Infra2026-09-01 · source-backed

MCP Rust SDK 3.2.0 stopped concurrent clients racing each other's OAuth refreshes.

Issue

2026-09-01

Confidence

source-backed

Sources

Redaction

redacted

Story

rmcp v3.2.0 routes refreshes through credential stores rather than letting each client refresh independently, and adds request-state key rotation (GitHub). Three transport fixes matter more day to day: initialize is kept on legacy protocol versions, sessionless HTTP discovery rejections now fall back instead of failing, and concurrent streamable HTTP requests are allowed, so a single Rust MCP server no longer serializes its streamable HTTP clients.

Source trail

modelcontextprotocol/rust-sdk More from github.com

Entities

GitHub HTTP MCP Rust SDK OAuth Rust MCP

Provenance

Canonical issue: Ramsay Research Agent — September 1, 2026
AI generated: no
Story unit: 2026-09-01-mcp-rust-sdk-3-2-0-stopped-concurrent-clients-racing-each-other-s-oauth-refreshes
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

MCP Rust SDK 3.2.0 stopped concurrent clients racing each other's OAuth refreshes.

Story

Related stories

gemini-cli now blocks SSRF through MCP OAuth discovery, including DNS rebinding.

The Code Editor Is Dead. Three Platforms Buried It in the Same Week.

Agent Plugins 1.0 went GA — and a lab outside the authoring group shipped support the same week

agentmemory puts a dollar figure on memory architecture: ~$10/year vs ~$500/year.

The Claude Code Field Guide Hit 53,400 Stars. Here's Why That Matters.

The LiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months later

Source trail

Entities

Provenance

MCP Rust SDK 3.2.0 stopped concurrent clients racing each other's OAuth refreshes.

Story

Related stories

gemini-cli now blocks SSRF through MCP OAuth discovery, including DNS rebinding.

The Code Editor Is Dead. Three Platforms Buried It in the Same Week.

Agent Plugins 1.0 went GA — and a lab outside the authoring group shipped support the same week

agentmemory puts a dollar figure on memory architecture: ~$10/year vs ~$500/year.

The Claude Code Field Guide Hit 53,400 Stars. Here's Why That Matters.

The LiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months later

Source trail

Entities

Provenance

Story

Related stories

gemini-cli now blocks SSRF through MCP OAuth discovery, including DNS rebinding.

The Code Editor Is Dead. Three Platforms Buried It in the Same Week.

Agent Plugins 1.0 went GA — and a lab outside the authoring group shipped support the same week

agentmemory puts a dollar figure on memory architecture: ~$10/year vs ~$500/year.

The Claude Code Field Guide Hit 53,400 Stars. Here's Why That Matters.

The LiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months later

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance

Story

Related stories

gemini-cli now blocks SSRF through MCP OAuth discovery, including DNS rebinding.

The Code Editor Is Dead. Three Platforms Buried It in the Same Week.

Agent Plugins 1.0 went GA — and a lab outside the authoring group shipped support the same week

agentmemory puts a dollar figure on memory architecture: ~$10/year vs ~$500/year.

The Claude Code Field Guide Hit 53,400 Stars. Here's Why That Matters.

The LiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months later

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance