MCP Rust SDK 3.2.0 coordinates OAuth refreshes through credential stores so concurrent clients stop racing each other's tokens

GitHub·medium signalXBlueskyLinkedInCopy link

rmcp v3.2.0 shipped 2026-08-31 with PR #1232 routing OAuth refreshes through credential stores rather than letting each client refresh independently, plus request-state key rotation from PR #1128. Three fixes address real transport breakage: initialize is kept on legacy protocol versions (#1228), sessionless HTTP discover rejections now fall back instead of failing (#1211), and concurrent streamable HTTP requests are allowed (#1186). The concurrency fix in particular means a single Rust MCP server no longer serializes streamable HTTP clients.