ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-18 19:44:19 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,609 commits 154 branches 116 tags 100 MiB
Commit graph

27 commits

Author SHA1 Message Date
Jeremiah Lowin
3522a98766
 		Migrate to MCP Python SDK v2 (#4437) 2026-07-06 17:36:45 -04:00
Jeremiah Lowin
67527c1f69
 		Block unsafe OAuth redirect schemes (#4419) 2026-07-05 17:16:10 -04:00
Jeremiah Lowin
cccb529f50
 		Fix DCR redirect URI validation (#4408) 2026-07-05 17:05:13 -04:00
Jacky Su
0668eb7b80
 		Fix/cimd flow issue (#4206) 2026-06-27 10:57:58 -04:00
Bobby Davidson
7f2d034f4d
 		Forward IdP auth errors to MCP client instead of showing HTML error page (#4293) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-06-24 12:09:09 -04:00
Jeremiah Lowin
e58f386bac
 		Log refresh-token misses in OAuthProxy instead of failing silently (#4276) 2026-06-03 11:22:35 -04:00
Jeremiah Lowin
58e0f5320b
 		Decouple FastMCP access token lifetime from upstream expires_in (#4254) 2026-05-30 11:48:23 -04:00
Jeremiah Lowin
53b20168c8
 		Close upstream OAuth clients (#4248) 2026-05-27 19:45:45 -04:00
mohanram
0022d8518f
 		Add token_expiry_threshold_seconds for proactive token refresh (#4142) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-05-20 10:47:26 -04:00
Taylor Wilsdon
61e56c683e
 		enh: Add public API for updating OAuthProxy scopes after initialization (#4091) 2026-05-04 15:49:12 -04:00
Jeremiah Lowin
2d6143c6d8
 		fix: honor upstream refresh token expiry in OAuthProxy (#3990) 2026-04-20 14:03:57 -04:00
Jeremiah Lowin
801385df44
 		fix: bound _refresh_locks with LRU eviction to prevent memory leak (#3968) 2026-04-18 11:07:38 -04:00
Jeremiah Lowin
eb1426251c
 		Allow upstream client_id to be used directly without DCR (#3957) 
Co-authored-by: Claude <noreply@anthropic.com>
 2026-04-17 15:22:44 -04:00
Adam Azzam
f21e51794c
 		Allow auth providers to override protected resource base URLs (#3900) 
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-04-13 13:36:55 -04:00
Jeremiah Lowin
1d39e26025
 		Fix CIMD clients getting required_scopes instead of valid_scopes (#3836) 2026-04-12 16:34:56 -04:00
Fatia Kusuma Dewi
5587cb7c43
 		changeable allowed_client_redirect_uris (#3772) 2026-04-06 20:58:09 -04:00
Kakarlamudi Venkata Dhanush
c642d6a5cf
 		fix: propagate upstream_claims in load_access_token (#3750) 2026-04-06 19:55:26 -04:00
Jeremiah Lowin
c397e68d39
 		Update ty ignore comments for 0.0.25 compatibility (#3614) 2026-03-24 20:26:26 -04:00
Jeremiah Lowin
52feff6878
 		Transparently refresh upstream token in OAuthProxy.load_access_token() (#3584) 
* Transparently refresh upstream token in OAuthProxy.load_access_token()

When upstream token validation fails during load_access_token, attempt
to refresh using the stored refresh token before returning None. This
prevents premature 401s that force clients into expensive full re-auth
flows when the upstream token expires.

Co-authored-by: Claude <noreply@anthropic.com>

* Gate transparent refresh on token expiry, add advisory lock

Only attempt upstream refresh when the token is actually expired, not
on any validation failure (scope mismatch, revocation, etc.). Add
per-token advisory lock to prevent concurrent async tasks from racing
to refresh the same upstream token.

* Re-check expiry inside lock, reload from storage after refresh failure

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-03-22 10:43:44 -04:00
Jeremiah Lowin
bb37c3bb6b
 		fix: reject refresh tokens used as Bearer access tokens (#3524) 2026-03-15 15:21:30 -04:00
Jeremiah Lowin
32dfe50f39
 		Treat refresh_expires_in=0 as missing, fall back to 30-day default (#3514) 
Keycloak returns refresh_expires_in=0 for offline tokens (offline_access scope),
meaning "no fixed time-based expiry". The truthiness check on this value caused
the proxy to skip issuing a PROXY_RT, forcing browser re-auth every hour.

Closes #3509

🤖 Generated with Claude Code

Co-authored-by: Marvin Context Protocol <41898282+Marvin Context Protocol@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
 2026-03-15 11:49:50 -04:00
Jeremiah Lowin
ea529f6a49
 		feat: make upstream_client_secret optional in OAuthProxy (#3486) 
* feat: make upstream_client_secret optional in OAuthProxy

Extract _create_upstream_oauth_client() factory method for subclass
override. Cookie signing falls back to JWT key material when no secret.

* fix: include client_id in revocation requests for public clients

* fix: use factory method for revocation auth
 2026-03-15 11:14:56 -04:00
Jeremiah Lowin
799c4f1673
 		Escape client_id in OAuth consent details (#3418) 
🤖 Generated with GPT-5.2-Codex
 2026-03-06 17:33:12 -05:00
Jeremiah Lowin
880d835ccc
 		Add CIMD (Client ID Metadata Document) support for OAuth (#2871) 2026-02-06 13:44:52 -05:00
claude[bot]
cec40b378d Use MemoryStore for OAuth proxy tests 
Updated all OAuthProxy test instantiations to use MemoryStore instead of defaulting to DiskStore, avoiding SQLite timeout issues on Windows and improving test performance.

Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>
 2026-02-01 02:30:05 +00:00
Abhijeeth Padarthi
cee99d1210
 		Normalize resource URLs before comparison to support RFC 8707 query parameters (#2967) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-01-22 19:41:02 -05:00
Jeremiah Lowin
23bfdf0680
 		Consolidate test fixtures and refactor large test files (#2941) 2026-01-19 15:18:35 -05:00