Python: update MCP OAuth sample dependencies - #14352
Conversation
Update the MCP OAuth sample to use Semantic Kernel 1.44.1 and align the sample with the current SDK type signatures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 71b0555a-bf39-4b88-8ff9-9a1178453c1b
There was a problem hiding this comment.
Pull request overview
Updates the Python MCP OAuth demo to stay compatible with the current Semantic Kernel Python SDK release and its MCP/OAuth-related APIs.
Changes:
- Bumps the demo’s
semantic-kernel[mcp]dependency to>=1.44.1. - Refreshes
uv.lockto reflect the updated transitive dependency graph. - Updates the MCP plugin timeout argument and agent thread typing to match current SDK signatures.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| python/samples/demos/mcp_with_oauth/uv.lock | Regenerated lockfile for the updated Semantic Kernel and transitive dependencies. |
| python/samples/demos/mcp_with_oauth/pyproject.toml | Pins semantic-kernel[mcp] to >=1.44.1. |
| python/samples/demos/mcp_with_oauth/agent/main.py | Aligns MCP timeout argument type and thread annotation with current Semantic Kernel APIs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): 84ef67d63133
Model: claude-opus-4.8
Overview
This PR maintains the mcp_with_oauth demo: it pins semantic-kernel[mcp]>=1.44.1,
regenerates uv.lock, and aligns two agent/main.py annotations with the current
SDK public API (timeout=60.0 float instead of timedelta, and a widened
AgentThread thread annotation). All four edits were verified against the in-tree
SDK 1.44.1: MCPStreamableHttpPlugin.__init__ declares timeout: float | None,
AgentThread is an exported public base of ChatHistoryAgentThread, the removed
timedelta/ChatHistoryAgentThread symbols are cleanly excised, and the lockfile
digests match genuine PyPI artifacts with no downgraded or vulnerable pins. The
edits are correctness-improving and demo-scoped, so no publishable defect is
established. The one residual risk — the regenerated lock resolving a never-tested
openai 3.x major against SK 1.44.1 — is unverified and demo-only, recorded as a
follow-up rather than a concrete finding.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 71b0555a-bf39-4b88-8ff9-9a1178453c1b
Motivation and Context
Keep the MCP OAuth demo aligned with the current Semantic Kernel Python SDK release and public API signatures.
Description
Contribution Checklist