767 commits

Author	SHA1	Message	Date
nate nowack	1d932cc778	Fix Azure scope fallback (#4469)	2026-07-09 15:29:50 -04:00
Jeremiah Lowin	9f251bad00	Forward-port Hugging Face auth provider (#4475)	2026-07-08 20:56:07 -04:00
Jeremiah Lowin	4ad78a60ef	Forward-port HTTP host guard compatibility (#4474)	2026-07-08 20:55:56 -04:00
Jeremiah Lowin	fd5d98bd13	Test: HTTP lifespan fires once per process across sessions (#4470)	2026-07-08 20:55:26 -04:00
Jeremiah Lowin	8ba5b89918	Add server-level cache hints (SEP-2549) (#4464)	2026-07-08 09:10:41 -04:00
Jeremiah Lowin	f30f847e1f	Merge pull request #4449 from PrefectHQ/modernize/path-security ... Route skill file access through SDK path-security primitives	2026-07-07 08:00:21 -04:00
Jeremiah Lowin	f0e350942f	Merge pull request #4448 from PrefectHQ/modernize/sampling-deprecation ... Deprecate ctx.sample and add clear errors for push features on 2026 connections	2026-07-07 08:00:08 -04:00
Jeremiah Lowin	396fb876d3	Apply ruff-format: drop now-unused imports and reflow	2026-07-07 07:53:11 -04:00
Jeremiah Lowin	6a6fdcb2bb	Repoint tests and examples off removed deprecations ... Replaces FastMCP.as_proxy() helper calls with create_proxy(), rewrites the mount() as_proxy=/prefix= kwarg tests to plain mount() (the params are gone), and deletes deprecation-only tests for as_proxy() and remove_tool().	2026-07-07 07:53:11 -04:00
Jeremiah Lowin	6621024ce4	Drive the FastMCP lifespan through the SDK session manager (#4446)	2026-07-07 07:49:16 -04:00
Jeremiah Lowin	ac78e6f693	Emit one SERVER span per request and adopt spec-correct error codes (#4445)	2026-07-07 07:49:06 -04:00
Jeremiah Lowin	023a578279	Capture SharedContext for task-enabled Docket servers (#4443)	2026-07-07 07:48:49 -04:00
Jeremiah Lowin	13b9ab80ab	Use a single fastmcp import style in protocol-era tests	2026-07-06 22:06:22 -04:00
Jeremiah Lowin	77131edc00	Don't era-gate server-side sampling handlers on modern connections ... The era-gate blocked every ctx.sample/sample_step on a 2026-07-28 connection, but a server-configured sampling handler answers server-side without the client back-channel. Gate only when the request would hit the removed client path; force the handler path (client_available=False) on modern so "fallback" goes straight to the handler instead of a bare client-attempt failure.	2026-07-06 21:49:18 -04:00
Jeremiah Lowin	05be554e85	Apply ruff formatting to attack corpus tests	2026-07-06 21:32:47 -04:00
Jeremiah Lowin	389e3b78e7	Add path-safety attack corpus tests and document skill file confinement	2026-07-06 21:31:56 -04:00
Jeremiah Lowin	17954f569d	Deprecate ctx.sample/sample_step and era-gate sampling+elicit on modern connections	2026-07-06 21:30:03 -04:00
Jeremiah Lowin	3522a98766	Migrate to MCP Python SDK v2 (#4437)	2026-07-06 17:36:45 -04:00
Jeremiah Lowin	691766b5d0	[codex] Fix OpenAPI resource template requests (#4407)	2026-07-05 19:11:03 -04:00
Jeremiah Lowin	c1b0396c0a	Block IPv6 transition SSRF bypasses (#4426)	2026-07-05 17:52:57 -04:00
Jeremiah Lowin	67527c1f69	Block unsafe OAuth redirect schemes (#4419)	2026-07-05 17:16:10 -04:00
Jeremiah Lowin	57a279928d	Protect streamable HTTP from DNS rebinding (#4405)	2026-07-05 17:11:08 -04:00
Jeremiah Lowin	cccb529f50	Fix DCR redirect URI validation (#4408)	2026-07-05 17:05:13 -04:00
Jeremiah Lowin	de521e651d	Fix versioned auth middleware checks (#4401)	2026-06-28 10:43:34 -04:00
