Convert httpx usage added on main to httpx2

The rebase onto main picked up files added since the swap (stories
examples, identity-assertion client/docs, client probe, docs_src
tutorials) that still imported httpx. Apply the same httpx -> httpx2
rename to them, update the migration guide's mcp-types and
identity-assertion sections to name httpx2, and document the
certifi -> truststore TLS verification change.

Author: maxisbey

docs/client/identity-assertion.md

@@ -19,7 +19,7 @@ Everything below is the second request: the client that sends it and the authori
 
 ## The client
 
-**`IdentityAssertionOAuthProvider`** lives in `mcp.client.auth.extensions.identity_assertion`. Like every provider in **[OAuth clients](oauth-clients.md)** it is an `httpx.Auth`: construct one, put it on `auth=`, hand the `httpx.AsyncClient` to the transport.
+**`IdentityAssertionOAuthProvider`** lives in `mcp.client.auth.extensions.identity_assertion`. Like every provider in **[OAuth clients](oauth-clients.md)** it is an `httpx2.Auth`: construct one, put it on `auth=`, hand the `httpx2.AsyncClient` to the transport.
 
 ```python title="client.py" hl_lines="49-50 53-61"
 --8<-- "docs_src/identity_assertion/tutorial001.py"
@@ -139,7 +139,7 @@ And notice what the returned `OAuthToken` does not carry: a refresh token. The I
 
 * [SEP-990](https://github.com/modelcontextprotocol/modelcontextprotocol/issues/990) lets the enterprise identity provider, not the end user, decide which MCP servers a client may reach. The IdP signs that decision into an **ID-JAG**.
 * Obtaining the ID-JAG is an [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693) token exchange against *your IdP*, and the SDK does not make it. Presenting it to the MCP authorization server is the [RFC 7523](https://datatracker.ietf.org/doc/html/rfc7523) `jwt-bearer` grant, and the SDK does both sides of that.
-* `IdentityAssertionOAuthProvider` is another `httpx.Auth`: a pre-registered confidential client, a pinned `issuer`, and one `assertion_provider(audience, resource)` callback. No browser, no registration, no refresh token.
+* `IdentityAssertionOAuthProvider` is another `httpx2.Auth`: a pre-registered confidential client, a pinned `issuer`, and one `assertion_provider(audience, resource)` callback. No browser, no registration, no refresh token.
 * The authorization server is never discovered from the resource server. Configure `issuer` to exactly the string its metadata document serves; the comparison is character for character.
 * Server side, `identity_assertion_enabled=True` plus `exchange_identity_assertion`. The SDK authenticates the client and gates the grant; validating the ID-JAG is entirely yours, and the issued token is bound to the ID-JAG's `resource`, not the request's.
 

docs/client/oauth-clients.md

@@ -2,7 +2,7 @@
 
 Some MCP servers are protected. Send them a request without a token and they answer `401 Unauthorized`.
 
-**`OAuthClientProvider`** is how you get the token. It is not an MCP object at all. It is an `httpx.Auth`, the standard httpx hook for "do something to every request". You attach it to an `httpx.AsyncClient`, hand that client to the Streamable HTTP transport, and stop thinking about it.
+**`OAuthClientProvider`** is how you get the token. It is not an MCP object at all. It is an `httpx2.Auth`, the standard httpx2 hook for "do something to every request". You attach it to an `httpx2.AsyncClient`, hand that client to the Streamable HTTP transport, and stop thinking about it.
 
 This page is the client side. Making your own server demand a token is **[Authorization](../run/authorization.md)**.
 
@@ -68,9 +68,9 @@ A real client runs a small local HTTP server on the redirect URI instead of call
 
 ### Into the `Client`
 
-Look at `main()`. The provider goes on the **httpx client**, the httpx client goes into `streamable_http_client(url, http_client=...)`, and that transport goes into `Client`.
+Look at `main()`. The provider goes on the **httpx2 client**, the httpx2 client goes into `streamable_http_client(url, http_client=...)`, and that transport goes into `Client`.
 
-`streamable_http_client` has no `auth=` keyword. Anything HTTP-level (auth, headers, timeouts, proxies) belongs on the `httpx.AsyncClient` you bring. That layering is **[Client transports](transports.md)**.
+`streamable_http_client` has no `auth=` keyword. Anything HTTP-level (auth, headers, timeouts, proxies) belongs on the `httpx2.AsyncClient` you bring. That layering is **[Client transports](transports.md)**.
 
 ## What the provider does for you
 
@@ -103,7 +103,7 @@ The URL must be HTTPS with a non-root path; anything else is a `ValueError` at c
 
 A nightly job, a CI step, another service. There is no browser and nobody to click "allow". That is the **client credentials** grant: you already hold a `client_id` and a `client_secret`, and the token endpoint is the whole flow.
 
-`ClientCredentialsOAuthProvider` is the same `httpx.Auth`, minus the human:
+`ClientCredentialsOAuthProvider` is the same `httpx2.Auth`, minus the human:
 
 ```python title="client.py" hl_lines="4 27-33"
 --8<-- "docs_src/oauth_clients/tutorial002.py"
@@ -113,7 +113,7 @@ What changed:
 
 * No `OAuthClientMetadata`, no handlers. You pass `client_id` and `client_secret`; the provider builds a minimal `client_credentials` registration around them and skips dynamic registration entirely.
 * `scopes` is a space-separated string, the OAuth wire format.
-* Everything downstream is identical: the same `TokenStorage`, the same `httpx.AsyncClient(auth=...)`, the same `streamable_http_client`.
+* Everything downstream is identical: the same `TokenStorage`, the same `httpx2.AsyncClient(auth=...)`, the same `streamable_http_client`.
 
