The MCP Python SDK stopped following cross-origin redirects that carried your auth headers to another host.

PR #3448, merged September 4, backports #3397 to the v1.x line: streamable_http_client, streamablehttp_client, sse_client and OAuthClientProvider now follow a redirect only when it stays on the endpoint's origin, keeps the method, and carries no userinfo. Before this, the default client from create_mcp_http_client followed every redirect, so a Location naming another host moved the connection there with headers, auth and body attached. Breaking: a cross-origin redirect or a 301/302/303 answering a POST now raises httpx.HTTPStatusError, and follow_redirects=True on a caller-supplied client is no longer consulted (GitHub).