Jeremiah Lowin	feaae683a4	[codex] Fix event store replay isolation (#4402)	2026-06-27 12:49:24 -04:00
Jeremiah Lowin	5de15e0c21	Block NAT64 SSRF bypass (#4400)	2026-06-27 12:21:37 -04:00
Jeremiah Lowin	a8bb1b08c2	Raise fastmcp.ValidationError for invalid tool arguments (#4392) ... Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-06-27 11:14:20 -04:00
Jacky Su	0668eb7b80	Fix/cimd flow issue (#4206)	2026-06-27 10:57:58 -04:00
Jeremiah Lowin	0cffe41115	fix: validate task tool arguments against declared types (#4373)	2026-06-27 10:03:59 -04:00
Jeremiah Lowin	a612846224	fix: bound default OIDC discovery timeout and expose it on provider wrappers (#4374)	2026-06-24 17:16:18 -04:00
Jeremiah Lowin	ade2b3ff46	fix: bracket IPv6 hosts in server startup log URL (#4372)	2026-06-24 17:15:40 -04:00
Bobby Davidson	7f2d034f4d	Forward IdP auth errors to MCP client instead of showing HTML error page (#4293) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-06-24 12:09:09 -04:00
Tomasz Czochański	4ce8e2a5d0	Fix: async rate limiting middleware get_client_id callbacks (#4319) ... Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-24 10:27:30 -04:00
Jeremiah Lowin	3b8538e242	Allow private JWT headers (#4290)	2026-06-06 02:23:48 +01:00
Jeremiah Lowin	e58f386bac	Log refresh-token misses in OAuthProxy instead of failing silently (#4276)	2026-06-03 11:22:35 -04:00
René Mulder	0f4f78c464	Fix resource templates with query params on proxied servers (#4251) ... Co-authored-by: René Mulder <rene@silverflow.com>	2026-05-31 14:03:49 -04:00
Jeremiah Lowin	58e0f5320b	Decouple FastMCP access token lifetime from upstream expires_in (#4254)	2026-05-30 11:48:23 -04:00
Jeremiah Lowin	53b20168c8	Close upstream OAuth clients (#4248)	2026-05-27 19:45:45 -04:00
Jeremiah Lowin	140d96aadd	Forward proxy initialize as bridge behavior (#4228)	2026-05-27 10:41:49 -04:00
Bill Easton	802ceaaa6b	Add targeted coverage tests (#4230) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-25 18:57:28 -04:00
Jeremiah Lowin	2bff3725bf	Surface proxy upstream failures (#4227)	2026-05-23 14:56:10 -04:00
Jeremiah Lowin	59223f6e89	Allow pre-bound HTTP sockets (#4222)	2026-05-23 10:08:49 -04:00
Jeremiah Lowin	b8c9d58d61	Migrate auth JWTs to joserfc (#4221)	2026-05-23 09:29:04 -04:00
Jeremiah Lowin	e242abee7d	Let ToolResult return an error result via is_error (#4217)	2026-05-22 20:20:52 -04:00
rgillinlz	81a16ed27f	fix(auth): unprefix Azure scopes echoed back to MCP clients (#4130) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-20 12:22:24 -04:00
mohanram	0022d8518f	Add token_expiry_threshold_seconds for proactive token refresh (#4142) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-20 10:47:26 -04:00
Shigechika AIKAWA	2a262438fa	fix(auth): add /.well-known/openid-configuration alias for OAuth server metadata (#4167) ... Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-20 10:36:01 -04:00
Bill Easton	1c4069efa3	fix(proxy): restore _current_server in _restore_request_context (#4168)	2026-05-20 10:34:00 -04:00
Tiago Surjus Kaneta	b0fb2c3ae6	Add valid_scopes and extra_authorize_params to WorkOSProvider (#4135)	2026-05-20 10:31:48 -04:00
Bill Easton	2d61d8a46b	fix: add OTEL spans to sampling step and tool execution (#4059) ... Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-20 09:38:58 -04:00