Jeremiah Lowin
a139a06005
sync: bring published-docs to main @ v3.3.0
2026-05-14 22:09:39 -04:00
Jeremiah Lowin
3a9717e6be
Publish docs for v3.2.0 ( #3713 )
...
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
Co-authored-by: Marvin Context Protocol <41898282+Marvin Context Protocol@users.noreply.github.com>
Co-authored-by: voidborne-d <voidborne-d@users.noreply.github.com>
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: d 🔹 <258577966+voidborne-d@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Co-authored-by: nightcityblade <nightcityblade@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>
Co-authored-by: Sumanshu Nankana <sumanshunankana@gmail.com>
Co-authored-by: Eric Robinson <ericrobinson@indeed.com>
Co-authored-by: Martim Santos <martimfasantos@gmail.com>
Co-authored-by: d 🔹 <liusway405@gmail.com>
Co-authored-by: Matthieu B <66959271+mtthidoteu@users.noreply.github.com>
Co-authored-by: Sascha Buehrle <47737812+saschabuehrle@users.noreply.github.com>
Co-authored-by: Hakancan <142545736+hkc5@users.noreply.github.com>
Co-authored-by: nightcityblade <jackchen@haloailabs.com>
Co-authored-by: Matt Hallowell <17804673+mhallo@users.noreply.github.com>
Co-authored-by: nate nowack <thrast36@gmail.com>
Co-authored-by: Bill Easton <williamseaston@gmail.com>
Co-authored-by: Marcus Shu <46469249+shulkx@users.noreply.github.com>
Co-authored-by: Rushabh Doshi <radoshi@gmail.com>
Co-authored-by: AIKAWA Shigechika <shige@aikawa.jp>
Co-authored-by: Jeremy Simon <simonjer805@gmail.com>
Co-authored-by: Miguel Miranda Dias <7780875+pandego@users.noreply.github.com>
Co-authored-by: Anthony James Padavano <padavano.anthony@gmail.com>
Co-authored-by: Mostafa Kamal <hiremostafa@gmail.com>
Fix auto-close MRE script posting comment without closing (#3386 )
Fix WorkOS token scope verification bypass 🤖 Generated with Codex (#3407 )
Fix initialize McpError fallthrough 🤖 Generated with Codex (#3413 )
Fix transform arg collisions with passthrough params (#3431 )
Fix get_* returning None when latest version is disabled (#3439 )
Fix get_* returning None when latest version is disabled (#3421 )
Fix server lifespan overlap teardown (#3415 )
Fix $ref output schema object detection regression (#3420 )
resolved annotations (#3429 )
Fix async partial callables rejected by iscoroutinefunction (#3438 )
Fix async partial callables rejected by iscoroutinefunction (#3423 )
fix: add version to components (#3458 )
fix: use intent-based flag for OIDC scope patch in load_access_token (#3465 )
Fixes #3461
fix: normalize Google scope shorthands and surface valid_scopes (#3477 )
fix: resolve ty 0.0.23 type-checking errors and bump pin (#3481 )
fix: shield lifespan teardown from cancellation (#3480 )
fix: forward custom_route endpoints from mounted servers (#3462 )
fix updates _get_additional_http_routes() to traverse providers,
Fixes #3457
fix: remove hardcoded version from CLI help text (#3456 )
fix: monty 0.0.8 compatibility, drop external_functions from constructor (#3468 )
fix: task test teardown hanging 5s per test (#3499 )
Closes #3498
fix: validate workspace path is a directory before cursor install (#3440 )
Fixes #3426
fix: handle re.error from malformed URI templates in build_regex (#3501 )
fix: reject empty/OIDC-only required_scopes in AzureProvider (#3503 )
fix: restrict $ref resolution to local refs only (SSRF/LFI) (#3502 )
fix warnings and timeouts (#3504 )
close upgrade check issue when build passes (#3505 )
Closes #3484
fix: URL-encode path params to prevent SSRF/path traversal (GHSA-vv7q-7jx5-f767) (#3507 )
fix: prevent path traversal in skill download (#3493 )
fix: prefer IdP-granted scopes over client-requested scopes in OAuthProxy (#3492 )
fix: remove unrelated transform and http.py changes from PR scope
