Evidence · DiggingBeagle record
MCP Python SDK deprecated WebSocket transport lacked Host and Origin validation
Maintainer advisory for the deprecated WebSocket helper. Version 1.28.1 introduces validation support, but applications must explicitly provide the security settings. The advisory excludes FastMCP and the other listed transports.
- Published
- Jul 7, 2026
- Accessed
- Oct 1, 2026
- Publisher
- Model Context Protocol Python SDK
- Source role
- primary disclosure
- Version
- 2026-07-07
- Rights
- Public web source; citation and short excerpt/paraphrase only.
Evidence record
Maintainer advisory for the deprecated WebSocket helper. Version 1.28.1 introduces validation support, but applications must explicitly provide the security settings. The advisory excludes FastMCP and the other listed transports.
Claim-level citations (4)
- supportsA deprecated MCP WebSocket transport trusted the browser origin: Version 1.28.1 adds optional Host/Origin validation for the deprecated WebSocket helper; the advisory lists it as patched but says applications must explicitly enable the settings.
Patched versions
- supportsA deprecated MCP WebSocket transport trusted the browser origin: The advisory says the affected WebSocket transport was deprecated, not part of the MCP specification and not reachable through FastMCP; stdio, SSE and Streamable HTTP were not affected by this advisory.
Am I affected?
- supportsA deprecated MCP WebSocket transport trusted the browser origin: The advisory says version 1.28.1 leaves WebSocket Host/Origin validation disabled when security_settings is omitted; applications retaining the helper must configure TransportSecuritySettings explicitly.
Remediation: security_settings defaults to None; configured TransportSecuritySettings
- supportsA deprecated MCP WebSocket transport trusted the browser origin: Before 1.28.1, the MCP Python SDK deprecated WebSocket server transport accepted handshakes without Host or Origin validation.
Summary