René's URL Explorer Experiment

Title: feat: RFC 6570 URI templates with operator-aware security by maxisbey · Pull Request #2356 · modelcontextprotocol/python-sdk · GitHub

Open Graph Title: feat: RFC 6570 URI templates with operator-aware security by maxisbey · Pull Request #2356 · modelcontextprotocol/python-sdk

X Title: feat: RFC 6570 URI templates with operator-aware security by maxisbey · Pull Request #2356 · modelcontextprotocol/python-sdk

Description: Replaces the regex-based resource template matcher with a linear-time RFC 6570 implementation, adds configurable path-safety validation, and exports a standalone UriTemplate usable from both client and low-level server. Motivation The existing matcher only supports RFC 6570 Level 1 ({var}). Users writing file://{+path} for multi-segment paths hit a confusing "mismatch" error because the regex-based extraction doesn't understand the + operator. The TypeScript, C#, and Go SDKs all support Level 3+. The matcher also doesn't escape template literals, so data://v1.0/{id} incorrectly matches data://v1X0/42. Separately, encoded ../ sequences in extracted parameters are passed to handlers unchecked. The 2026 spec adds a normative requirement that file:// resource servers sanitize paths. Closes #436, closes #220, closes #159, closes #378 Supersedes #197, #427, #1439, #2353 What's in here mcp.shared.uri_template.UriTemplate — RFC 6570 Levels 1-3 plus path-style explode ({/var*}, {.var*}, {;var*}). parse() / expand() / match(). Re-exported at the top level so clients can expand a template a server advertises. The matcher is a two-ended linear scan with no backtracking. Rather than handling ambiguous templates with scan-time special cases, the parser rejects them up front: two variables adjacent with no literal between them, more than one multi-segment variable, and more than one {?...} expression all raise InvalidUriTemplate at decoration time. Operators that emit their own delimiter ({+path}{.ext}, {+path}{/seg}, {+path}{;k}) still compose. Query expressions match leniently (order-agnostic, partial, extras ignored), and a handler parameter bound to one must declare a Python default — also checked at decoration time. mcp.shared.path_security — contains_path_traversal(), is_absolute_path(), safe_join(). The last resolves and verifies containment, catching symlink escapes. ResourceSecurity policy — wired into MCPServer(resource_security=...) and @mcp.resource(..., security=...). By default rejects .. escapes, absolute paths, and null bytes. A rejection is indistinguishable on the wire from a not-found resource (-32602) and halts template iteration. Per-parameter opt-out via exempt_params={"name"}. Tests Example-based suites for UriTemplate and path_security, e2e tests through Client for the decorator and policy, plus two seeded property tests over the full space the parser accepts: match(expand(v)) round-trips and match() never raises on any input. 100% coverage. Breaking changes See docs/migration.md for the full list. Headline items: Path-safety checks applied by default (opt out via ResourceSecurity) Template literals match exactly; {var} stops at structural delimiters and now matches an empty value Two adjacent variables, more than one multi-segment variable, more than one {?...}, and other malformed templates raise at decoration time A {?...}-bound handler parameter without a default raises at decoration time Docs Tested reference page at docs/advanced/uri-templates.md with runnable examples under docs_src/uri_templates/. AI Disclaimer

Open Graph Description: Replaces the regex-based resource template matcher with a linear-time RFC 6570 implementation, adds configurable path-safety validation, and exports a standalone UriTemplate usable from both client...

X Description: Replaces the regex-based resource template matcher with a linear-time RFC 6570 implementation, adds configurable path-safety validation, and exports a standalone UriTemplate usable from both client...

Opengraph URL: https://github.com/modelcontextprotocol/python-sdk/pull/2356

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width