Commit graph

55 commits

Author SHA1 Message Date
Jeremiah Lowin
a139a06005
sync: bring published-docs to main @ v3.3.0 2026-05-14 22:09:39 -04:00
Jeremiah Lowin
3a9717e6be
Publish docs for v3.2.0 (#3713)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
Co-authored-by: Marvin Context Protocol <41898282+Marvin Context Protocol@users.noreply.github.com>
Co-authored-by: voidborne-d <voidborne-d@users.noreply.github.com>
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: d 🔹 <258577966+voidborne-d@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Co-authored-by: nightcityblade <nightcityblade@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>
Co-authored-by: Sumanshu Nankana <sumanshunankana@gmail.com>
Co-authored-by: Eric Robinson <ericrobinson@indeed.com>
Co-authored-by: Martim Santos <martimfasantos@gmail.com>
Co-authored-by: d 🔹 <liusway405@gmail.com>
Co-authored-by: Matthieu B <66959271+mtthidoteu@users.noreply.github.com>
Co-authored-by: Sascha Buehrle <47737812+saschabuehrle@users.noreply.github.com>
Co-authored-by: Hakancan <142545736+hkc5@users.noreply.github.com>
Co-authored-by: nightcityblade <jackchen@haloailabs.com>
Co-authored-by: Matt Hallowell <17804673+mhallo@users.noreply.github.com>
Co-authored-by: nate nowack <thrast36@gmail.com>
Co-authored-by: Bill Easton <williamseaston@gmail.com>
Co-authored-by: Marcus Shu <46469249+shulkx@users.noreply.github.com>
Co-authored-by: Rushabh Doshi <radoshi@gmail.com>
Co-authored-by: AIKAWA Shigechika <shige@aikawa.jp>
Co-authored-by: Jeremy Simon <simonjer805@gmail.com>
Co-authored-by: Miguel Miranda Dias <7780875+pandego@users.noreply.github.com>
Co-authored-by: Anthony James Padavano <padavano.anthony@gmail.com>
Co-authored-by: Mostafa Kamal <hiremostafa@gmail.com>
Fix auto-close MRE script posting comment without closing (#3386)
Fix WorkOS token scope verification bypass 🤖 Generated with Codex (#3407)
Fix initialize McpError fallthrough 🤖 Generated with Codex (#3413)
Fix transform arg collisions with passthrough params (#3431)
Fix get_* returning None when latest version is disabled (#3439)
Fix get_* returning None when latest version is disabled (#3421)
Fix server lifespan overlap teardown (#3415)
Fix $ref output schema object detection regression (#3420)
resolved annotations (#3429)
Fix async partial callables rejected by iscoroutinefunction (#3438)
Fix async partial callables rejected by iscoroutinefunction (#3423)
fix: add version to components (#3458)
fix: use intent-based flag for OIDC scope patch in load_access_token (#3465)
Fixes #3461
fix: normalize Google scope shorthands and surface valid_scopes (#3477)
fix: resolve ty 0.0.23 type-checking errors and bump pin (#3481)
fix: shield lifespan teardown from cancellation (#3480)
fix: forward custom_route endpoints from mounted servers (#3462)
fix updates _get_additional_http_routes() to traverse providers,
Fixes #3457
fix: remove hardcoded version from CLI help text (#3456)
fix: monty 0.0.8 compatibility, drop external_functions from constructor (#3468)
fix: task test teardown hanging 5s per test (#3499)
Closes #3498
fix: validate workspace path is a directory before cursor install (#3440)
Fixes #3426
fix: handle re.error from malformed URI templates in build_regex (#3501)
fix: reject empty/OIDC-only required_scopes in AzureProvider (#3503)
fix: restrict $ref resolution to local refs only (SSRF/LFI) (#3502)
fix warnings and timeouts (#3504)
close upgrade check issue when build passes (#3505)
