/mcp/server/streamable_http.py | 61 | # Special key for the standalone GET stream | COMMENT |
| LOW | src/mcp/server/auth/handlers/authorize.py | 81 | # 1. The request has a valid client ID & redirect_uri: we issue a redirect | COMMENT |
| LOW | src/mcp/server/lowlevel/server.py | 441 | self._session_manager: StreamableHTTPSessionManager | None = None | COMMENT |
| LOW | src/mcp/shared/jsonrpc_dispatcher.py | 741 | finally: | COMMENT |
| LOW | src/mcp/shared/uri_template.py | 1081 | if atom.ifemp: | COMMENT |
| LOW | src/mcp/shared/inbound.py | 81 | Shared by client emit (which header to send) and server validate (which body | COMMENT |
| LOW | src/mcp/client/session.py | 161 | def stamp(data: dict[str, Any], opts: CallOptions) -> None: | COMMENT |
| LOW | src/mcp/client/auth/oauth2.py | 61 | from mcp.shared.inbound import MCP_PROTOCOL_VERSION_HEADER | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/server/mcpserver/auth/test_auth_integration.py | 561 | # Step 1: First, let's create a token and refresh token at the current time | COMMENT |
| LOW | tests/server/mcpserver/auth/test_auth_integration.py | 580 | # Step 2: Time travel forward 4 hours (tokens expire in 1 hour by default) | COMMENT |
| LOW | src/mcp/server/auth/middleware/client_auth.py | 88 | # form_data.get() can return an UploadFile or None, so we need to check if it's a string | COMMENT |
| LOW⚡ | src/mcp/client/auth/oauth2.py | 784 | # Step 5: Perform authorization and complete token exchange | COMMENT |
| LOW | src/mcp/client/auth/oauth2.py | 645 | # Step 1: Discover protected resource metadata (SEP-985 with fallback support) | COMMENT |
| LOW | src/mcp/client/auth/oauth2.py | 700 | # Step 2: Discover OAuth Authorization Server Metadata (OASM) (with fallback for legacy servers) | COMMENT |
| LOW | src/mcp/client/auth/oauth2.py | 722 | # Step 3: Apply scope selection strategy | COMMENT |
| LOW | src/mcp/client/auth/oauth2.py | 738 | # Step 4: Register client or use URL-based client ID (CIMD) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/server/mcpserver/test_func_metadata.py | 1179 | return PersonWithAddress(name="Jack", address=Address(street="123 Main St", city="Anytown", zipcode="12345")) | CODE |
| LOW⚡ | tests/server/mcpserver/test_server.py | 536 | assert result.structured_content == {"name": "John Doe", "age": 30, "active": True} | CODE |
| LOW⚡ | tests/server/mcpserver/test_server.py | 540 | assert '"name": "John Doe"' in result.content[0].text | CODE |
| LOW | tests/server/mcpserver/test_server.py | 518 | return UserOutput(name="John Doe", age=30) | CODE |
| LOW | tests/server/mcpserver/test_elicitation.py | 166 | {"required_name": "John Doe", "optional_age": 30, "optional_email": "john@example.com", "subscribe": True}, | CODE |
| LOW⚡ | tests/shared/test_auth.py | 179 | @pytest.mark.parametrize("placeholder", [None, ""], ids=["null", "empty-string"]) | CODE |
| LOW | …vers/everything-server/mcp_everything_server/server.py | 241 | name: str = Field(default="John Doe", description="User name") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | examples/servers/simple-auth/mcp_simple_auth/server.py | 6 | NOTE: this is a simplified example for demonstration purposes. | STRING |
| MEDIUM | …rs/simple-auth/mcp_simple_auth/simple_auth_provider.py | 4 | for demonstration purposes. No external authentication provider is required. | STRING |
| MEDIUM | …rs/simple-auth/mcp_simple_auth/simple_auth_provider.py | 6 | NOTE: this is a simplified example for demonstration purposes. | STRING |
| MEDIUM | …les/servers/simple-auth/mcp_simple_auth/auth_server.py | 6 | NOTE: this is a simplified example for demonstration purposes. | STRING |
| MEDIUM | …ervers/simple-auth/mcp_simple_auth/legacy_as_server.py | 6 | NOTE: this is a simplified example for demonstration purposes. | STRING |
| MEDIUM | …/servers/simple-auth/mcp_simple_auth/token_verifier.py | 15 | This is a simple example implementation for demonstration purposes. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/server/mcpserver/test_tool_manager.py | 630 | def process_data(input_data: str) -> str: # pragma: no cover | CODE |
| LOW | examples/snippets/servers/notifications.py | 7 | async def process_data(data: str, ctx: Context) -> str: | CODE |
| LOW | …amples/snippets/servers/streamable_http_path_config.py | 17 | def process_data(data: str) -> str: | CODE |
| LOW | src/mcp/server/streamable_http.py | 474 | async def handle_request(self, scope: Scope, receive: Receive, send: Send) -> None: | CODE |
| LOW | src/mcp/server/streamable_http_manager.py | 176 | async def handle_request(self, scope: Scope, receive: Receive, send: Send) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/build-docs.sh | 20 | # Usage: | COMMENT |
| LOW | scripts/serve-docs.sh | 12 | # Usage: | COMMENT |
| LOW | scripts/docs/build.sh | 22 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/server/test_streamable_http_manager.py | 749 | CODE |