fix: remove forced follow_redirects from httpx_client_factory calls (#3496 )
fix: stop passing follow_redirects to httpx_client_factory
fix: restore follow_redirects=True for custom httpx client factories
Closes #3509
fix: CSRF double-submit cookie check in consent flow (#3519 )
fix: validate server names in install commands (#3522 )
fix: use raw strings for regex in pytest.raises match (#3523 )
fix: reject refresh tokens used as Bearer access tokens (#3524 )
fix: route ResourcesAsTools/PromptsAsTools through server middleware (#3495 )
fix: resolve Pyright "Module is not callable" on @tool, @resource, @prompt decorators (#3540 )
fix: filter warnings by message in KEY_PREFIX test (#3549 )
fix: suppress output schema for ToolResult subclass annotations (#3548 )
fix: increase sleep duration in proxy cache tests (#3567 )
fix: store absolute token expiry to prevent stale expires_in on reload (#3572 )
fix: preserve tool properties named 'title' during schema compression (#3582 )
Fix loopback redirect URI port matching per RFC 8252 §7.3 (#3589 )
Fix app tool routing: visibility check and middleware propagation (#3591 )
Fix query parameter serialization to respect OpenAPI explode/style settings (#3595 )
Fix dev apps form: union types, textarea support, JSON parsing (#3597 )
fix(google): replace deprecated /oauth2/v1/tokeninfo with /oauth2/v3/userinfo (#3603 )
fix: resolve EntraOBOToken dependency injection through MultiAuth (#3609 )
fix(docs): correct misleading stateless_http header (#3622 )
fix: filesystem provider import machinery (#3626 )
Closes #3625 (issues 2, 3, 6)
fix: recover StdioTransport after subprocess exits (#3630 )
fix(server): preserve mounted tool task metadata (#3632 )
fix: scope deprecation warning filter to FastMCPDeprecationWarning (#3649 )
fix imports, add PrefabAppConfig (#3650 )
fix: resolve CurrentFastMCP/ctx.fastmcp to child server in mounted background tasks (#3651 )
Fix blocking docs issues: chart imports, Select API, Rx consistency (#3652 )
closed by default (#3657 )
Fix prompt caching middleware missing wrap/unwrap round-trip (#3666 )
fix: serialize object query params per OpenAPI style/explode rules (#3662 )
Fixes #2857
fix: HTTP request headers not accessible in background task workers (#3631 )
fix: restore HTTP headers in worker execution path for background tasks (#3681 )
fix: strip discriminator after dereferencing schemas (#3682 )
fix: remove stale ty:ignore directives for ty 0.0.26 (#3684 )
Fix docs gaps in app provider pages (#3690 )
fix: dev apps log panel UX improvements (#3698 )
fix dev server empty string args (#3700 )
2026-03-30 16:48:30 -04:00
Jeremiah Lowin
5dd8cde2f9
Drop diskcache dependency (CVE-2025-69872) ( #3185 )
...
* Drop diskcache dependency (CVE-2025-69872)
Switch default OAuth proxy storage from DiskStore (backed by diskcache,
which uses pickle serialization) to FileTreeStore (file-per-key JSON).
This removes diskcache from the dependency tree entirely, resolving
CVE-2025-69872 for pip-audit and similar scanners.
* chore: Update SDK documentation
* Add comments explaining FileTreeStore warning suppression
* chore: Update SDK documentation
* Isolate storage by encryption key, gracefully handle decryption failures
* chore: Update SDK documentation
* Bump py-key-value-aio lower bound to 0.4.2 for FileTreeStore security hardening
* chore: Update SDK documentation
* Document storage backend change and update DiskStore references
* Bump py-key-value-aio lower bound to 0.4.3
* Bump py-key-value-aio to 0.4.4, remove warning suppression
* chore: Update SDK documentation
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-02-16 16:43:15 -05:00
Jeremiah Lowin
fe57c3d689
Make $ref dereferencing optional via FastMCP(dereference_refs=...) ( #3151 )
...