Closes #3484
fix: URL-encode path params to prevent SSRF/path traversal (GHSA-vv7q-7jx5-f767) (#3507)
fix: prevent path traversal in skill download (#3493)
fix: prefer IdP-granted scopes over client-requested scopes in OAuthProxy (#3492)
fix: remove unrelated transform and http.py changes from PR scope
fix: remove forced follow_redirects from httpx_client_factory calls (#3496)
fix: stop passing follow_redirects to httpx_client_factory
fix: restore follow_redirects=True for custom httpx client factories
Closes #3509
fix: CSRF double-submit cookie check in consent flow (#3519)
fix: validate server names in install commands (#3522)
fix: use raw strings for regex in pytest.raises match (#3523)
fix: reject refresh tokens used as Bearer access tokens (#3524)
fix: route ResourcesAsTools/PromptsAsTools through server middleware (#3495)
fix: resolve Pyright "Module is not callable" on @tool, @resource, @prompt decorators (#3540)
fix: filter warnings by message in KEY_PREFIX test (#3549)
fix: suppress output schema for ToolResult subclass annotations (#3548)
fix: increase sleep duration in proxy cache tests (#3567)
fix: store absolute token expiry to prevent stale expires_in on reload (#3572)
fix: preserve tool properties named 'title' during schema compression (#3582)
Fix loopback redirect URI port matching per RFC 8252 §7.3 (#3589)
Fix app tool routing: visibility check and middleware propagation (#3591)
Fix query parameter serialization to respect OpenAPI explode/style settings (#3595)
Fix dev apps form: union types, textarea support, JSON parsing (#3597)
fix(google): replace deprecated /oauth2/v1/tokeninfo with /oauth2/v3/userinfo (#3603)
fix: resolve EntraOBOToken dependency injection through MultiAuth (#3609)
fix(docs): correct misleading stateless_http header (#3622)
fix: filesystem provider import machinery (#3626)
Closes #3625 (issues 2, 3, 6)
fix: recover StdioTransport after subprocess exits (#3630)
fix(server): preserve mounted tool task metadata (#3632)
fix: scope deprecation warning filter to FastMCPDeprecationWarning (#3649)
fix imports, add PrefabAppConfig (#3650)
fix: resolve CurrentFastMCP/ctx.fastmcp to child server in mounted background tasks (#3651)
Fix blocking docs issues: chart imports, Select API, Rx consistency (#3652)
closed by default (#3657)
Fix prompt caching middleware missing wrap/unwrap round-trip (#3666)
fix: serialize object query params per OpenAPI style/explode rules (#3662)
Fixes #2857
fix: HTTP request headers not accessible in background task workers (#3631)
fix: restore HTTP headers in worker execution path for background tasks (#3681)
fix: strip discriminator after dereferencing schemas (#3682)
fix: remove stale ty:ignore directives for ty 0.0.26 (#3684)
Fix docs gaps in app provider pages (#3690)
fix: dev apps log panel UX improvements (#3698)
fix dev server empty string args (#3700)
2026-03-30 16:48:30 -04:00
Georgios Roros
ee6f469aa5 Fix flaky timing test on Windows CI
Increase performance test threshold from 100ms to 1.0s. Windows CI runners
are slower than Linux, and the 100ms threshold was too tight. The test's
intent is to catch obvious regressions (e.g., accidentally re-introducing
code generation), not to precisely benchmark.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-03-02 13:28:28 -05:00
Jeremiah Lowin
aa7946d353
Preserve skill metadata through provider wrapping (#3237)
* Preserve computed _meta through provider wrapping; add skill identity to _meta

