- Remove info/warning logs for allowed_client_redirect_uris
- Add 'and use persistent storage' to production guidance for JWT signing key and token encryption key
Use direct imports for non-deprecated items (ENV_FILE, ExtendedEnvSettingsSource,
ExtendedSettingsConfigDict) and settings_module for the deprecated settings instance.
This test file was testing the old oidc_proxy module which has been renamed
to oidc_dcr_proxy. The module is only used internally by providers and doesn't
need backwards compatibility.
Use ExtendedSettingsConfigDict instead of SettingsConfigDict in all provider
Settings classes to support env_prefixes field. This matches the pattern used
in src/fastmcp/settings.py and resolves type checking errors.
Changed all 6 provider files from 'from fastmcp.settings import settings'
to 'import fastmcp.settings as settings_module' to avoid triggering the
settings import deprecation warning.
Also simplified deprecation tests to only verify imports and subclass
relationships without instantiating providers.
Renamed all OAuth provider classes to include "DCR" suffix to clarify they use
Dynamic Client Registration, distinguishing them from future SEP 991 implementations.
Provider renames:
- GitHubProvider → GitHubDCRProvider
- GoogleProvider → GoogleDCRProvider
- AzureProvider → AzureDCRProvider
- WorkOSProvider → WorkOSDCRProvider
- Auth0Provider → Auth0DCRProvider
- AWSCognitoProvider → AWSCognitoDCRProvider
Changes:
- Renamed all provider classes and settings classes with DCR suffix
- Updated environment variable prefixes to include _DCR_
- Added backwards compatibility via env_prefixes array (old vars still work)
- Created deprecated alias classes that emit deprecation warnings
- Updated all provider tests to use new DCR naming
- Fixed Auth0 tests to use oidc_dcr_proxy instead of deprecated oidc_proxy
- Created deprecation test suite to verify old names can be imported
Renames all OAuth providers that inherit from OAuthDCRProxy to explicitly
include "DCR" in their names, clarifying their Dynamic Client Registration
implementation approach.
Changes:
- GitHubProvider → GitHubDCRProvider
- GoogleProvider → GoogleDCRProvider
- AzureProvider → AzureDCRProvider
- WorkOSProvider → WorkOSDCRProvider
- Auth0Provider → Auth0DCRProvider
- AWSCognitoProvider → AWSCognitoDCRProvider
All old names remain as deprecated aliases with warnings that respect
settings.deprecation_warnings. Environment variables updated to include
_DCR_ with backwards compatibility via env_prefixes.
* Replace asyncio.sleep() with anyio.sleep()
- Replace asyncio.sleep() in error_handling.py retry middleware
- Replace asyncio.sleep() in oauth.py callback shutdown
- Keep asyncio.TimeoutError check for Python 3.10 compatibility
- Add anyio import to error_handling.py
All core library sleep calls now use anyio primitives. Tests and
example code still use asyncio where appropriate.
* Replace OAuth asyncio.Future with anyio.Event pattern
- Create OAuthCallbackResult dataclass for result storage
- Replace Future with Event + result container pattern
- Update oauth_callback.py to use anyio.Event coordination
- Update auth/oauth.py callback_handler to use Event pattern
- Remove asyncio imports from OAuth flow
OAuth callback now uses anyio primitives for async coordination
instead of asyncio.Future.
* Remove asyncio fire-and-forget task hack from Context
- Remove _try_flush_notifications() method entirely
- Update _queue_*_list_changed() to only queue notifications
- Remove asyncio import from context.py
- Keep _flush_notifications() for deferred sending on context exit
Notifications now flush reliably on request completion (__aexit__)
instead of attempting immediate delivery with asyncio.create_task().
Slight delay is acceptable - all notifications are deduplicated and
sent when the MCP request handler completes.
* Use anyio as testing backend
* Remove asyncio markers
* Update streamable http tests
* Replace all subprocess tests
* Replace anyio task groups with asyncio context managers in tests
- Convert run_server_async from anyio task group pattern to asyncio.create_task with async context manager
- Remove task_group fixture from conftest
- Update all test fixtures to use async with run_server_async pattern
- Remove TaskGroup imports from all test files
- Tests now work with pytest-asyncio instead of pytest-anyio
* Update test_github_provider_integration.py
* Implement icon support in fastmcp
* Fix icon feature tests
- Update snapshot for ResourceTemplate to include icons field
- Remove OAuth mounting tests (belong to PR #2119, not this feature)
* Update docs
* Customize consent screen
* Use server website link if available
* Anchor link shouldnt have trailing slash
* Remove 'a FastMCP server named' from consent page message
* Update docs
* Implement icon support in fastmcp
* Fix icon feature tests
- Update snapshot for ResourceTemplate to include icons field
- Remove OAuth mounting tests (belong to PR #2119, not this feature)
* Update docs
* Add issuer_url parameter to OAuth providers for mounting scenarios
* Add get_well_known_routes
* Update docs
* Improve docs and tests
* Trigger CI
* Fix conditional test execution for Windows
* Upgrade to MCP 1.17+ with RFC 9728 compliance
Updates FastMCP to require MCP 1.17+ and implements RFC 9728-compliant
OAuth protected resource metadata URL handling.
The key change is that .well-known/oauth-protected-resource endpoints
are now registered at path-aware locations. For example, if an MCP
server is mounted at /mcp, the metadata endpoint is now at
/.well-known/oauth-protected-resource/mcp instead of
/.well-known/oauth-protected-resource.
This ensures proper OAuth discovery for path-based resource servers
and aligns with the MCP SDK's implementation of RFC 9728 §3.1.
Changes include:
- Update minimum MCP version from 1.12.4 to 1.17.0
- Use build_resource_metadata_url() for RFC 9728 compliance
- Configure CI to test with latest package versions (--upgrade)
- Update tests for path-aware metadata URLs
- Add icons field to Tool model (introduced in MCP 1.17)
* Fix RemoteAuthProvider integration tests for RFC 9728
* Fix parameterized test for nested base URL paths