 By default the secret travels as HTTP Basic auth on the token request (`client_secret_basic`). Pass `token_endpoint_auth_method="client_secret_post"` to put it in the form body instead. Some authorization servers only accept one of the two.
 
@@ -133,11 +133,11 @@ There is one more no-human situation: the client belongs to an enterprise whose
 
 When the OAuth flow goes wrong, the provider raises an `OAuthFlowError` from `mcp.client.auth`. It has two subclasses. `OAuthRegistrationError` means the authorization server refused to register you. `OAuthTokenError` means the token endpoint said no. One `except OAuthFlowError:` covers discovery, registration, authorization, and exchange.
 
-Not everything is a flow error. The network can still fail; those are ordinary `httpx` exceptions and pass through untouched.
+Not everything is a flow error. The network can still fail; those are ordinary `httpx2` exceptions and pass through untouched.
 
 ## Recap
 
-* `OAuthClientProvider` is an `httpx.Auth`. Put it on an `httpx.AsyncClient`, pass that to `streamable_http_client(url, http_client=...)`, and `Client` never knows OAuth happened.
+* `OAuthClientProvider` is an `httpx2.Auth`. Put it on an `httpx2.AsyncClient`, pass that to `streamable_http_client(url, http_client=...)`, and `Client` never knows OAuth happened.
 * You supply four things: the server URL, an `OAuthClientMetadata`, a `TokenStorage`, and the redirect/callback handler pair.
 * `TokenStorage` is a `Protocol`: four async methods, no base class. Persist `client_info` as well as the tokens.
 * Discovery, registration (dynamic, or via a **Client ID Metadata Document**), PKCE, the `state` and `iss` checks, and token refresh are the provider's job, not yours.

docs_src/client_transports/tutorial003.py

@@ -1,13 +1,13 @@
-import httpx
+import httpx2
 
 from mcp import Client
 from mcp.client.streamable_http import streamable_http_client
 
 
 async def main() -> None:
-    async with httpx.AsyncClient(
+    async with httpx2.AsyncClient(
         headers={"Authorization": "Bearer ..."},
-        timeout=httpx.Timeout(30.0, read=300.0),
+        timeout=httpx2.Timeout(30.0, read=300.0),
         follow_redirects=True,
     ) as http_client:
         transport = streamable_http_client("http://localhost:8000/mcp", http_client=http_client)

docs_src/identity_assertion/tutorial001.py

@@ -1,7 +1,7 @@
 import time
 import uuid
 
-import httpx
+import httpx2
 import jwt
 
 from mcp import Client
@@ -62,7 +62,7 @@ async def fetch_id_jag(audience: str, resource: str) -> str:
 
 
 async def main() -> None:
-    async with httpx.AsyncClient(auth=oauth, follow_redirects=True) as http_client:
+    async with httpx2.AsyncClient(auth=oauth, follow_redirects=True) as http_client:
         transport = streamable_http_client("http://localhost:8001/mcp", http_client=http_client)
         async with Client(transport) as client:
             result = await client.list_tools()

docs_src/oauth_clients/tutorial001.py

@@ -1,6 +1,6 @@
 from urllib.parse import parse_qs, urlparse
 
-import httpx
+import httpx2
 from pydantic import AnyUrl
 
 from mcp import Client
@@ -55,7 +55,7 @@ async def wait_for_callback() -> AuthorizationCodeResult:
 
 
 async def main() -> None:
-    async with httpx.AsyncClient(auth=oauth, follow_redirects=True) as http_client:
+    async with httpx2.AsyncClient(auth=oauth, follow_redirects=True) as http_client:
         transport = streamable_http_client("http://localhost:8001/mcp", http_client=http_client)
         async with Client(transport) as client:
             result = await client.list_tools()

docs_src/oauth_clients/tutorial002.py

@@ -1,4 +1,4 @@
-import httpx
+import httpx2
 
 from mcp import Client
 from mcp.client.auth.extensions.client_credentials import ClientCredentialsOAuthProvider
@@ -34,7 +34,7 @@ async def set_client_info(self, client_info: OAuthClientInformationFull) -> None
 
 
 async def main() -> None:
-    async with httpx.AsyncClient(auth=oauth, follow_redirects=True) as http_client:
+    async with httpx2.AsyncClient(auth=oauth, follow_redirects=True) as http_client:
         transport = streamable_http_client("http://localhost:8001/mcp", http_client=http_client)
         async with Client(transport) as client:
             result = await client.list_tools()

examples/snippets/clients/identity_assertion_client.py

@@ -16,7 +16,7 @@
 
 import asyncio
 
-import httpx
+import httpx2
 
 from mcp import ClientSession
 from mcp.client.auth.extensions.identity_assertion import IdentityAssertionOAuthProvider
@@ -66,7 +66,7 @@ async def main() -> None:
         scope="user",
     )
 