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-02-19 12:24:39 -05:00
Jeremiah Lowin
564b4c0d5c
Fix ty 0.0.17 diagnostics and bump lockfile 2026-02-16 16:13:38 -05:00
Jeremiah Lowin
5f941be5a3
Fix stale request context in StatefulProxyClient handlers (#3172)
* fix: restore request context in StatefulProxyClient handlers

StatefulProxyClient reuses sessions across requests, so its receive-loop
task inherits a stale request_ctx ContextVar from the first request.
Server-initiated messages (elicitation, sampling, etc.) that depend on
related_request_id routing get sent to a closed stream and hang forever.

Closes #3169

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-02-12 17:13:23 -05:00
Jeremiah Lowin
25e2f4da32
Remove deprecated FastMCP() constructor kwargs (#3148)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-02-11 11:39:34 -05:00
Jeremiah Lowin
1d0c0adeab
Add validate_output option for OpenAPI tools (#3134)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-02-10 13:29:45 -05:00
Jeremiah Lowin
a715176499
Fix unhandled exceptions in OpenAPI POST tool calls (#3133)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-02-10 13:13:45 -05:00
Jeremiah Lowin
85eff33b81
Infer MIME types from OpenAPI response definitions (#3101)
* Infer mime_type from OpenAPI response content types for resources

🤖 Generated with Claude Code

https://claude.ai/code/session_01FZD5ZT8WiQqfBu39ybuQis

* Handle media types without schemas in MIME inference

🤖 Generated with Claude Code

https://claude.ai/code/session_01FZD5ZT8WiQqfBu39ybuQis

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-02-06 20:08:08 -05:00
Jeremiah Lowin
db650ca7cb
Update Anthropic and OpenAI clients to use Omit instead of NotGiven (#3088)
* Fix ty 0.0.15 type errors: use Omit/omit instead of NotGiven/NOT_GIVEN

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fs5vHiWaUebe826pGq4eCN

* Use kwargs dict to avoid NotGiven/Omit sentinel type issues across SDK versions

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fs5vHiWaUebe826pGq4eCN

* Bump ty minimum to 0.0.15

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fs5vHiWaUebe826pGq4eCN

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-02-05 11:40:25 -05:00
Jeremiah Lowin
5fd41b2e15
Remove OpenAPI timeout parameter, make client optional, surface timeout errors (#3067)
* Remove OpenAPI timeout param, make client optional, surface timeout errors

