1,420 commits

Author	SHA1	Message	Date
Jeremiah Lowin	0a619de571	Publish FastMCP v4.0.0b3 docs (#4842)	2026-08-14 13:51:05 -04:00
Jeremiah Lowin	98bbec1f14	sync: bring published-docs to main @ v4.0.0b1 (+ whats-new/extensions) (#4700)	2026-07-28 22:45:47 -04:00
Jeremiah Lowin	0747ce0bc1	Publish FastMCP 4.0.0b1 docs to gofastmcp.com (#4695)	2026-07-28 17:26:15 -04:00
Jeremiah Lowin	8cf4506aa9	Publish FastMCP 4 (alpha) docs to gofastmcp.com (#4624)	2026-07-23 21:21:01 -04:00
Jeremiah Lowin	691766b5d0	[codex] Fix OpenAPI resource template requests (#4407)	2026-07-05 19:11:03 -04:00
Jeremiah Lowin	47907e0767	Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428)	2026-07-05 19:10:40 -04:00
Jeremiah Lowin	c1b0396c0a	Block IPv6 transition SSRF bypasses (#4426)	2026-07-05 17:52:57 -04:00
Jeremiah Lowin	67527c1f69	Block unsafe OAuth redirect schemes (#4419)	2026-07-05 17:16:10 -04:00
Jeremiah Lowin	57a279928d	Protect streamable HTTP from DNS rebinding (#4405)	2026-07-05 17:11:08 -04:00
Jeremiah Lowin	cccb529f50	Fix DCR redirect URI validation (#4408)	2026-07-05 17:05:13 -04:00
fengguodong	0d8844d5a7	Reject empty env var keys (#4410)	2026-06-29 09:42:06 -04:00
Jeremiah Lowin	de521e651d	Fix versioned auth middleware checks (#4401)	2026-06-28 10:43:34 -04:00
Jeremiah Lowin	feaae683a4	[codex] Fix event store replay isolation (#4402)	2026-06-27 12:49:24 -04:00
Jeremiah Lowin	5de15e0c21	Block NAT64 SSRF bypass (#4400)	2026-06-27 12:21:37 -04:00
Jeremiah Lowin	a1dd8b12e1	Fix dev apps launch escaping (#4399)	2026-06-27 12:18:36 -04:00
Jeremiah Lowin	a8bb1b08c2	Raise fastmcp.ValidationError for invalid tool arguments (#4392) ... Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-06-27 11:14:20 -04:00
Jacky Su	0668eb7b80	Fix/cimd flow issue (#4206)	2026-06-27 10:57:58 -04:00
Jeremiah Lowin	dc4b0e202d	fix(tools): honor serialize_by_alias in tool result serialization (#4391)	2026-06-27 10:24:39 -04:00
Jeremiah Lowin	0cffe41115	fix: validate task tool arguments against declared types (#4373)	2026-06-27 10:03:59 -04:00
Jeremiah Lowin	a612846224	fix: bound default OIDC discovery timeout and expose it on provider wrappers (#4374)	2026-06-24 17:16:18 -04:00
Jeremiah Lowin	ade2b3ff46	fix: bracket IPv6 hosts in server startup log URL (#4372)	2026-06-24 17:15:40 -04:00
Jeremiah Lowin	094908042c	fix(resources): round-trip path values with reserved characters in URI templates (#4368)	2026-06-24 13:56:04 -04:00
Jeremiah Lowin	a13e48ea6f	feat(remote): add --verify flag for TLS certificate verification (#4369)	2026-06-24 12:09:22 -04:00
Bobby Davidson	7f2d034f4d	Forward IdP auth errors to MCP client instead of showing HTML error page (#4293) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-06-24 12:09:09 -04:00
Jianke LIN	ba77e4626b	fix: guard recursive refs in json_schema_to_type (#4312)	2026-06-24 11:53:36 -04:00
Alex LaGuardia	27a0720928	Add real Monty sandbox e2e coverage for CodeMode call_tool (#4274) ... Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-06-24 11:52:27 -04:00
Jeremiah Lowin	cf1d821129	fix(fs): isolate same-named package imports across providers (#4361)	2026-06-24 10:57:01 -04:00
Yufeng He	9b1a1a04e0	fix: preserve required discriminator tags (#4297) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-06-24 10:36:56 -04:00
Tomasz Czochański	4ce8e2a5d0	Fix: async rate limiting middleware get_client_id callbacks (#4319) ... Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-24 10:27:30 -04:00
Jeremiah Lowin	3b8538e242	Allow private JWT headers (#4290)	2026-06-06 02:23:48 +01:00
Jeremiah Lowin	e58f386bac	Log refresh-token misses in OAuthProxy instead of failing silently (#4276)	2026-06-03 11:22:35 -04:00
René Mulder	0f4f78c464	Fix resource templates with query params on proxied servers (#4251) ... Co-authored-by: René Mulder <rene@silverflow.com>	2026-05-31 14:03:49 -04:00
Jeremiah Lowin	1a06130fcf	Fix GitHub MCP resource integration test (#4253)	2026-05-30 11:48:46 -04:00
Jeremiah Lowin	58e0f5320b	Decouple FastMCP access token lifetime from upstream expires_in (#4254)	2026-05-30 11:48:23 -04:00
Jeremiah Lowin	8e66b0a47a	Upgrade ty to 0.0.39 (#4225)	2026-05-30 11:25:05 -04:00
Jeremiah Lowin	53b20168c8	Close upstream OAuth clients (#4248)	2026-05-27 19:45:45 -04:00
Jeremiah Lowin	140d96aadd	Forward proxy initialize as bridge behavior (#4228)	2026-05-27 10:41:49 -04:00
Bill Easton	802ceaaa6b	Add targeted coverage tests (#4230) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-25 18:57:28 -04:00
Jeremiah Lowin	2bff3725bf	Surface proxy upstream failures (#4227)	2026-05-23 14:56:10 -04:00
Jeremiah Lowin	59223f6e89	Allow pre-bound HTTP sockets (#4222)	2026-05-23 10:08:49 -04:00
Jeremiah Lowin	70013c5a91	Add fastmcp-remote bridge package (#4208)	2026-05-23 10:04:21 -04:00
Jeremiah Lowin	b8c9d58d61	Migrate auth JWTs to joserfc (#4221)	2026-05-23 09:29:04 -04:00
Jeremiah Lowin	9b5d402bf2	Exempt maintainers from MRE auto-close (#4220)	2026-05-23 09:02:44 -04:00
Jeremiah Lowin	e242abee7d	Let ToolResult return an error result via is_error (#4217)	2026-05-22 20:20:52 -04:00
yuyua9	dbf5ee24be	fix(cli): forward stateless flag in uv run path (#4177) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-20 12:22:45 -04:00
rgillinlz	81a16ed27f	fix(auth): unprefix Azure scopes echoed back to MCP clients (#4130) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-20 12:22:24 -04:00
mohanram	0022d8518f	Add token_expiry_threshold_seconds for proactive token refresh (#4142) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-20 10:47:26 -04:00
Bill Easton	9d384ffa7f	feat(code-mode): default sandbox limits and per-execution tool-call cap (#4170) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-20 10:47:12 -04:00
Bill Easton	bdbef49383	fix(code-mode): cancel Monty sandbox future on task cancellation (#4169)	2026-05-20 10:36:31 -04:00
Shigechika AIKAWA	2a262438fa	fix(auth): add /.well-known/openid-configuration alias for OAuth server metadata (#4167) ... Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-20 10:36:01 -04:00