Mention the SSL_CERT_FILE remedy and update stale HTTPX docstrings

The TLS notes now cover the zero-code SSL_CERT_FILE/SSL_CERT_DIR route
httpx2 honors before falling back to the system trust store, and warn
that verify="ca.pem" and cert= are deprecated there. A handful of
docstrings still branded the client HTTPX; they now say httpx2.

No-Verification-Needed: docstring- and documentation-only change

Author: maxisbey

docs/client/transports.md

@@ -56,8 +56,9 @@ Two things to notice:
 
 One TLS note: `httpx2` verifies certificates against the operating system trust store (via
 [`truststore`](https://pypi.org/project/truststore/)), not a bundled CA list. In an environment with
-no usable system CA store - some minimal containers - pass an explicit `verify=ssl_context` to your
-`httpx2.AsyncClient` (background in
+no usable system CA store — some minimal containers — set the standard `SSL_CERT_FILE`/`SSL_CERT_DIR`
+environment variables or pass an explicit `verify=ssl_context` to your `httpx2.AsyncClient`
+(background in
 [`httpx` and `httpx-sse` replaced by `httpx2`](../migration.md#httpx-and-httpx-sse-replaced-by-httpx2)).
 
 !!! warning

docs/migration.md

@@ -99,8 +99,8 @@ The SDK now depends on [`httpx2`](https://pypi.org/project/httpx2/) instead of
 `httpx`) with server-sent events support built in, so the separate `httpx-sse`
 dependency is gone.
 
-The swap itself does not change any SDK signatures - `streamable_http_client`
-and `sse_client` accept the same arguments as elsewhere in v2 - but the client
+The swap itself does not change any SDK signatures — `streamable_http_client`
+and `sse_client` accept the same arguments as elsewhere in v2 — but the client
 type they expect is now `httpx2.AsyncClient`. If you construct your own client to pass as
 `http_client` (or build an `httpx2.Auth` subclass for `auth`), import from
 `httpx2`:
@@ -129,8 +129,12 @@ TLS verification also changes: `httpx` validated certificates against the
 bundled `certifi` CA list, while `httpx2` validates against the operating
 system trust store via [`truststore`](https://pypi.org/project/truststore/).
 If your environment has no usable system CA store (some minimal containers),
-or you relied on certifi's bundle specifically, pass an explicit
-`verify=ssl_context` to your `httpx2.AsyncClient`.
+or you relied on certifi's bundle specifically, point the standard
+`SSL_CERT_FILE` or `SSL_CERT_DIR` environment variable at a CA bundle —
+`httpx2` honors these before falling back to the system store — or pass an
+explicit `verify=ssl_context` to your `httpx2.AsyncClient`. Passing a CA
+bundle path as `verify="ca.pem"` or using the `cert=` parameter is deprecated
+in `httpx2`; build an `ssl.SSLContext` and configure it instead.
 
 ### `mcp dev` and `mcp install` pin the spawned environment to your SDK version
 

src/mcp/client/auth/__init__.py

@@ -1,4 +1,4 @@
-"""OAuth2 Authentication implementation for HTTPX.
+"""OAuth2 Authentication implementation for httpx2.
 
 Implements authorization code flow with PKCE and automatic token refresh.
 """

src/mcp/client/auth/oauth2.py

@@ -1,4 +1,4 @@
-"""OAuth2 Authentication implementation for HTTPX.
+"""OAuth2 Authentication implementation for httpx2.
 
 Implements authorization code flow with PKCE and automatic token refresh.
 """
@@ -528,7 +528,7 @@ async def _validate_resource_match(self, prm: ProtectedResourceMetadata) -> None
             raise OAuthFlowError(f"Protected resource {prm_resource} does not match expected {default_resource}")
 
     async def async_auth_flow(self, request: httpx2.Request) -> AsyncGenerator[httpx2.Request, httpx2.Response]:
-        """HTTPX auth flow integration."""
+        """httpx2 auth flow integration."""
         async with self.context.lock:
             if not self._initialized:
                 await self._initialize()

src/mcp/client/sse.py

@@ -47,8 +47,8 @@ async def sse_client(
         headers: Optional headers to include in requests.
         timeout: HTTP timeout for regular operations (in seconds).
         sse_read_timeout: Timeout for SSE read operations (in seconds).
-        httpx_client_factory: Factory function for creating the HTTPX client.
-        auth: Optional HTTPX authentication handler.
+        httpx_client_factory: Factory function for creating the httpx2 client.
+        auth: Optional httpx2 authentication handler.
         on_session_created: Optional callback invoked with the session ID when received.
     """
     logger.debug(f"Connecting to SSE endpoint: {remove_request_params(url)}")

src/mcp/server/extension.py

@@ -7,7 +7,7 @@
 interceptor. The server never hands itself to an extension; the extension
 declares what it adds, and the server consumes it.
 
-The shape follows the HTTPX `Transport`/`Auth` pattern: a narrow base class whose
+The shape follows the httpx2 `Transport`/`Auth` pattern: a narrow base class whose
 methods have sensible defaults, so an extension overrides only what it needs. A
 purely additive extension (Apps) overrides `tools`/`resources`; an interceptive
 one overrides `methods`/`intercept_tool_call`.