* Initialize 2.14 deprecation removal branch
* Remove deprecated FASTMCP_SERVER_ environment variable prefix (#2330)
* Remove deprecated Context.get_http_request method (#2332)
* Remove fastmcp.Image top-level import (deprecated 2.8.1) (#2334)
* Remove test warnings (#2331)
* Create new branch and fix issue
* Remove deprecated client parameter from FastMCPProxy (#2333)
* Remove deprecated run_streamable_http_async method (#2338)
* Remove deprecated sse_app method (#2337)
* Remove deprecated run_sse_async method (#2335)
* Remove deprecated run_sse_async method
* Update CLI and tests to use run_http_async(transport="sse")
- Change CLI to call run_http_async with transport="sse" instead of run_sse_async
- Update test to mock run_http_async with create=True for v1 servers
* Revert CLI changes - v1 servers do have run_sse_async
- Keep CLI calling run_sse_async() for v1 compatibility
- Update test to mock run_sse_async (which exists on v1)
* Remove unnecessary type ignore for run_sse_async
Method exists on v1 FastMCP class, no type error
* Remove unused imports after test deletion
* Remove deprecated streamable_http_app method (#2336)
* Remove deprecated dependencies parameter from FastMCP constructor (#2340)
* Remove output_schema=False support (deprecated 2.11.4) (#2339)
* Remove deprecated client parameter from FastMCPProxy (#2333)
* Delete deprecated test_output_schema_false.py
Tests functionality that has been removed
* Remove deprecated BearerAuthProvider module (#2341)
* Remove resource_prefix_format="protocol" support (deprecated 2.4.0) (#2342)
* Remove resource_prefix_format="protocol" support (fixes#2195)
Removes deprecated protocol format (prefix+resource://path) and keeps only
path format (resource://prefix/path). Since only one format remains:
- Removed resource_prefix_format from settings, FastMCP.__init__, and helpers
- Simplified add_resource_prefix, remove_resource_prefix, has_resource_prefix
- Removed MountedServer.resource_prefix_format field
- Deleted tests for protocol format
All resource prefixes now use path format exclusively.
* Clean up resource_prefix_format references
- Remove from test files
- Update documentation to remove protocol format section
- Move custom HTTP routes note to mounting section
- Remove resource_prefix_format from settings docs
* Use inline version note instead of badge for prefix format
* Remove obsolete test functions and update docs
- Delete test functions that no longer assert anything
- Remove proxy.mdx reference to deleted prefix format section
* Format error messages per ruff
* Remove from_client classmethod (deprecated 2.8.0) (#2343)
* Remove deprecated from_client classmethod (fixes#2192)
* Remove unused Client import
* Remove add_resource_fn method (deprecated 2.7.0) (#2345)
* Update SDK
* Add missing imports for exclude_args deprecation warning
* Fix Azure provider to handle OIDC scopes correctly
OIDC scopes (openid, profile, email, offline_access) were being
incorrectly prefixed with identifier_uri, causing Azure to reject
authorization requests. This fix:
- Detects OIDC scopes and sends them unprefixed to Azure
- Filters OIDC scopes from token validation (Azure doesn't include
them in access token scp claims)
- Still advertises OIDC scopes to clients via valid_scopes
- Also handles dot-notation scopes (e.g., User.Read) correctly
Fixes#2451, #2420
* Fix dot-notation scopes to be prefixed (custom scopes can have dots)
* Improve Azure scope handling docs with clear examples
* Add consent_csp_policy parameter to OAuthProxy
Allows customization or disabling of CSP directives on the consent page.
Fixes#2476.
* Add consent_csp_policy to OIDCProxy and update docs
* Fix HTML injection vulnerability in CSP policy
HTML-escape the CSP policy value before inserting into meta tag to prevent HTML injection when CSP policies contain quotes.
Corrects the typo in the VersionBadge component in docs/servers/icons.mdx. The version number was incorrectly displayed as 2.14.0 but should be 2.13.0 to match the actual current version of FastMCP.