* Close auto-created httpx client via provider lifespan
2026-02-03 21:08:09 -05:00
Jeremiah Lowin
0e4d519c86
Rename Enabled transform to Visibility (#2950) 2026-01-19 20:46:58 -05:00
Jeremiah Lowin
16ffc9432f
Add Skills Provider for exposing agent skills as MCP resources (#2944) 2026-01-19 18:29:16 -05:00
Jeremiah Lowin
4d2feb0c29
Refactor transform list methods to pure function pattern (#2942) 2026-01-19 16:21:35 -05:00
Jeremiah Lowin
23bfdf0680
Consolidate test fixtures and refactor large test files (#2941) 2026-01-19 15:18:35 -05:00
Jeremiah Lowin
d8ab493664
Add session-specific visibility control via Context (#2917) 2026-01-18 22:31:06 -05:00
Jeremiah Lowin
c3111a8978
Unify discovery API: deduplicate at protocol layer only (#2919) 2026-01-18 21:01:53 -05:00
Jeremiah Lowin
ed0587d683
Immutable transform wrapping for providers (#2913) 2026-01-18 19:37:29 -05:00
Jeremiah Lowin
c4f506b097 Update test_local_provider.py 2026-01-18 15:01:51 -05:00
Jeremiah Lowin
84d7d3b281 Support plural names/keys in enable/disable API
Change enable() and disable() to accept sets: names, keys, tags.
Use key-based disable for decorator enabled=False to scope exactly.
2026-01-18 14:58:29 -05:00
Jeremiah Lowin
50ba6ea5a4 Refactor visibility to mark-based enabled system
Rename Visibility to Enabled, collapse VisibilityRule into the transform,
and move enabled filtering from Provider to Server level so server-level
transforms can override provider-level disables.
2026-01-18 14:36:33 -05:00
Jeremiah Lowin
dada8893a9 Add MCP-compliant pagination for list operations
Server authors opt-in by setting list_page_size on FastMCP.
Client convenience methods auto-fetch all pages transparently.
Use _mcp methods with cursor parameter for manual pagination.
2026-01-17 19:30:24 -05:00
Jeremiah Lowin
de1bf9864a fix: update remaining test to use get_prompt 2026-01-17 14:46:58 -05:00
Jeremiah Lowin
850f0a0050 fix: update all tests to use get_prompt instead of _get_prompt 2026-01-17 14:46:21 -05:00
Jeremiah Lowin
61d98b41d1 refactor: reverse visibility for get_resource/_get_resource methods 2026-01-17 14:40:16 -05:00
Jeremiah Lowin
b13e1c7caf refactor: reverse visibility for get_tool/_get_tool methods 2026-01-17 14:38:07 -05:00
Jeremiah Lowin
5fe471dc60 refactor: reverse visibility for list_tools/_list_tools methods 2026-01-17 14:32:53 -05:00
Jeremiah Lowin
5b24ea393d Refactor FastMCP to use inherited _get_* methods from Provider
- get_*() now does aggregation + component auth (raises AuthorizationError)
- Deleted _get_*() overrides - inherited from Provider applies transforms
- Simplified AuthMiddleware to global auth only
- Changed version params to VersionSpec | None (not str | None)
- Updated tests to use _get_*() where visibility filtering is expected
2026-01-17 12:15:01 -05:00
Jeremiah Lowin
66d713b367 Merge main into refactor-provider-inheritance-v2
Resolved conflicts to combine Provider inheritance refactor with versioning feature:
- FastMCP now properly inherits from Provider
- get_tool/resource/template/prompt return None instead of raising NotFoundError
- Deduplication uses version_sort_key to keep highest version per name/URI
- _source_* methods eliminated in favor of inherited _* methods
2026-01-16 22:13:29 -05:00
Jeremiah Lowin
53e220a99e
Rename _fastmcp metadata namespace to fastmcp and make non-optional (#2895) 2026-01-16 21:35:53 -05:00
Jeremiah Lowin
a6cd764b5f
Add component versioning and VersionFilter transform (#2894) 2026-01-16 20:53:18 -05:00
Jeremiah Lowin
85f32959b1 Refactor FastMCP to inherit from Provider
FastMCP now properly inherits from Provider, eliminating ~200 lines of
duplicated _source_* methods. Key changes:

- get_tool/resource/prompt return None instead of raising NotFoundError
- Visibility filter separated from transforms (applied last)
- Nested server middleware runs on both list and execution operations
- Resource auth failure doesn't fall back to templates
- AggregateProvider kept as user-facing utility class
2026-01-16 16:50:56 -05:00
Chris Guidry
07b056b0ab Address CodeRabbit feedback
- Fix potential None session_id in span attributes
- Add return type annotation to _get_parent_trace_context
- Fix type checker issue with ClientFactoryT await pattern

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-14 09:55:11 -05:00
Jeremiah Lowin
2b6a0faf1c
Add loq file size limits and clean up type ignores (#2859) 2026-01-13 07:29:12 -05:00
Jeremiah Lowin
07d89c4038
Add transform system for modifying components in provider chains (#2836)
* Consolidate tool transformation logic into TransformingProvider

Tool transformations were previously scattered across LocalProvider,
ProxyProvider, and MCPConfig. This consolidates all transformation
logic into TransformingProvider via with_transforms(tool_transforms={...}).

