Increase performance test threshold from 100ms to 1.0s. Windows CI runners
are slower than Linux, and the 100ms threshold was too tight. The test's
intent is to catch obvious regressions (e.g., accidentally re-introducing
code generation), not to precisely benchmark.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add MultiAuth for composing multiple token verification sources
🤖 Generated with Claude Code
https://claude.ai/code/session_01WwKYDCqjM2FqYwY5ZNVvjb
* Fix ruff lint/format in MultiAuth tests
🤖 Generated with Claude Code
https://claude.ai/code/session_01WwKYDCqjM2FqYwY5ZNVvjb
* Fix MultiAuth well-known route delegation and empty scopes handling
🤖 Generated with Claude Code
https://claude.ai/code/session_01WwKYDCqjM2FqYwY5ZNVvjb
* Harden MultiAuth: exception resilience, mcp_path propagation, test coverage
- verify_token now catches exceptions from individual sources and
continues to the next, so one broken verifier can't take down the
whole chain
- set_mcp_path propagates to verifiers, not just the server
- Fix jwks_url→jwks_uri typo in class docstring
- Add tests for raising verifiers, valid-token HTTP acceptance,
and set_mcp_path propagation
* Clean up MultiAuth: precompute sources, deduplicate test helpers
* Fix version badges to 3.1.0
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add prefab auto-wiring for MCP Apps (#3119)
Tools that return prefab types (UIResponse, Component) automatically get
wired to the shared prefab renderer resource. Works via app=True,
return type inference, or both.
* Prefab compatibility updates
* Use published prefab-ui >=0.6.0, remove local source override
* Migrate UIResponse to PrefabApp for Prefab UI integration
PrefabApp is a pure data object with to_json(), html(), and csp()
methods. Tools can return PrefabApp, bare Components, or
ToolResult with structured_content for custom LLM fallback text.
* Add Prefab UI apps documentation
* Add mini apps and full apps documentation pages
Mini apps covers the common single-screen patterns: charts (bar, line,
area, pie), data tables with sorting/search/pagination, forms (manual
and Pydantic-generated), status displays, conditional content, and
layout composition with tabs and accordions.
Full apps covers multi-page applications using Pages/Page components,
shared state across pages, and using ToolCall with result_key for
server-driven state updates.
* Reframe apps docs around motivation, add generative UIs page
The docs now lead with the problem — MCP tools stuff data into the LLM
context window, and building HTML/JS/CSS frontends is a non-starter for
Python developers — before introducing Prefab as the solution. Mini apps
are framed as the primary use case: focused, single-purpose UIs that
present data visually and collect structured input.
New generative UIs page covers the concept of LLMs producing component
JSON directly, enabling adaptive dashboards, tailored forms, and
exploratory workflows.
* Tag Prefab docs pages as SOON instead of NEW
* Rename Low-Level API to Custom HTML Apps
The page is about using the MCP Apps extension directly, not a FastMCP
or Prefab internal API. Reframed to make clear this is the open MCP
protocol with FastMCP providing convenience wrappers.
* Tighten apps docs and widen content area
Strip editorial motivation from all app doc pages — let code examples
do the talking. Add content-area max-width override (44rem) to style.css.
* Restructure apps docs, fix code issues
Rename Prefab UI → Prefab Apps, mini-apps → patterns, remove
generative-uis and full-apps pages. Rewrite prefab page to lead with
what users do (declare a UI, return it) before explaining internals.
Patterns page now has fully self-contained copy-pasteable examples with
explicit imports and links to prefab docs. Forms show the two-tool
pattern (form + handler). Add patterns_server.py example.
Code fixes: move get_args to module-level import, remove dead
AuthCheckCallable type alias, fix ToolCall→CallTool in all docs.
* Remove unused ToolResult import from chart_server
* Handle composite Prefab types in type inference and schema suppression
_has_prefab_return_type and the output schema suppression logic only
checked bare classes, missing unions (Column | None) and Annotated
wrappers (Annotated[PrefabApp | None, ...]). Recurse through Union,
types.UnionType, and Annotated to detect Prefab types in composite
annotations.
* code mode
* update uv.lock for monty optional dep
🤖 Generated with Claude Code
* retry CI
* Address PR review comments on CodeMode transform
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix ty unresolved-attribute error on search_helper
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* more idiomacy
* harden
* fix docs
* harden
* fix red CI
* Refactor CodeMode to use CatalogTransform base class
Removes the duplicate ContextVar bypass pattern in favor of the shared
CatalogTransform machinery. Also fixes a pre-existing bug where
`from __future__ import annotations` caused NameError for Annotated
in nested function scopes at runtime.
