1,426 commits

Author	SHA1	Message	Date
Jeremiah Lowin	538611b50b	Backport CIMD assertion audience fix to v3 (#4799) ... * Backport CIMD assertion audience fix * test(auth): exercise CIMD audience mismatch 🤖 Generated with OpenAI Codex * Revert "test(auth): exercise CIMD audience mismatch" This reverts commit 9225572505. * test(auth): exercise CIMD audience mismatch 🤖 Generated with OpenAI Codex --------- Co-authored-by: zzstoatzz <thrast36@gmail.com>	2026-08-10 15:42:16 -05:00
Jeremiah Lowin	fcdf422e54	Backport #4412 to 3.x: support trusted SSRF proxies (#4755)	2026-08-05 10:29:38 -04:00
Jeremiah Lowin	5daa91bafe	Backport #4492 to release/3.x: don't mutate the caller's schema in compress_schema (#4663) ... * Don't mutate the caller's schema in compress_schema (#4492) (cherry picked from commit 6202008cf3) * Copy schemas iteratively so deep nesting still compresses (cherry picked from commit 2662e675ca) * Keep $defs when the reference scan hits its depth limit (cherry picked from commit 054a6cf3c2) --------- Co-authored-by: WinkleMad <winklemad@outlook.com>	2026-07-27 15:02:41 -04:00
Jeremiah Lowin	49c5ed5581	Make transformed tool required order deterministic (#4564) (#4665) ... (cherry picked from commit 7934124fb5) Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-07-27 13:11:04 -04:00
Jeremiah Lowin	87ba18c898	Serialize deep object query parameters (#4523) (#4664) ... (cherry picked from commit b623c23183)	2026-07-27 13:10:57 -04:00
Jeremiah Lowin	aa8ab1ee66	Fix Azure scope fallback (#4469) (#4662) ... (cherry picked from commit 1d932cc778) Co-authored-by: nate nowack <thrast36@gmail.com>	2026-07-27 13:10:27 -04:00
Kaki Wang	93696a59f4	Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#4517) (#4631) ... (cherry picked from commit 1fca15abe6) Co-authored-by: Burt Matthews <80060660+earfman@users.noreply.github.com>	2026-07-26 14:02:20 -04:00
shaun smith	d929882f77	Hugging Face Auth Integration (#4385) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-07-08 20:27:44 -04:00
Jeremiah Lowin	5fe4fae535	Restore HTTP host guard compatibility (#4472)	2026-07-08 20:16:44 -04:00
Jeremiah Lowin	400db61b8b	Relax host origin guard defaults (#4439)	2026-07-06 20:59:28 -04:00
Jeremiah Lowin	691766b5d0	[codex] Fix OpenAPI resource template requests (#4407)	2026-07-05 19:11:03 -04:00
Jeremiah Lowin	47907e0767	Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift (#4428)	2026-07-05 19:10:40 -04:00
Jeremiah Lowin	c1b0396c0a	Block IPv6 transition SSRF bypasses (#4426)	2026-07-05 17:52:57 -04:00
Jeremiah Lowin	67527c1f69	Block unsafe OAuth redirect schemes (#4419)	2026-07-05 17:16:10 -04:00
Jeremiah Lowin	57a279928d	Protect streamable HTTP from DNS rebinding (#4405)	2026-07-05 17:11:08 -04:00
Jeremiah Lowin	cccb529f50	Fix DCR redirect URI validation (#4408)	2026-07-05 17:05:13 -04:00
fengguodong	0d8844d5a7	Reject empty env var keys (#4410)	2026-06-29 09:42:06 -04:00
Jeremiah Lowin	de521e651d	Fix versioned auth middleware checks (#4401)	2026-06-28 10:43:34 -04:00
Jeremiah Lowin	feaae683a4	[codex] Fix event store replay isolation (#4402)	2026-06-27 12:49:24 -04:00
Jeremiah Lowin	5de15e0c21	Block NAT64 SSRF bypass (#4400)	2026-06-27 12:21:37 -04:00
Jeremiah Lowin	a1dd8b12e1	Fix dev apps launch escaping (#4399)	2026-06-27 12:18:36 -04:00
Jeremiah Lowin	a8bb1b08c2	Raise fastmcp.ValidationError for invalid tool arguments (#4392) ... Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-06-27 11:14:20 -04:00
