Bible v18.0 to v18.1 Law 7 rewritten:
Bible v18.0 to v18.1 Law 7 rewritten: Transport-Appropriate Authentication (3-Pattern). Was OAuth 2.1+PKCE mandatory for all HTTP. Now 3 patterns: Pattern A: Platform-Managed (Manus+Traefik) — auth=None, NO OAuthProvider (adding it causes 401 on ALL requests). Pattern B: JWTVerifier — public servers with external IdP. Pattern C: OAuthProvider — standalone servers only (rare). Other v18.1 changes: on_duplicate_tools to on_duplicate, Elicitation SEP-1148 to SEP-1330, UV 0.10.4 to 0.10.x, stateless_http=True moved to mcp.run() call.