ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-16 18:49:14 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,572 commits 157 branches 116 tags 100 MiB
Commit graph

204 commits

Author SHA1 Message Date
Jeremiah Lowin
0a619de571
 		Publish FastMCP v4.0.0b3 docs (#4842) 2026-08-14 13:51:05 -04:00
Jeremiah Lowin
0747ce0bc1
 		Publish FastMCP 4.0.0b1 docs to gofastmcp.com (#4695) 2026-07-28 17:26:15 -04:00
Jeremiah Lowin
8cf4506aa9
 		Publish FastMCP 4 (alpha) docs to gofastmcp.com (#4624) 2026-07-23 21:21:01 -04:00
Jeremiah Lowin
c1b0396c0a
 		Block IPv6 transition SSRF bypasses (#4426) 2026-07-05 17:52:57 -04:00
Jeremiah Lowin
67527c1f69
 		Block unsafe OAuth redirect schemes (#4419) 2026-07-05 17:16:10 -04:00
Jeremiah Lowin
cccb529f50
 		Fix DCR redirect URI validation (#4408) 2026-07-05 17:05:13 -04:00
Jeremiah Lowin
de521e651d
 		Fix versioned auth middleware checks (#4401) 2026-06-28 10:43:34 -04:00
Jeremiah Lowin
5de15e0c21
 		Block NAT64 SSRF bypass (#4400) 2026-06-27 12:21:37 -04:00
Jacky Su
0668eb7b80
 		Fix/cimd flow issue (#4206) 2026-06-27 10:57:58 -04:00
Jeremiah Lowin
a612846224
 		fix: bound default OIDC discovery timeout and expose it on provider wrappers (#4374) 2026-06-24 17:16:18 -04:00
Bobby Davidson
7f2d034f4d
 		Forward IdP auth errors to MCP client instead of showing HTML error page (#4293) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-06-24 12:09:09 -04:00
Jeremiah Lowin
3b8538e242
 		Allow private JWT headers (#4290) 2026-06-06 02:23:48 +01:00
Jeremiah Lowin
e58f386bac
 		Log refresh-token misses in OAuthProxy instead of failing silently (#4276) 2026-06-03 11:22:35 -04:00
Jeremiah Lowin
58e0f5320b
 		Decouple FastMCP access token lifetime from upstream expires_in (#4254) 2026-05-30 11:48:23 -04:00
Jeremiah Lowin
53b20168c8
 		Close upstream OAuth clients (#4248) 2026-05-27 19:45:45 -04:00
Bill Easton
802ceaaa6b
 		Add targeted coverage tests (#4230) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-05-25 18:57:28 -04:00
Jeremiah Lowin
b8c9d58d61
 		Migrate auth JWTs to joserfc (#4221) 2026-05-23 09:29:04 -04:00
rgillinlz
81a16ed27f
 		fix(auth): unprefix Azure scopes echoed back to MCP clients (#4130) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-05-20 12:22:24 -04:00
mohanram
0022d8518f
 		Add token_expiry_threshold_seconds for proactive token refresh (#4142) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-05-20 10:47:26 -04:00
Shigechika AIKAWA
2a262438fa
 		fix(auth): add /.well-known/openid-configuration alias for OAuth server metadata (#4167) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 10:36:01 -04:00
Tiago Surjus Kaneta
b0fb2c3ae6
 		Add valid_scopes and extra_authorize_params to WorkOSProvider (#4135) 2026-05-20 10:31:48 -04:00
Bill Easton
344a4f81b5
 		fix(auth): disambiguate auth-denied vs missing component messages (#4165) 2026-05-20 09:36:27 -04:00
Bill Easton
11951585c0
 		fix(tests): hoist azure-identity import out of the OBO test timeout window (#4176) 2026-05-20 09:35:56 -04:00
Kiran Thakkar
cf59a4511f
 		Fix OCI Provider issue in 3.x version. Add OCI auth provider example … (#4116) 
* Fix OCI Provider issue in 3.x version. Add OCI auth provider example and test

* Fix OCI Provider issue in 3.x version. Add OCI auth provider example and test. Fixed a couple of minor issues in README.