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-02-11 13:45:37 -05:00
Jeremiah Lowin
1b723f302d
Decorators return functions instead of component objects ( #2856 )
2026-01-12 21:58:07 -05:00
Jeremiah Lowin
2e8adafdf5
Add regression tests for caching with mounted server prefixes ( #2762 )
2025-12-26 16:33:03 -05:00
Jeremiah Lowin
61ebc64730
Introduce Message and PromptResult as canonical prompt types ( #2738 )
2025-12-25 22:16:26 -05:00
Jeremiah Lowin
648684d2bb
Introduce ResourceResult as canonical resource return type ( #2734 )
2025-12-25 21:21:55 -05:00
Jeremiah Lowin
ae3c2abbf6
Consolidate notification system with unified API ( #2710 )
2025-12-24 16:05:08 -05:00
Chris Guidry
66aaf420c9
[2.14] SEP-1686 tasks ( #2378 )
...
* Implement MCP background tasks (SEP-1686) using Docket
Adds support for background task execution via the MCP task protocol,
powered by Docket for task queue management.
- Tools, resources, and prompts can be marked with `task=True` to run async
- Progress dependency for tracking task progress
- CurrentDocket and CurrentWorker dependencies for advanced use cases
- Client API with `.call_tool(..., task=True)` returns task handles
- Task status notifications via subscriptions
- CLI worker command for distributed task processing
Configuration via environment:
- FASTMCP_ENABLE_DOCKET=true
- FASTMCP_ENABLE_TASKS=true
- FASTMCP_DOCKET_URL=redis://... (or memory:// for single-process)
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix tasks example import (TaskStatusResponse → GetTaskResult)
The example was using a non-existent TaskStatusResponse type.
Updated to use mcp.types.GetTaskResult which is what the
on_status_change callback actually receives.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix env var name in Docket error messages
The error messages referenced FASTMCP_EXPERIMENTAL_ENABLE_DOCKET but the
actual setting is FASTMCP_ENABLE_DOCKET.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com>
* Remove deprecated code re-added from pre-#2329 branch
- Remove ExtendedEnvSettingsSource (FASTMCP_SERVER_ prefix support)
- Remove dependencies parameter from FastMCP.__init__
* Replace fakeredis git pin with PyPI release
* Remove redundant fakeredis dev dep (pulled via pydocket)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2025-12-04 20:10:35 -05:00
William Easton
1b5e3cb272
Actually update lockfile, ignore caching diskstore cleanup
2025-11-17 12:03:24 -06:00
Brandon Shar
c18782f02b
Add meta support to ToolResult ( #2283 )
...
* Add meta to ToolResult
* add this at the client level and test the full integration
* add example
* slipped through linting somehow
---------
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2025-11-02 16:46:52 -05:00
William Easton
5831c4bb60
PR Clean-up
2025-10-16 21:56:55 -05:00
William Easton
6ea6351d57
PR Feedback
2025-10-13 09:47:13 -05:00
William Easton
57cb83a145
Update response caching PR
2025-10-10 19:35:38 -04:00
William Easton
a9113d0c9a
Refactor cache, add Elasticsearch cache backend as a contrib module with docs
2025-09-18 13:47:42 -05:00
William Easton
d5f01dae15
Add docs
2025-09-17 19:46:15 -05:00
William Easton
c600a16899
More progress
2025-09-17 19:36:14 -05:00
William Easton
84b3e0ff60
Adding response caching with tests
2025-09-17 19:10:18 -05:00
William Easton
09369b5555
Add disk cache
2025-09-16 22:47:49 -05:00
William Easton
daa0eb7aa6
Add tests for caching
2025-09-16 22:23:54 -05:00