Fixes issue #2487
* sk-provider updates - aud not enforce, scopes enforce if present
* updating env_prefix, adding debug logs
* updating docs
* ruff formatting
* not changing prefix for backward compatiblity
* backward compatibility changes
* give more preference to base_url than mcp_url if both passed
* updating docs
* refactor
* updating example server
* updating readme of example
* updating docs
* updating tests to reflect what should ideally go in the parameter
Fixes issue #2431 where exclude_args fails when excluded parameters have
non-serializable types (e.g., ServerSession). The fix excludes parameters
from function annotations before Pydantic tries to serialize them.
Also adds deprecation notice that exclude_args will be deprecated in
FastMCP 2.14 in favor of dependency injection.
The on_initialize hook (2.13.0) runs before the MCP session is established, causing request_context
to be unavailable. Changed request_context to return None instead of raising, allowing middleware to
check availability and use HTTP helpers when needed. Updated docs to guide this pattern.
Closes#2393
* docs: clarify pytest-asyncio dependency and asyncio mode configuration
Added a Prerequisites section to the testing documentation explaining:
- pytest-asyncio is required for async test functions and fixtures
- Recommended configuration: asyncio_mode = 'auto' in pyproject.toml
- This eliminates need for @pytest.mark.asyncio decorators
Resolves#2372
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
* feat: add testing_demo example with comprehensive test suite
Add a standalone example project demonstrating FastMCP testing patterns:
- Tools, resources, and prompts with full test coverage
- pytest-asyncio configuration in pyproject.toml
- 18 passing tests showing async fixtures, parametrized tests, and more
- Documentation explaining testing best practices
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
* Add manual initialization control to Client
- Add auto_initialize parameter (default True) to control automatic initialization
- Make initialize() method public with idempotent caching
- Add comprehensive test suite for initialization behavior
* Document client initialization control and server instructions
- Expand documentation to cover auto_initialize parameter
- Show manual initialization for advanced use cases
- Document accessing server instructions via initialize_result
* Update client.mdx
* switch from pre-commit to prek
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix prek tools list in contributing.mdx - include prettier, not pytest
* Use prek-action for caching
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
- Restructured confusing sections: 'Object-like Results' → 'Dictionaries and Objects', 'Non-object Results' → 'Primitives and Collections', 'Complex Type Example' → 'Typed Models'
- Simplified CodeGroup examples to show Tool Definition + MCP Result instead of 3-4 confusing tabs
- Split Primitives/Collections into separate CodeGroups for clarity
- Renamed 'Full Control with ToolResult' → 'ToolResult and Metadata' for better TOC visibility
- Flattened ToolResult documentation with inline field descriptions instead of nested headings
- Added version badge for ToolResult meta field (2.13.1)
- Added clarification that ToolResult meta is separate from @mcp.tool meta
- Improved example server with realistic metadata (execution time, character/word counts)
- Fixed code formatting (multi-line objects, trailing commas)
* Add meta to ToolResult
* add this at the client level and test the full integration
* add example
* slipped through linting somehow
---------
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
* Added to_data_uri method and path_to_data_uri classmethod for Image class.
* Removed path_to_data_uri classmethod and modified _get_mime_type to use mimetypes.guess_type function instead of hardcoded dictionary.
* Register image/webp with mimetypes before guess_type to support WEBP mimetype detection on Python 3.10.
* Improved branch coverage for Image.to_data_uri.
* Added Image._to_data_uri example in the docs.
Add warning notes to documentation directing users to review
py-key-value documentation for backend maturity and limitations
before production use.
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
* Add custom token verifier support to OIDCProxy
OIDCProxy now accepts an optional token_verifier parameter to support
non-JWT token formats like opaque tokens from providers such as Clerk.
When provided, the custom verifier is used instead of creating a default
JWTVerifier. Parameters that only apply to JWTVerifier creation (algorithm,
required_scopes) raise clear errors when specified alongside a custom
verifier. Parameters with other purposes (audience for OAuth flow,
timeout_seconds for config fetch) remain allowed.
The custom verifier's required_scopes are automatically loaded and
advertised through OAuth discovery endpoints.
* Document custom token verifier support in OIDC proxy
* Update docs for required scopes
* add scopes
* Fix Azure scope validation
Azure returns unprefixed scopes in JWT tokens but requires prefixed scopes in authorization requests. The previous implementation incorrectly validated tokens against prefixed scopes, causing "invalid_token" errors.