* Remove redundant _get_visible_tools wrapper in CodeMode
* Rewrite CodeMode docs with proper motivation and structure
* Fix type narrowing in collision test
* Stop unwrapping tool results in CodeMode's call_tool
call_tool() inside execute blocks now returns structured content as-is,
preserving the {"result": value} wrapping. This means the output schema
shown in search results accurately describes what call_tool() returns,
so LLMs can trust the schema when writing code.
Also adds examples/code_mode/ with a server and narrated client demo.
* Simplify call_tool return type: dict | str
* Fix example client to unwrap structured results
* Let server resolve tool versions instead of pinning first match
* Rewrite CodeMode docs to match current behavior
* Rename optional extra from monty to code-mode
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Fix description of "FastMCP Constructor Parameters": Remove parameters `on_duplicate_tools`, `on_duplicate_resources` and `on_duplicate_prompts`, which are no longer accepted by FastMCP(). Add the new parameter `on_duplicate` and its description.
* feat: Add search transforms for tool discovery
RegexSearchTransform and BM25SearchTransform collapse large tool
catalogs into a search interface so LLMs discover tools on demand
instead of receiving the full listing.
* chore: Update SDK documentation
* fix: call_tool recursion guard, atomic BM25 rebuild, hash includes descriptions
* Extract CatalogTransform base class for catalog-aware transforms
Transforms that replace list_tools() with synthetic components (like
search) need to read the real catalog at call time without triggering
their own replacement logic. CatalogTransform handles the re-entrant
bypass via per-instance ContextVar, exposing transform_tools() as the
subclass hook and get_tool_catalog() for catalog access.
* Add search transform examples for regex and BM25
* Add README for search transform examples
* Polish search example clients with rich output
* Remove hardcoded tool counts from search example subtitles
* Clarify that review bot feedback should be evaluated on its merits
* Expand search transform docs with proper hierarchy
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
The `key` parameter was removed from `add_resource()` in the 2.x era and no longer exists in the implementation. Removes all references and the "Custom Resource Keys" section from both the current and v2 docs.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Nc1qEJ1rKaRRxB5h6Qu5V3
Co-authored-by: Claude <noreply@anthropic.com>
* Fix ty 0.0.19 type errors
🤖 Generated with Claude Code
* Fix ruff formatting in sampling/run.py
🤖 Generated with Claude Code
https://claude.ai/code/session_01GWzbyF1vHvVeS4yJ5bhScf
---------
Co-authored-by: Claude <noreply@anthropic.com>
Defer auth providers (JWTVerifier, OAuthProxy, OIDCProxy) and Client
to avoid eagerly importing authlib, cryptography, key_value.aio, and
beartype on every `from fastmcp import FastMCP`.
* Fix background Context request correlation
* Make OptionalCurrentContext type-safe
Refactor OptionalCurrentContext to wrap CurrentContext instead of overriding __aenter__ with a wider return type. Adds a background-task origin_request_id round-trip test and applies ruff formatting.
* fix: prevent MCP transport auth header from leaking to downstream OpenAPI APIs (#3260)
Two issues in OpenAPITool.run():
1. get_http_headers() does not exclude 'authorization', so the MCP
client's auth token is included in forwarded headers.
2. mcp_headers.update() overwrites existing request headers, including
the Authorization header that was already set from the httpx client's
configured API key.
Fix:
- Add 'authorization' to exclude_headers in get_http_headers() to
prevent MCP transport credentials from being forwarded by default.
- Change mcp_headers forwarding to use the same non-overwriting pattern
as client headers (only set if key not already present), making the
behavior consistent and preventing accidental overwrites.
Fixes#3260
* Add include parameter to get_http_headers(); update proxy transports
The authorization exclusion is correct for the default case (OpenAPI
tools should not forward MCP transport credentials), but proxy
transports need auth headers forwarded to upstream MCP servers.
The new `include` parameter lets callers opt specific headers back in
despite the default exclusion set. Proxy transports now explicitly
request authorization forwarding.
* Include authorization header in CurrentHeaders dependency
CurrentHeaders is user-facing — tools use it to inspect the caller's
auth token for custom logic. Reading a header in your own code is safe;
the exclusion is meant to prevent blindly forwarding it to third-party
APIs.
---------
Co-authored-by: User <user@example.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