Jacky Su	0668eb7b80	Fix/cimd flow issue (#4206)	2026-06-27 10:57:58 -04:00
Jeremiah Lowin	dc4b0e202d	fix(tools): honor serialize_by_alias in tool result serialization (#4391)	2026-06-27 10:24:39 -04:00
Jeremiah Lowin	0cffe41115	fix: validate task tool arguments against declared types (#4373)	2026-06-27 10:03:59 -04:00
Jeremiah Lowin	a612846224	fix: bound default OIDC discovery timeout and expose it on provider wrappers (#4374)	2026-06-24 17:16:18 -04:00
Jeremiah Lowin	ade2b3ff46	fix: bracket IPv6 hosts in server startup log URL (#4372)	2026-06-24 17:15:40 -04:00
Jeremiah Lowin	094908042c	fix(resources): round-trip path values with reserved characters in URI templates (#4368)	2026-06-24 13:56:04 -04:00
Jeremiah Lowin	a13e48ea6f	feat(remote): add --verify flag for TLS certificate verification (#4369)	2026-06-24 12:09:22 -04:00
Bobby Davidson	7f2d034f4d	Forward IdP auth errors to MCP client instead of showing HTML error page (#4293) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-06-24 12:09:09 -04:00
Jianke LIN	ba77e4626b	fix: guard recursive refs in json_schema_to_type (#4312)	2026-06-24 11:53:36 -04:00
Alex LaGuardia	27a0720928	Add real Monty sandbox e2e coverage for CodeMode call_tool (#4274) ... Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-06-24 11:52:27 -04:00
Jeremiah Lowin	cf1d821129	fix(fs): isolate same-named package imports across providers (#4361)	2026-06-24 10:57:01 -04:00
Yufeng He	9b1a1a04e0	fix: preserve required discriminator tags (#4297) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-06-24 10:36:56 -04:00
Tomasz Czochański	4ce8e2a5d0	Fix: async rate limiting middleware get_client_id callbacks (#4319) ... Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-24 10:27:30 -04:00
Jeremiah Lowin	3b8538e242	Allow private JWT headers (#4290)	2026-06-06 02:23:48 +01:00
Jeremiah Lowin	e58f386bac	Log refresh-token misses in OAuthProxy instead of failing silently (#4276)	2026-06-03 11:22:35 -04:00
René Mulder	0f4f78c464	Fix resource templates with query params on proxied servers (#4251) ... Co-authored-by: René Mulder <rene@silverflow.com>	2026-05-31 14:03:49 -04:00
Jeremiah Lowin	1a06130fcf	Fix GitHub MCP resource integration test (#4253)	2026-05-30 11:48:46 -04:00
Jeremiah Lowin	58e0f5320b	Decouple FastMCP access token lifetime from upstream expires_in (#4254)	2026-05-30 11:48:23 -04:00
Jeremiah Lowin	8e66b0a47a	Upgrade ty to 0.0.39 (#4225)	2026-05-30 11:25:05 -04:00
Jeremiah Lowin	53b20168c8	Close upstream OAuth clients (#4248)	2026-05-27 19:45:45 -04:00
Jeremiah Lowin	140d96aadd	Forward proxy initialize as bridge behavior (#4228)	2026-05-27 10:41:49 -04:00
Bill Easton	802ceaaa6b	Add targeted coverage tests (#4230) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-25 18:57:28 -04:00
Jeremiah Lowin	2bff3725bf	Surface proxy upstream failures (#4227)	2026-05-23 14:56:10 -04:00
Jeremiah Lowin	59223f6e89	Allow pre-bound HTTP sockets (#4222)	2026-05-23 10:08:49 -04:00
Jeremiah Lowin	70013c5a91	Add fastmcp-remote bridge package (#4208)	2026-05-23 10:04:21 -04:00
Jeremiah Lowin	b8c9d58d61	Migrate auth JWTs to joserfc (#4221)	2026-05-23 09:29:04 -04:00
Jeremiah Lowin	9b5d402bf2	Exempt maintainers from MRE auto-close (#4220)	2026-05-23 09:02:44 -04:00
Jeremiah Lowin	e242abee7d	Let ToolResult return an error result via is_error (#4217)	2026-05-22 20:20:52 -04:00