* Fix ty ignore syntax in OpenAPI provider
* Fix flaky rate limiting and ping timing tests
* Assert rate limit error message in flaky test fix
* Catch only ToolError in rate limiting test
* Fix NameError with future annotations and Context/Depends parameters
Closes#3238, closes#905
* chore: Update SDK documentation
* Drop unnecessary pre-resolution of annotations
Pydantic (even 2.11.7) uses __module__ not __globals__ to resolve
annotations, so setting __module__ alone is sufficient.
* chore: Update SDK documentation
* Restore annotation pre-resolution for Pydantic compat
The wrapper's __globals__ is read-only and points to dependencies.py,
so some Pydantic versions use it instead of __module__ when resolving
string annotations. Pre-resolving via get_type_hints on the original
function ensures annotations are type objects before Pydantic sees them.
* chore: Update SDK documentation
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Fix dedupe bot adding wrong label by making labeling deterministic
* Scope label step to comments from current workflow run
* Fetch newest comments first to avoid pagination miss
* Fix non-serializable state lost between middleware and tools
Inherit _request_state dict from parent Context in __aenter__ so
middleware and tool contexts share the same in-memory state.
Closes#3228
* chore: Update SDK documentation
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Use standard traceparent/tracestate keys per OTel MCP semconv
The OTel semantic conventions for MCP (https://opentelemetry.io/docs/specs/semconv/gen-ai/mcp/)
put `traceparent` and `tracestate` directly in `params._meta` without a prefix.
FastMCP was using `fastmcp.traceparent` / `fastmcp.tracestate`, which meant
non-FastMCP clients sending the standard keys couldn't propagate traces.
Switches injection to the bare keys and adds fallback extraction for the old
prefixed keys so older FastMCP clients still work.
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: Update SDK documentation
* Drop legacy fastmcp.-prefixed trace key fallback
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: Update SDK documentation
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Add upgrade guides for users coming from the MCP SDK
* Fix incorrect Image import path in LLM migration prompt
* Align LLM prompts with prose across all three upgrade guides
* Move upgrade guides under getting-started/upgrading, add install section and --upgrade flag
* Fix MDX parsing error and add broken link CI check
Escape curly braces in docstring example that broke MDX parsing,
update card images, and add docs broken link check to CI.
* Revert CI broken link check — Mintlify runs this already
* Use code fence instead of inline backticks for MDX escaping
* chore: Update SDK documentation
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Update repository references from jlowin/fastmcp to prefecthq/fastmcp
* Retrigger CI after repo transfer
* chore: Update SDK documentation
* Only run deep triage on bug issues for jlowin
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Overhaul v3.0 upgrade guide
Rewrites the upgrade guide with educational context for each breaking
change, adds an LLM migration prompt users can copy into any AI assistant,
and covers previously missing items (removed constructor kwargs, module
path deprecations, import_server deprecation).
* Address CodeRabbit review feedback on upgrade guide
Split message_path from other transport kwargs (env-var only, not a
run() kwarg), move decorator change to breaking changes in the LLM
prompt since accessing component attributes will crash, and add
DiskStore/OAuth storage change to the prompt's numbered list.
* Move decorator change under Breaking Changes in prose
* Add before/after pattern to auth provider section
* Add Warning callout, WSTransport and OpenAPI migration examples
* Add missing imports to FastMCPOpenAPI migration example
* Add consent binding cookie to prevent confused deputy attacks (GHSA-rww4-4w9c-7733)
The OAuthProxy's consent page verified user intent but didn't bind the
consenting browser to the IdP callback. An attacker could intercept the
upstream authorization URL after consent and send it to a victim, whose
browser would complete the flow without having the consent cookie.
This adds a signed consent binding cookie set during consent approval
(both manual and auto-approve paths) and verified in the IdP callback
handler. A different browser won't have this cookie and gets a 403.
* Use startswith for URL assertion in consent binding test
* Store consent bindings as per-transaction map to support parallel flows
* Only accept __Host- consent binding cookie on HTTPS
* chore: Update SDK documentation
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Reorganize docs navigation and add Apps documentation
Collapse Providers, Transforms, and Deployment under Servers. Add Apps
section with overview and low-level API pages. Add card images to welcome
page and README. Add NEW tags to recent features.
* Fix missing imports in Apps low-level API code examples
