1,594 commits

Author	SHA1	Message	Date
nate nowack	1d932cc778	Fix Azure scope fallback (#4469)	2026-07-09 15:29:50 -04:00
Jeremiah Lowin	9f251bad00	Forward-port Hugging Face auth provider (#4475)	2026-07-08 20:56:07 -04:00
Jeremiah Lowin	4ad78a60ef	Forward-port HTTP host guard compatibility (#4474)	2026-07-08 20:55:56 -04:00
Jeremiah Lowin	fd5d98bd13	Test: HTTP lifespan fires once per process across sessions (#4470)	2026-07-08 20:55:26 -04:00
Jeremiah Lowin	8ba5b89918	Add server-level cache hints (SEP-2549) (#4464)	2026-07-08 09:10:41 -04:00
Jeremiah Lowin	515a2244a2	Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache (#4450)	2026-07-07 08:00:45 -04:00
Jeremiah Lowin	f30f847e1f	Merge pull request #4449 from PrefectHQ/modernize/path-security ... Route skill file access through SDK path-security primitives	2026-07-07 08:00:21 -04:00
Jeremiah Lowin	f0e350942f	Merge pull request #4448 from PrefectHQ/modernize/sampling-deprecation ... Deprecate ctx.sample and add clear errors for push features on 2026 connections	2026-07-07 08:00:08 -04:00
Jeremiah Lowin	7832f884c6	Merge pull request #4453 from PrefectHQ/remove/deprecated-params ... Remove 3.x deprecated parameters and object-mode decorators	2026-07-07 07:59:53 -04:00
Jeremiah Lowin	3cb34034d2	Merge pull request #4451 from PrefectHQ/remove/server-method-deprecations ... Remove 3.0-deprecated FastMCP server methods	2026-07-07 07:59:40 -04:00
Jeremiah Lowin	7c2133a52f	Remove deprecated component-import __getattr__ shims	2026-07-07 07:53:12 -04:00
Jeremiah Lowin	45475bd072	Remove deprecated exclude_args tool parameter	2026-07-07 07:53:12 -04:00
Jeremiah Lowin	7f032bb82e	Remove deprecated tool-level serializer parameter	2026-07-07 07:53:11 -04:00
Jeremiah Lowin	396fb876d3	Apply ruff-format: drop now-unused imports and reflow	2026-07-07 07:53:11 -04:00
Jeremiah Lowin	6a6fdcb2bb	Repoint tests and examples off removed deprecations ... Replaces FastMCP.as_proxy() helper calls with create_proxy(), rewrites the mount() as_proxy=/prefix= kwarg tests to plain mount() (the params are gone), and deletes deprecation-only tests for as_proxy() and remove_tool().	2026-07-07 07:53:11 -04:00
Jeremiah Lowin	e5d9d1f17d	Remove deprecated FastMCP server methods for 4.0 ... Removes deprecations that shipped replacements in 3.0: - FastMCP.as_proxy() classmethod -> create_proxy() - import_server() -> mount() - mount(prefix=) -> namespace= - mount(as_proxy=) -> now meaningless; mounts always invoke lifespan/middleware - add_tool_transformation() -> add_transform(ToolTransform({...})) - remove_tool_transformation() -> pure no-op that warned callers it had no effect; removed entirely - FastMCP.remove_tool() -> mcp.local_provider.remove_tool() Also drops the now-unused URI_PATTERN/re import and FastMCPDeprecationWarning import. The _REMOVED_KWARGS TypeError shim is retained.	2026-07-07 07:53:10 -04:00
Jeremiah Lowin	be8aee3a96	Skip live-import validation for frozen v2 doc snapshots	2026-07-07 07:53:10 -04:00
Jeremiah Lowin	d74f7b5996	Remove deprecated PromptToolMiddleware / ResourceToolMiddleware (3.1) ... Use the PromptsAsTools / ResourcesAsTools transforms instead. The non-deprecated ToolInjectionMiddleware base class is retained.	2026-07-07 07:53:10 -04:00
Jeremiah Lowin	497ed2ea00	Remove deprecated fastmcp.server.openapi shim + FastMCPOpenAPI (3.0)	2026-07-07 07:53:10 -04:00
Jeremiah Lowin	6621024ce4	Drive the FastMCP lifespan through the SDK session manager (#4446)	2026-07-07 07:49:16 -04:00
Jeremiah Lowin	ac78e6f693	Emit one SERVER span per request and adopt spec-correct error codes (#4445)	2026-07-07 07:49:06 -04:00