-    async with httpx.AsyncClient(auth=oauth_auth, follow_redirects=True) as http_client:
+    async with httpx2.AsyncClient(auth=oauth_auth, follow_redirects=True) as http_client:
         async with streamable_http_client("http://localhost:8001/mcp", http_client=http_client) as (read, write):
             async with ClientSession(read, write) as session:
                 await session.initialize()

examples/stories/_harness.py

@@ -18,7 +18,7 @@
 from urllib.parse import urlsplit
 
 import anyio
-import httpx
+import httpx2
 from mcp_types.version import LATEST_MODERN_VERSION
 
 from mcp import StdioServerParameters, stdio_client
@@ -38,8 +38,8 @@
 TargetFactory = Callable[[], Target]
 """Yields a FRESH target against the same server/app on every call (``multi_connection`` stories)."""
 
-AuthBuilder = Callable[[httpx.AsyncClient], httpx.Auth]
-"""Builds an ``httpx.Auth`` bound to the in-process HTTP client (auth-story harness seam)."""
+AuthBuilder = Callable[[httpx2.AsyncClient], httpx2.Auth]
+"""Builds an ``httpx2.Auth`` bound to the in-process HTTP client (auth-story harness seam)."""
 
 
 def argv_after(flag: str, *, default: str | None = None) -> str:
@@ -127,8 +127,8 @@ def _story_cfg(name: str) -> dict[str, Any]:
     return manifest["defaults"] | manifest["story"].get(name, {})
 
 
-def _authed_targets(url: str, http: httpx.AsyncClient) -> TargetFactory:
-    """Fresh streamable-HTTP transports over an already-authed ``httpx`` client."""
+def _authed_targets(url: str, http: httpx2.AsyncClient) -> TargetFactory:
+    """Fresh streamable-HTTP transports over an already-authed ``httpx2`` client."""
     return lambda: streamable_http_client(url, http_client=http)
 
 
@@ -176,13 +176,13 @@ async def _run() -> None:
                 if url is None or (build_auth is None and not cfg["needs_http"]):
                     await main(targets if cfg["multi_connection"] else targets(), mode=mode)
                     return
-                # Auth and needs_http stories want the raw httpx client underneath the transport:
-                # build_auth threads an httpx.Auth onto it (Client(url, auth=...) doesn't exist
+                # Auth and needs_http stories want the raw httpx2 client underneath the transport:
+                # build_auth threads an httpx2.Auth onto it (Client(url, auth=...) doesn't exist
                 # yet), and needs_http stories assert on raw responses, so root the client at the
                 # server origin and relative paths like "/mcp" resolve.
                 parts = urlsplit(url)
                 base = f"{parts.scheme}://{parts.netloc}"
-                http = await stack.enter_async_context(httpx.AsyncClient(base_url=base))
+                http = await stack.enter_async_context(httpx2.AsyncClient(base_url=base))
                 make = targets
                 if build_auth is not None:
                     http.auth = build_auth(http)

examples/stories/_hosting.py

@@ -25,7 +25,7 @@
 AppFactory = Callable[[], Starlette]
 
 NO_DNS_REBIND = TransportSecuritySettings(enable_dns_rebinding_protection=False)
-"""Harness servers bind 127.0.0.1 and the in-process httpx client sends no Origin header."""
+"""Harness servers bind 127.0.0.1 and the in-process httpx2 client sends no Origin header."""
 
 
 def argv_after(flag: str, *, default: str | None = None) -> str:

examples/stories/_shared/auth.py

@@ -10,7 +10,7 @@
 import time
 from urllib.parse import parse_qs, urlsplit
 
-import httpx
+import httpx2
 from pydantic import AnyHttpUrl
 
 from mcp.server.auth.provider import (
@@ -49,14 +49,14 @@ async def set_client_info(self, client_info: OAuthClientInformationFull) -> None
 
 
 class HeadlessOAuth:
-    """Completes the authorize redirect in-process via the bound ``httpx`` client."""
+    """Completes the authorize redirect in-process via the bound ``httpx2`` client."""
 
     def __init__(self) -> None:
         self.authorize_url: str | None = None
-        self._http: httpx.AsyncClient | None = None
+        self._http: httpx2.AsyncClient | None = None
         self._result = AuthorizationCodeResult(code="", state=None)
 
-    def bind(self, http_client: httpx.AsyncClient) -> None:
+    def bind(self, http_client: httpx2.AsyncClient) -> None:
         self._http = http_client
 
     async def redirect_handler(self, authorization_url: str) -> None: