diff --git a/docs/python-sdk/fastmcp-cli-generate.mdx b/docs/python-sdk/fastmcp-cli-generate.mdx index ebedaa186..0d9285189 100644 --- a/docs/python-sdk/fastmcp-cli-generate.mdx +++ b/docs/python-sdk/fastmcp-cli-generate.mdx @@ -33,7 +33,7 @@ generate_cli_script(server_name: str, server_spec: str, transport_code: str, ext Generate the full CLI script source code. -### `generate_skill_content` +### `generate_skill_content` ```python generate_skill_content(server_name: str, cli_filename: str, tools: list[mcp.types.Tool]) -> str @@ -43,7 +43,7 @@ generate_skill_content(server_name: str, cli_filename: str, tools: list[mcp.type Generate a SKILL.md file for a generated CLI script. -### `generate_cli_command` +### `generate_cli_command` ```python generate_cli_command(server_spec: Annotated[str, cyclopts.Parameter(help='Server URL, Python file, MCPConfig JSON, discovered name, or .js file')], output: Annotated[str, cyclopts.Parameter(help='Output file path (default: cli.py)')] = 'cli.py') -> None diff --git a/docs/python-sdk/fastmcp-cli-install-goose.mdx b/docs/python-sdk/fastmcp-cli-install-goose.mdx index cd2a8cc9a..af5aed24c 100644 --- a/docs/python-sdk/fastmcp-cli-install-goose.mdx +++ b/docs/python-sdk/fastmcp-cli-install-goose.mdx @@ -29,7 +29,7 @@ Generate a Goose deeplink for installing an MCP extension. - A goose://extension?... deeplink URL. -### `install_goose` +### `install_goose` ```python install_goose(file: Path, server_object: str | None, name: str) -> bool @@ -49,7 +49,7 @@ Install FastMCP server in Goose via deeplink. - True if installation was successful, False otherwise. -### `goose_command` +### `goose_command` ```python goose_command(server_spec: str) -> None diff --git a/docs/python-sdk/fastmcp-server-auth-auth.mdx b/docs/python-sdk/fastmcp-server-auth-auth.mdx index 69f63aeb7..8f7954cd9 100644 --- a/docs/python-sdk/fastmcp-server-auth-auth.mdx +++ b/docs/python-sdk/fastmcp-server-auth-auth.mdx @@ -254,7 +254,7 @@ Get routes for this provider. Creates protected resource metadata routes (RFC 9728). -### `MultiAuth` +### `MultiAuth` Composes an optional auth server with additional token verifiers. @@ -270,7 +270,7 @@ come from the server; verifiers contribute only token verification. **Methods:** -#### `verify_token` +#### `verify_token` ```python verify_token(self, token: str) -> AccessToken | None @@ -283,7 +283,7 @@ it is logged and treated as a non-match so that remaining sources still get a chance to verify the token. -#### `set_mcp_path` +#### `set_mcp_path` ```python set_mcp_path(self, mcp_path: str | None) -> None @@ -292,7 +292,7 @@ set_mcp_path(self, mcp_path: str | None) -> None Propagate MCP path to the server and all verifiers. -#### `get_routes` +#### `get_routes` ```python get_routes(self, mcp_path: str | None = None) -> list[Route] @@ -301,7 +301,7 @@ get_routes(self, mcp_path: str | None = None) -> list[Route] Delegate route creation to the server. -#### `get_well_known_routes` +#### `get_well_known_routes` ```python get_well_known_routes(self, mcp_path: str | None = None) -> list[Route] @@ -313,7 +313,7 @@ This ensures that server-specific well-known route logic (e.g., OAuthProvider's RFC 8414 path-aware discovery) is preserved. -### `OAuthProvider` +### `OAuthProvider` OAuth Authorization Server provider. @@ -324,7 +324,7 @@ authorization flows, token issuance, and token verification. **Methods:** -#### `verify_token` +#### `verify_token` ```python verify_token(self, token: str) -> AccessToken | None @@ -342,7 +342,7 @@ to our existing load_access_token method. - AccessToken object if valid, None if invalid or expired -#### `get_routes` +#### `get_routes` ```python get_routes(self, mcp_path: str | None = None) -> list[Route] @@ -358,7 +358,7 @@ This method creates the full set of OAuth routes including: - List of OAuth routes -#### `get_well_known_routes` +#### `get_well_known_routes` ```python get_well_known_routes(self, mcp_path: str | None = None) -> list[Route] diff --git a/docs/python-sdk/fastmcp-server-auth-providers-jwt.mdx b/docs/python-sdk/fastmcp-server-auth-providers-jwt.mdx index b049a4d64..68c39df63 100644 --- a/docs/python-sdk/fastmcp-server-auth-providers-jwt.mdx +++ b/docs/python-sdk/fastmcp-server-auth-providers-jwt.mdx @@ -97,7 +97,7 @@ Validate a JWT bearer token and return an AccessToken when the token is valid. - AccessToken | None: An AccessToken populated from token claims if the token is valid; `None` if the token is expired, has an invalid signature or format, fails issuer/audience/scope validation, or any other validation error occurs. -#### `verify_token` +#### `verify_token` ```python verify_token(self, token: str) -> AccessToken | None @@ -115,7 +115,7 @@ to our existing load_access_token method. - AccessToken object if valid, None if invalid or expired -### `StaticTokenVerifier` +### `StaticTokenVerifier` Simple static token verifier for testing and development. @@ -136,7 +136,7 @@ WARNING: Never use this in production - tokens are stored in plain text! **Methods:** -#### `verify_token` +#### `verify_token` ```python verify_token(self, token: str) -> AccessToken | None diff --git a/docs/python-sdk/fastmcp-server-auth-providers-workos.mdx b/docs/python-sdk/fastmcp-server-auth-providers-workos.mdx index 8d8c80061..7917f1504 100644 --- a/docs/python-sdk/fastmcp-server-auth-providers-workos.mdx +++ b/docs/python-sdk/fastmcp-server-auth-providers-workos.mdx @@ -82,10 +82,31 @@ IMPORTANT SETUP REQUIREMENTS: For detailed setup instructions, see: https://workos.com/docs/authkit/mcp/integrating/token-verification +Token audience is bound to this server automatically: when the MCP +mount path becomes known (typically at ``http_app()`` construction), +``JWTVerifier.audience`` is set to the resource URL advertised in +``.well-known/oauth-protected-resource``. Enable Resource Indicators +(RFC 8707) in your WorkOS Dashboard and list that same URL — AuthKit +will then mint tokens with the matching ``aud`` claim. + **Methods:** -#### `get_routes` +#### `set_mcp_path` + +```python +set_mcp_path(self, mcp_path: str | None) -> None +``` + +Bind the default verifier's audience to this server's resource URL. + +AuthKit with Resource Indicators (RFC 8707) mints tokens whose ``aud`` +claim equals the resource URL the client requested — which is the URL +we advertise in ``.well-known/oauth-protected-resource``. Binding the +audience here keeps validation in lock-step with what clients are sent. + + +#### `get_routes` ```python get_routes(self, mcp_path: str | None = None) -> list[Route] diff --git a/docs/python-sdk/fastmcp-server-providers-prefab_synthesis.mdx b/docs/python-sdk/fastmcp-server-providers-prefab_synthesis.mdx index b3b2c9734..c06fc8b7a 100644 --- a/docs/python-sdk/fastmcp-server-providers-prefab_synthesis.mdx +++ b/docs/python-sdk/fastmcp-server-providers-prefab_synthesis.mdx @@ -23,7 +23,7 @@ the app name + tool name). CSP on the resource is the tool's ## Functions -### `synthesize_prefab_resources` +### `synthesize_prefab_resources` ```python synthesize_prefab_resources(server: FastMCP) -> list[Resource] @@ -33,7 +33,7 @@ synthesize_prefab_resources(server: FastMCP) -> list[Resource] Return fresh synthetic Prefab resources for all prefab tools. Pure. -### `synthesize_prefab_resource_by_uri` +### `synthesize_prefab_resource_by_uri` ```python synthesize_prefab_resource_by_uri(server: FastMCP, uri: str) -> Resource | None @@ -43,7 +43,7 @@ synthesize_prefab_resource_by_uri(server: FastMCP, uri: str) -> Resource | None Intercept a Prefab renderer URI and synthesize on demand. -### `rewrite_tool_meta_for_wire` +### `rewrite_tool_meta_for_wire` ```python rewrite_tool_meta_for_wire(tool: Tool) -> Tool