Simplified AzureProvider to use standard JWTVerifier with unprefixed scopes for validation. Scopes are only prefixed when building the Azure authorization URL via _build_upstream_authorize_url() override.
Closes#2263
* Improve OAuth client token storage security documentation
Updated warning message and documentation to address security concerns
around storing OAuth credentials for multiple MCP servers.
* Update Azure sidebar title to include Entra ID
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
* Update Azure title to emphasize Microsoft Entra ID
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
* Update Azure title to emphasize Azure over Entra ID
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
* Update docs for required scopes
* add scopes
* Fix Azure scope validation
Azure returns unprefixed scopes in JWT tokens but requires prefixed scopes in authorization requests. The previous implementation incorrectly validated tokens against prefixed scopes, causing "invalid_token" errors.
Simplified AzureProvider to use standard JWTVerifier with unprefixed scopes for validation. Scopes are only prefixed when building the Azure authorization URL via _build_upstream_authorize_url() override.
Closes#2263
* Add list_resources, list_prompts, and get_prompt methods to Context
- Add Context.list_resources() to list all available resources
- Add Context.list_prompts() to list all available prompts
- Add Context.get_prompt() to get a specific prompt with arguments
- Update ToolInjectionMiddleware to use new Context methods instead of creating temporary Client instances
- Remove unused Client and FastMCPTransport imports from tool_injection.py
This improves API consistency by allowing middleware/tools to use Context methods directly without needing to create temporary Client instances.
Fixes#2245
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
* Update docs
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
* Checkpoint progress
* Checkpoint progress
* add derive b64 method
* PR clean-up
* refactor da proxy
* Updates to tests
* Make jwt_signing_key required for oauth proxy
* use typing_extensions and fix tests
* PR Cleanup
* also adjust integration tests
* Update docs, use client secret to derive jwt signing key
* You win some you lose some, gg claude
* check for both in derive
* update documentation / clean up
* Update http.mdx
---------
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
* Add compatibility tools contrib module
Implements four standalone tools that expose resources and prompts
as callable tools for clients that only support the tools capability.
Features:
- list_resources: List all available resources
- get_resource: Read a resource by URI
- list_prompts: List all available prompts
- get_prompt: Get a prompt with optional arguments
The tools use Context to access the server instance and can be easily
added to any FastMCP server using the add_compatibility_tools helper
or by adding individual tool instances directly.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
* Simplify compatibility tools to return raw MCP protocol objects
Return raw MCP protocol objects (ListResourcesResult, ReadResourceResult,
ListPromptsResult, GetPromptResult) instead of custom dictionaries. This
makes the tools simpler and more predictable by directly exposing what
the client methods return.
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
* Add tool injection middleware
* cleanup contrib module
* More clean-up
* Clean up tool injection middleware.
* Update src/fastmcp/server/middleware/tool_injection.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add tool injection docs
* Small cleanup of prompt middleware
* PR Feedback
* Fix tool injection tests
---------
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
All OAuth providers and OIDCProxy now expose jwt_signing_key,
token_encryption_key, and client_storage parameters for production
deployments requiring persistent token management across server restarts.
* Add comprehensive keyring integration tests
Prevents OS keyring pollution during testing by adding a global mock in
conftest.py. Tests verify keyring behavior across platforms and fallback
scenarios without writing to the actual system keyring.
- Add global mock_keyring fixture to tests/conftest.py
- Add TestOAuthProxyKeyring class with 6 keyring-specific tests
- Remove try/except ImportError for keyring (now required dependency)
- Add keyring extra to py-key-value-aio dependency
- Clean up extraneous implementation comments in oauth_proxy.py
* Update OAuth keyring documentation
Update all OAuth-related documentation to reflect keyring-based key management:
- Add version badges to jwt_signing_key, token_encryption_key, and client_storage parameters
- Standardize "Default behavior (`None`):" formatting with backticks
- Ensure consistent messaging about development-only defaults across all docs
- Update oauth-proxy.mdx, oidc-proxy.mdx, http.mdx, storage-backends.mdx, and upgrade-guide.mdx
Update documentation links from py-key-value-aio to py-key-value repository.
The py-key-value-aio package lives in the py-key-value monorepo.
Co-authored-by: William Easton <strawgate@users.noreply.github.com>
