Changes settings.home from `Path.home() / ".fastmcp"` to use platformdirs.user_data_dir(), following platform conventions (~/Library/Application Support on macOS, ~/.local/share on Linux, %APPDATA% on Windows).
* bug fix in `fastmcp install claude-code`
Calling the CLI like below command doenst end up working:
```
fastmcp install claude-code "$SERVER_FILE" \
--python 3.12 \
--env "DOCS_DIR=$DOCS_DIR" \
--env "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY" \
--with fastmcp \
--with anthropic \
--with click
```
It errors out like:
```
Failed to install 'foo-mcp' in Claude Code: Invalid environment variable format: foo-mcp, environment variables should be added as: -e KEY1=value1
-e KEY2=value2
```
The fix was simply ensuring that the claude code mcp command gets mcp name directly.
* Apply suggestion from @jlowin
---------
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
* Add optional authorization consent screen for OAuth providers
Adds `require_authorization_consent` parameter (default True) to OAuthProxy and all providers. When disabled, authorization skips the consent screen for local development/testing. Logs security warning when disabled.
* Update warning message to use 'authorization consent screen'
* Replace asyncio.sleep() with anyio.sleep()
- Replace asyncio.sleep() in error_handling.py retry middleware
- Replace asyncio.sleep() in oauth.py callback shutdown
- Keep asyncio.TimeoutError check for Python 3.10 compatibility
- Add anyio import to error_handling.py
All core library sleep calls now use anyio primitives. Tests and
example code still use asyncio where appropriate.
* Replace OAuth asyncio.Future with anyio.Event pattern
- Create OAuthCallbackResult dataclass for result storage
- Replace Future with Event + result container pattern
- Update oauth_callback.py to use anyio.Event coordination
- Update auth/oauth.py callback_handler to use Event pattern
- Remove asyncio imports from OAuth flow
OAuth callback now uses anyio primitives for async coordination
instead of asyncio.Future.
* Remove asyncio fire-and-forget task hack from Context
- Remove _try_flush_notifications() method entirely
- Update _queue_*_list_changed() to only queue notifications
- Remove asyncio import from context.py
- Keep _flush_notifications() for deferred sending on context exit
Notifications now flush reliably on request completion (__aexit__)
instead of attempting immediate delivery with asyncio.create_task().
Slight delay is acceptable - all notifications are deduplicated and
sent when the MCP request handler completes.
* Use anyio as testing backend
* Remove asyncio markers
* Update streamable http tests
* Replace all subprocess tests
* Replace anyio task groups with asyncio context managers in tests
- Convert run_server_async from anyio task group pattern to asyncio.create_task with async context manager
- Remove task_group fixture from conftest
- Update all test fixtures to use async with run_server_async pattern
- Remove TaskGroup imports from all test files
- Tests now work with pytest-asyncio instead of pytest-anyio
* Update test_github_provider_integration.py
* Implement icon support in fastmcp
* Fix icon feature tests
- Update snapshot for ResourceTemplate to include icons field
- Remove OAuth mounting tests (belong to PR #2119, not this feature)
* Update docs
* Customize consent screen
* Use server website link if available
* Anchor link shouldnt have trailing slash
* Remove 'a FastMCP server named' from consent page message
* Update docs
* Implement icon support in fastmcp
* Fix icon feature tests
- Update snapshot for ResourceTemplate to include icons field
- Remove OAuth mounting tests (belong to PR #2119, not this feature)
* Update docs
* Add issuer_url parameter to OAuth providers for mounting scenarios
* Add get_well_known_routes
* Update docs
* Improve docs and tests
* Trigger CI
* Fix conditional test execution for Windows
* Upgrade to MCP 1.17+ with RFC 9728 compliance
Updates FastMCP to require MCP 1.17+ and implements RFC 9728-compliant
OAuth protected resource metadata URL handling.
The key change is that .well-known/oauth-protected-resource endpoints
are now registered at path-aware locations. For example, if an MCP
server is mounted at /mcp, the metadata endpoint is now at
/.well-known/oauth-protected-resource/mcp instead of
/.well-known/oauth-protected-resource.
This ensures proper OAuth discovery for path-based resource servers
and aligns with the MCP SDK's implementation of RFC 9728 §3.1.
Changes include:
- Update minimum MCP version from 1.12.4 to 1.17.0
- Use build_resource_metadata_url() for RFC 9728 compliance
- Configure CI to test with latest package versions (--upgrade)
- Update tests for path-aware metadata URLs
- Add icons field to Tool model (introduced in MCP 1.17)
* Fix RemoteAuthProvider integration tests for RFC 9728
* Fix parameterized test for nested base URL paths