Jeremiah Lowin	023a578279	Capture SharedContext for task-enabled Docket servers (#4443)	2026-07-07 07:48:49 -04:00
Jeremiah Lowin	13b9ab80ab	Use a single fastmcp import style in protocol-era tests	2026-07-06 22:06:22 -04:00
Jeremiah Lowin	77131edc00	Don't era-gate server-side sampling handlers on modern connections ... The era-gate blocked every ctx.sample/sample_step on a 2026-07-28 connection, but a server-configured sampling handler answers server-side without the client back-channel. Gate only when the request would hit the removed client path; force the handler path (client_available=False) on modern so "fallback" goes straight to the handler instead of a bare client-attempt failure.	2026-07-06 21:49:18 -04:00
Jeremiah Lowin	05be554e85	Apply ruff formatting to attack corpus tests	2026-07-06 21:32:47 -04:00
Jeremiah Lowin	389e3b78e7	Add path-safety attack corpus tests and document skill file confinement	2026-07-06 21:31:56 -04:00
Jeremiah Lowin	17954f569d	Deprecate ctx.sample/sample_step and era-gate sampling+elicit on modern connections	2026-07-06 21:30:03 -04:00
Jeremiah Lowin	3522a98766	Migrate to MCP Python SDK v2 (#4437)	2026-07-06 17:36:45 -04:00
Jeremiah Lowin	691766b5d0	[codex] Fix OpenAPI resource template requests (#4407)	2026-07-05 19:11:03 -04:00
Jeremiah Lowin	47907e0767	Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428)	2026-07-05 19:10:40 -04:00
Jeremiah Lowin	c1b0396c0a	Block IPv6 transition SSRF bypasses (#4426)	2026-07-05 17:52:57 -04:00
Jeremiah Lowin	67527c1f69	Block unsafe OAuth redirect schemes (#4419)	2026-07-05 17:16:10 -04:00
Jeremiah Lowin	57a279928d	Protect streamable HTTP from DNS rebinding (#4405)	2026-07-05 17:11:08 -04:00
Jeremiah Lowin	cccb529f50	Fix DCR redirect URI validation (#4408)	2026-07-05 17:05:13 -04:00
fengguodong	0d8844d5a7	Reject empty env var keys (#4410)	2026-06-29 09:42:06 -04:00
Jeremiah Lowin	de521e651d	Fix versioned auth middleware checks (#4401)	2026-06-28 10:43:34 -04:00
Jeremiah Lowin	feaae683a4	[codex] Fix event store replay isolation (#4402)	2026-06-27 12:49:24 -04:00
Jeremiah Lowin	5de15e0c21	Block NAT64 SSRF bypass (#4400)	2026-06-27 12:21:37 -04:00
Jeremiah Lowin	a1dd8b12e1	Fix dev apps launch escaping (#4399)	2026-06-27 12:18:36 -04:00
Jeremiah Lowin	a8bb1b08c2	Raise fastmcp.ValidationError for invalid tool arguments (#4392) ... Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-06-27 11:14:20 -04:00
Jacky Su	0668eb7b80	Fix/cimd flow issue (#4206)	2026-06-27 10:57:58 -04:00
Jeremiah Lowin	dc4b0e202d	fix(tools): honor serialize_by_alias in tool result serialization (#4391)	2026-06-27 10:24:39 -04:00
Jeremiah Lowin	0cffe41115	fix: validate task tool arguments against declared types (#4373)	2026-06-27 10:03:59 -04:00
Jeremiah Lowin	a612846224	fix: bound default OIDC discovery timeout and expose it on provider wrappers (#4374)	2026-06-24 17:16:18 -04:00
Jeremiah Lowin	ade2b3ff46	fix: bracket IPv6 hosts in server startup log URL (#4372)	2026-06-24 17:15:40 -04:00
Jeremiah Lowin	094908042c	fix(resources): round-trip path values with reserved characters in URI templates (#4368)	2026-06-24 13:56:04 -04:00
Jeremiah Lowin	a13e48ea6f	feat(remote): add --verify flag for TLS certificate verification (#4369)	2026-06-24 12:09:22 -04:00
Bobby Davidson	7f2d034f4d	Forward IdP auth errors to MCP client instead of showing HTML error page (#4293) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-06-24 12:09:09 -04:00
Jianke LIN	ba77e4626b	fix: guard recursive refs in json_schema_to_type (#4312)	2026-06-24 11:53:36 -04:00
Alex LaGuardia	27a0720928	Add real Monty sandbox e2e coverage for CodeMode call_tool (#4274) ... Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-06-24 11:52:27 -04:00