fix(qr-server): use stable mcp SDK from PyPI (#360)

malbari · web-flow · commit f9abb74fc0a8 · 2026-01-26T18:52:10.000Z
* fix(qr-server): use stable mcp SDK from PyPI

- Replace git-based mcp dependency with mcp&gt;=1.26.0 from PyPI for stability
- Remove TransportSecuritySettings that was blocking browser connections
- Keep simple FastMCP initialization like other Python examples

Fixes ModuleNotFoundError and 403 Forbidden errors when connecting from basic-host

* fix(qr-server): use stable mcp SDK from PyPI

- Replace git-based mcp dependency with mcp&gt;=1.26.0 from PyPI
- Add stateless_http=True for proper HTTP transport handling
- Remove TransportSecuritySettings that blocked browser connections
diff --git a/examples/qr-server/server.py b/examples/qr-server/server.py
@@ -2,7 +2,7 @@
 # /// script
 # requires-python = ">=3.10"
 # dependencies = [
-#     "mcp @ git+https://github.com/modelcontextprotocol/python-sdk@main",
+#     "mcp>=1.26.0",
 #     "qrcode[pil]>=8.0",
 #     "uvicorn>=0.34.0",
 #     "starlette>=0.46.0",
@@ -19,15 +19,14 @@
 import qrcode
 import uvicorn
 from mcp.server.fastmcp import FastMCP
-from mcp.server.transport_security import TransportSecuritySettings
 from mcp import types
 from starlette.middleware.cors import CORSMiddleware
 
 VIEW_URI = "ui://qr-server/view.html"
 HOST = os.environ.get("HOST", "0.0.0.0")  # 0.0.0.0 for Docker compatibility
 PORT = int(os.environ.get("PORT", "3001"))
 
-mcp = FastMCP("QR Code Server")
+mcp = FastMCP("QR Code Server", stateless_http=True)
 
 # Embedded View HTML for self-contained usage (uv run <url> or unbundled)
 EMBEDDED_VIEW_HTML = """<!DOCTYPE html>
@@ -162,11 +161,7 @@ def view() -> str:
         mcp.run(transport="stdio")
     else:
         # HTTP mode for basic-host (default) - with CORS
-        # Allow Docker bridge IP for container-to-host communication
-        security = TransportSecuritySettings(
-            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*", "172.17.0.1:*"]
-        )
-        app = mcp.streamable_http_app(stateless_http=True, transport_security=security)
+        app = mcp.streamable_http_app()
         app.add_middleware(
             CORSMiddleware,
             allow_origins=["*"],
