MCP Python SDK backports security fixes to 1.x

The Model Context Protocol Python SDK backported its 2.x security defaults into the 1.x branch within two hours, per the release notes. Version 1.30.0 adds a 30-minute idle session expiry and caps concurrent sessions at 10,000. It also restricts redirects to the requesting origin and rejects authorization server metadata when the issuer doesn't match what the client expects.

Pinning to 1.x no longer avoids the 2.x defaults. Anyone who stayed on the older API to dodge the stricter session handling now hits the same 30-minute expiry and 10,000-session cap. The origin-scoped redirect restriction and the issuer-mismatch rejection come with it.

One piece of 1.30.0 doesn't have a 2.x match yet. Client registrations are now remembered per issuer. A server that later points at a different authorization server triggers a fresh registration instead of reusing the old one. Anything that rotates or migrates its authorization provider hits that path first on 1.x. The release notes don't say whether 2.x handles it the same way.