# Changelog

## Score

- CAI 75 → 63 (-12.4)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 86 → 73 (-12.7)
- Architecture 85 → 85 (+0.0)
- Maturity 79 → 51 (-27.6)
- Readiness 65 → 65 (+0.0)
- Security 87 → 77 (-9.7)
- Performance 100 → 100 (+0.0)

## Resolved (9)

- Critical CVE: [GHSA redacted] (uv.lock)
- High CVE: [GHSA redacted] (uv.lock)
- High CVE: [GHSA redacted] (uv.lock)
- Hotspot: src/mcp/client/streamable_http.py (src/mcp/client/streamable_http.py)
- Hotspot: src/mcp/server/mcpserver/resolve.py (src/mcp/server/mcpserver/resolve.py)
- Inconsistent parameter naming for pagination. The `list_*` methods on `ClientSession` use a single `params` argument of type `PaginatedRequestParams`, whereas the corresponding methods on the `Client` wrapper class use distinct `cursor` and `meta` arguments. This forces users to know which layer they are interacting with to construct the correct arguments.
- Medium CVE: PYSEC-2026-2132 (uv.lock)
- Off-boarding risk: anonymized user #1
- Signature drift between wrapper and core session. While both `Client` and `ClientSession` have `call_tool`, the `Client` version includes `cache_mode: CacheMode` which is absent in the `ClientSession` version. This creates a confusing split where high-level convenience methods have different capabilities/signatures than the underlying session methods.

## New (10)

- Duplicate intent with inconsistent signatures. `send_discover` exposes the raw protocol method and returns a generic dict, while `discover` is a typed wrapper returning `DiscoverResult`. The presence of `send_discover` suggests a lower-level transport method that duplicates the higher-level `discover` functionality, potentially confusing users about which to use for standard discovery.
- Hotspot: src/mcp/client/client.py (src/mcp/client/client.py)
- Hotspot: src/mcp/server/_streamable_http_modern.py (src/mcp/server/_streamable_http_modern.py)
- Inconsistent parameter sets for the same logical operation. `Client.read_resource` includes a `cache_mode` argument, while `ClientSession.read_resource` does not. This forces users to know whether they are using the high-level `Client` or low-level `Session` to understand caching behavior, and makes the signatures non-interchangeable even though `Client` delegates to `Session`.
- Off-boarding risk: anonymized user #1
- Orphaned file (src/mcp/server/auth/handlers/revoke.py)
- Orphaned file (src/mcp/server/auth/middleware/client_auth.py)
- Orphaned file (src/mcp/shared/auth_utils.py)
- Orphaned files with no living knowledge
- Signature drift between Client and ClientSession. The listing shows multiple overloaded signatures for `call_tool` in `ClientSession` (likely due to overloads for different input/response handling), but the `Client` wrapper signature appears to differ slightly in parameter handling (e.g., `cache_mode` or `input_responses` handling). This creates confusion about the exact contract when switching between the high-level Client and low-level Session.

## Changes since last survey

- 11 commits — 11 feature/other, 0 fixes

## By area

- src/mcp — 4 commits
- (root) — 3 commits
- .github/workflows — 2 commits
- examples/clients — 1 commit
- examples/servers — 1 commit

## Notable commits

- change: Add `Skills` extension (#3485)
- change: Add cache fields to directory read and `_meta` to `Skill` (#3719)
- change: Add support for Python 3.15 (#3688)
- change: Bump pyjwt from 2.13.0 to 2.15.0 (#3608)
- change: Drop support for Python 3.10 (#3690)
- change: Give each SSE response its own header list (#3726)
- change: Read MCP Apps tool results from notification params (#3679)
- change: Remove unused chatbot stdio context attribute (#3678)
- change: Return invalid params for unknown prompts and missing arguments (#3696)
- change: Update httpx2 and datamodel-code-generator (#3645)
- change: Update uv to 0.12.24 across the project (#3689)

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)