* Rerun CI
 2026-05-10 10:08:00 -04:00
Taylor Wilsdon
61e56c683e
 		enh: Add public API for updating OAuthProxy scopes after initialization (#4091) 2026-05-04 15:49:12 -04:00
Carlos Rian
eebdc8c031
 		feat: add AzureB2CProvider for Azure AD B2C user flows (#3995) 2026-04-22 09:24:09 -04:00
Jeremiah Lowin
2d6143c6d8
 		fix: honor upstream refresh token expiry in OAuthProxy (#3990) 2026-04-20 14:03:57 -04:00
Jeremiah Lowin
801385df44
 		fix: bound _refresh_locks with LRU eviction to prevent memory leak (#3968) 2026-04-18 11:07:38 -04:00
Jeremiah Lowin
1e67c53a17
 		Reject dot-segments in redirect URI allowlist matching (#3963) 2026-04-17 17:49:25 -04:00
Jeremiah Lowin
7fb037f20c
 		Harden OAuth Proxy silent consent against AS-in-the-middle (#3960) 2026-04-17 16:39:50 -04:00
Jeremiah Lowin
eb1426251c
 		Allow upstream client_id to be used directly without DCR (#3957) 
Co-authored-by: Claude <noreply@anthropic.com>
 2026-04-17 15:22:44 -04:00
Jeremiah Lowin
82f310fe61
 		AuthKit: auto-bind token audience to resource URL (RFC 8707) (#3905) 2026-04-13 17:11:17 -04:00
Adam Azzam
f21e51794c
 		Allow auth providers to override protected resource base URLs (#3900) 
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-04-13 13:36:55 -04:00
Stephan Eberle
99bf81c64f
 		Add Keycloak OAuth Provider for Enterprise Authentication and local dev (#1937) 2026-04-13 12:23:10 -04:00
Jeremiah Lowin
1d39e26025
 		Fix CIMD clients getting required_scopes instead of valid_scopes (#3836) 2026-04-12 16:34:56 -04:00
Jeremiah Lowin
6592aaa70e
 		fix: accept both client_id and identifier_uri as Azure audience (#3797) 2026-04-08 20:25:42 -04:00
Jeremiah Lowin
2b9d3eee0f
 		fix: use identifier_uri as audience for Azure token validation (#3787) 
* fix: use identifier_uri as audience for Azure token validation

* fix test expectations for identifier_uri audience
 2026-04-07 18:37:52 -04:00
Jeremiah Lowin
e1ea133fb7
 		fix: Cognito token verification checks client_id instead of aud (#3786) 
* fix: Cognito token verification checks client_id instead of aud

* fix: Cognito token verification checks client_id instead of aud

* handle list audience values in Cognito client_id check
 2026-04-07 18:09:43 -04:00
Fatia Kusuma Dewi
5587cb7c43
 		changeable allowed_client_redirect_uris (#3772) 2026-04-06 20:58:09 -04:00
Kakarlamudi Venkata Dhanush
c642d6a5cf
 		fix: propagate upstream_claims in load_access_token (#3750) 2026-04-06 19:55:26 -04:00
AIKAWA Shigechika
5be249ada3
 		fix(google): use sub (user ID) for client_id instead of aud (app ID) (#3722) 2026-03-31 10:33:58 -04:00
Mostafa Kamal
57a7f121d4
 		Add Clerk OAuth provider (#3677) 2026-03-29 11:01:22 -04:00
Jeremy Simon
492db9972f
 		fix: resolve EntraOBOToken dependency injection through MultiAuth (#3609) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-03-25 10:58:19 -04:00
AIKAWA Shigechika
c3f0223bbb
 		fix(google): replace deprecated /oauth2/v1/tokeninfo with /oauth2/v3/userinfo (#3603) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-03-25 10:39:34 -04:00
Jeremiah Lowin
c397e68d39
 		Update ty ignore comments for 0.0.25 compatibility (#3614) 2026-03-24 20:26:26 -04:00
Rushabh Doshi
204e566227
 		Fix loopback redirect URI port matching per RFC 8252 §7.3 (#3589) 
🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-22 19:35:02 -04:00
Jeremiah Lowin
52feff6878
 		Transparently refresh upstream token in OAuthProxy.load_access_token() (#3584) 
* Transparently refresh upstream token in OAuthProxy.load_access_token()

When upstream token validation fails during load_access_token, attempt
to refresh using the stored refresh token before returning None. This
prevents premature 401s that force clients into expensive full re-auth
flows when the upstream token expires.

Co-authored-by: Claude <noreply@anthropic.com>

* Gate transparent refresh on token expiry, add advisory lock

Only attempt upstream refresh when the token is actually expired, not
on any validation failure (scope mismatch, revocation, etc.). Add
per-token advisory lock to prevent concurrent async tasks from racing
to refresh the same upstream token.

* Re-check expiry inside lock, reload from storage after refresh failure

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-03-22 10:43:44 -04:00
Jeremiah Lowin
269c9c9f46
 		Extract TokenCache utility, add caching to GitHubTokenVerifier (#3547) 
* feat: add TokenCache utility and caching to GitHubTokenVerifier

Extract the caching machinery from IntrospectionTokenVerifier into a
shared TokenCache class in fastmcp.utilities.token_cache, then wire
it into both IntrospectionTokenVerifier and GitHubTokenVerifier.

* Remove dead constant, validate negative cache params

* Fix overwrite eviction bug, skip cache on scope lookup failure
 2026-03-18 15:26:09 -04:00
Jeremiah Lowin
bb37c3bb6b
 		fix: reject refresh tokens used as Bearer access tokens (#3524) 2026-03-15 15:21:30 -04:00
Jeremiah Lowin
8fdb3cc27c
 		fix: CSRF double-submit cookie check in consent flow (#3519) 
* Upgrade examples/testing_demo lockfile, drops diskcache (CVE-2025-69872)

* fix: add CSRF double-submit cookie check to consent flow (GHSA-rww4-4w9c-7733)

* fix: preserve CSRF state across concurrent flows, fix test isolation

* fix: reject non-__Host consent-state cookie on HTTPS
 2026-03-15 14:22:01 -04:00