- Updated docs/deployment/http.mdx to import EventStore from fastmcp.server.event_store
- Added SSE polling documentation section with correct imports
- Resolves merge conflict by not exporting EventStore from root __init__.py
All OAuth providers now return correct invalid_client error codes
instead of unauthorized_client for auth failures. Previously only
OAuthProxy had this fix; now OAuthProvider (and InMemoryOAuthProvider)
also benefit.
The pytest-retry plugin was causing teardown crashes due to a bug with
pytest's tmp_path fixture stash. Removing `@pytest.mark.flaky` and instead
improving the rate limit detection to properly skip tests on 429 errors.
Also fixed a brittle error message regex - GitHub changed their error
format from "tool not found" to "unknown tool".
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
* Fix RFC 8414 path-aware authorization server metadata discovery
Override get_well_known_routes() in OAuthProvider to rewrite the
authorization server metadata route to be path-aware based on issuer_url,
matching how protected resource metadata already works.
Closes#2527
* Update readme
The MCP SDK now validates that client_secret is provided if it's set,
regardless of token_endpoint_auth_method. Since the proxy uses 'none'
for client auth (handling upstream auth itself), we must also set
client_secret=None to be consistent.
- Bump mcp SDK to >=1.23.1
- Add `client_secret_basic` authentication support (SDK PR #1334)
- TokenHandler now wraps SDK's handle() to transform `unauthorized_client`
to `invalid_client` on 401 responses per OAuth 2.1 spec
- Update `sample()` return type to use SDK's SamplingMessageContentBlock
- Update test expectations for new SDK fields (`task`, `_meta`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Wrap responder.respond() to capture the InitializeResult before it's
sent to the write stream, then return it through the middleware chain.
This allows middleware (e.g., logging) to access the server's initialize
response, not just the client's request.
* Initialize 2.14 deprecation removal branch
* Remove deprecated FASTMCP_SERVER_ environment variable prefix (#2330)
* Remove deprecated Context.get_http_request method (#2332)
* Remove fastmcp.Image top-level import (deprecated 2.8.1) (#2334)
* Remove test warnings (#2331)
* Create new branch and fix issue
* Remove deprecated client parameter from FastMCPProxy (#2333)
* Remove deprecated run_streamable_http_async method (#2338)
* Remove deprecated sse_app method (#2337)
* Remove deprecated run_sse_async method (#2335)
* Remove deprecated run_sse_async method
* Update CLI and tests to use run_http_async(transport="sse")
- Change CLI to call run_http_async with transport="sse" instead of run_sse_async
- Update test to mock run_http_async with create=True for v1 servers
* Revert CLI changes - v1 servers do have run_sse_async
- Keep CLI calling run_sse_async() for v1 compatibility
- Update test to mock run_sse_async (which exists on v1)
* Remove unnecessary type ignore for run_sse_async
Method exists on v1 FastMCP class, no type error
* Remove unused imports after test deletion
* Remove deprecated streamable_http_app method (#2336)
* Remove deprecated dependencies parameter from FastMCP constructor (#2340)
* Remove output_schema=False support (deprecated 2.11.4) (#2339)
* Remove deprecated client parameter from FastMCPProxy (#2333)
* Delete deprecated test_output_schema_false.py
Tests functionality that has been removed
* Remove deprecated BearerAuthProvider module (#2341)
* Remove resource_prefix_format="protocol" support (deprecated 2.4.0) (#2342)
* Remove resource_prefix_format="protocol" support (fixes#2195)
Removes deprecated protocol format (prefix+resource://path) and keeps only
path format (resource://prefix/path). Since only one format remains:
- Removed resource_prefix_format from settings, FastMCP.__init__, and helpers
- Simplified add_resource_prefix, remove_resource_prefix, has_resource_prefix
- Removed MountedServer.resource_prefix_format field
- Deleted tests for protocol format
All resource prefixes now use path format exclusively.
* Clean up resource_prefix_format references
- Remove from test files
- Update documentation to remove protocol format section
- Move custom HTTP routes note to mounting section
- Remove resource_prefix_format from settings docs
* Use inline version note instead of badge for prefix format
* Remove obsolete test functions and update docs
- Delete test functions that no longer assert anything
- Remove proxy.mdx reference to deleted prefix format section
* Format error messages per ruff
* Remove from_client classmethod (deprecated 2.8.0) (#2343)
* Remove deprecated from_client classmethod (fixes#2192)
* Remove unused Client import
* Remove add_resource_fn method (deprecated 2.7.0) (#2345)
* Update SDK
* Add missing imports for exclude_args deprecation warning
* Fix Azure provider to handle OIDC scopes correctly
OIDC scopes (openid, profile, email, offline_access) were being
incorrectly prefixed with identifier_uri, causing Azure to reject
authorization requests. This fix:
- Detects OIDC scopes and sends them unprefixed to Azure
- Filters OIDC scopes from token validation (Azure doesn't include
them in access token scp claims)
- Still advertises OIDC scopes to clients via valid_scopes
- Also handles dot-notation scopes (e.g., User.Read) correctly
Fixes#2451, #2420
* Fix dot-notation scopes to be prefixed (custom scopes can have dots)
* Improve Azure scope handling docs with clear examples
* Add Discord OAuth provider and corresponding tests
* Update DiscordProvider client_secret and required_scopes documentation
* Add Discord to authentication support list in README
* Fix Discord token verifier to match actual API response format
Discord's /api/oauth2/@me endpoint returns:
- "scopes" as a list, not "scope" as a space-separated string
- "expires" as ISO timestamp, not "expires_in" as seconds
- "user" data directly in the response (no need for extra API call)
* Simplify Discord token verifier
---------
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
* Fix OAuth proxy refresh token storage for multi-instance deployments
- Use pluggable client_storage instead of local dict for refresh tokens
- Store refresh tokens by SHA-256 hash for defense in depth
- Remove unused access token and relationship mapping stores
- Simplify revocation logic
* Address review feedback for refresh token storage
- Use calculated refresh_expires_in for TTL instead of hardcoded 30 days
- Populate expires_at field with actual expiry timestamp
- Add client_id validation in load_refresh_token to prevent cross-client token usage
* fix: add title attribute to ProxyTool, ProxyResource, ProxyTemplate, and ProxyPrompt
* test: add title assertions for proxy tools, resources, and prompts
* Add consent_csp_policy parameter to OAuthProxy
Allows customization or disabling of CSP directives on the consent page.
Fixes#2476.
* Add consent_csp_policy to OIDCProxy and update docs
* Fix HTML injection vulnerability in CSP policy
HTML-escape the CSP policy value before inserting into meta tag to prevent HTML injection when CSP policies contain quotes.
Deep copy parent_defs before passing to compress_schema to prevent
mutation from affecting parent tool schemas when child tools hide
parameters that remove all $ref usage.
Corrects the typo in the VersionBadge component in docs/servers/icons.mdx. The version number was incorrectly displayed as 2.14.0 but should be 2.13.0 to match the actual current version of FastMCP.
Fixes issue #2487
* sk-provider updates - aud not enforce, scopes enforce if present
* updating env_prefix, adding debug logs
* updating docs
* ruff formatting
* not changing prefix for backward compatiblity
* backward compatibility changes
* give more preference to base_url than mcp_url if both passed
* updating docs
* refactor
* updating example server
* updating readme of example
* updating docs
* updating tests to reflect what should ideally go in the parameter
