Python SDK 2.1.0 and 1.29.1 extend the request body limit to SSE and OAuth endpoints and keep crash detail off the wire

The official Python SDK shipped two releases on 2026-08-24: v2.1.0 on the current line and v1.29.1 on the v1.x maintenance line. The change common to both is a widening of the SDK's request size defense: the 4 MiB request body limit, which previously covered the streamable HTTP transport, now also applies to the SSE transport and the OAuth endpoints, and the SSE message endpoint answers 405 to anything other than POST. SseServerTransport and MCPServer.sse_app() take a max_request_body_size argument for tuning the ceiling.

v2.1.0 also changes what a connected client learns when a handler crashes. An unexpected exception from a tool, resource or prompt handler is now logged once at ERROR with its traceback on the server, while the client sees only a generic message of the form "Error executing tool " rather than the exception text. Errors meant for the model still flow through: raising ToolError or ResourceError delivers the message to the client as before.

Two wire-level fixes land for the 2026-07-28 revision. A POSTed notification such as notifications/cancelled is acknowledged with HTTP 202 instead of being rejected with 400, and sessions negotiated at earlier revisions now ignore cache-hint fields introduced later instead of failing list_tools(). One behavior change deserves attention from server authors: a tool annotated to return content blocks such as TextContent or EmbeddedResource no longer advertises an outputSchema or returns structuredContent, unless structured_output=True is passed to keep the previous shape.