Origin-only redirect following; 30-minute idle session expiry on legacy Streamable HTTP; 10k session cap; OAuth issuer match on the legacy path. Docs: py.sdk.modelcontextprotocol.io. Twin defaults on 1.30.0.12
One issue every weekday. The whole thing, not a teaser.