- Add tool_transforms parameter to TransformingProvider
- Add tool_transforms to Provider.with_transforms()
- Remove transformation storage from LocalProvider and ProxyProvider
- Remove add_tool_transformation() and remove_tool_transformation() from FastMCP
- Add tool_transforms parameter to factory methods (from_openapi, from_fastapi, create_proxy)
- Update tests to use new patterns

* Fix: reject tool lookups by pre-transform name

* Add collision validation for tool_transforms and fix docstring examples

- Validate duplicate target names in tool_transforms raise ValueError
- Fix docstring examples to use arguments/ArgTransformConfig (not args/ArgTransform)
- Add test for collision validation

* Add server-level tool transform APIs and fix task registration

- Add AggregateProvider to present multiple providers as one
- Add _get_root_provider() to apply server-level transforms uniformly
- Fix _docket_lifespan to use root provider (ensures renamed tools
  register with correct keys for background execution)
- Add tool_transforms kwarg to __init__ (non-deprecated)
- Add add_tool_transform(), remove_tool_transform(), tool_transforms property
- Deprecate old API names (tool_transformations, add_tool_transformation, etc.)
- Update tests to use new API

* Add graceful degradation for provider errors in AggregateProvider

* Match original behavior: parallel queries with DEBUG logging

* Refactor transforms to middleware-style call_next pattern

Replaces the ad-hoc transformation system with a unified Transform
abstraction using the same call_next pattern as server middleware.

Key changes:
- New src/fastmcp/server/transforms/ module with Transform base class
- Namespace, ToolTransform, Visibility all implement the same interface
- Transforms compose via functools.partial chain building
- Visibility is now just the first transform in provider._transforms
- Server-level transforms apply after provider aggregation
- Task registration now applies full transform chain

Removes TransformingProvider, _BoundTransform, ComponentSource protocol.
User-facing API unchanged: mount(), add_transform(), enable/disable all
work as before.

* Add comprehensive transforms and visibility documentation

New docs/servers/providers/transforms.mdx covering:
- Mental model for middleware-style transform pattern
- Built-in transforms (Namespace, ToolTransform)
- Server vs provider-level transforms and ordering
- Tool modification (immediate vs deferred)
- Custom transform creation

New docs/servers/visibility.mdx covering:
- Enable/disable API for runtime visibility control
- Keys and tags for targeting components
- Allowlist mode with only=True
- Server vs provider visibility layering

Updates existing docs to reference new pages and simplifies
redundant content. Visibility is documented as a user feature,
not as an implementation detail.

* Restructure transforms docs and delete tool-transformation pattern

* Cleanup: simplify get_tasks and remove unused Provider.get_component

* Update loq

* Update loq limits and add loq note to AGENTS.md

* Deprecate add_tool_transformation and tool_transformations param

* Address PR review feedback: remove redundant imports, fix path reference

* Add missing imports to code examples in v3-features.mdx
2026-01-12 22:11:16 -05:00
Jeremiah Lowin
1b723f302d
Decorators return functions instead of component objects (#2856) 2026-01-12 21:58:07 -05:00
Jeremiah Lowin
daa2dace2f
Add standalone decorators and eliminate fastmcp.fs module (#2832) 2026-01-10 12:16:35 -05:00
Jeremiah Lowin
3163e61ee4
Replace FastMCP.as_proxy() with create_proxy() function (#2829) 2026-01-10 11:39:06 -05:00
Taisei Mima
df3d4e19ec
Fix base_url fallback when url is not set (#2776) 2025-12-29 18:43:51 -05:00
Jeremiah Lowin
7b0de84ba7
Add task_meta to prompts and centralize fn_key enrichment (#2751) 2025-12-26 15:04:25 -05:00
Jeremiah Lowin
fc19f1f8de
Add task_meta parameter to read_resource() for explicit task control (#2750) 2025-12-26 12:59:01 -05:00
Jeremiah Lowin
bf1c222e20
Add explicit task_meta parameter to FastMCP.call_tool() (#2749) 2025-12-26 11:38:35 -05:00
Jeremiah Lowin
5f1aa274cc
Convert provider tests to use direct server calls (#2748) 2025-12-26 08:42:47 -05:00
Jeremiah Lowin
61ebc64730
Introduce Message and PromptResult as canonical prompt types (#2738) 2025-12-25 22:16:26 -05:00
Jeremiah Lowin
648684d2bb
Introduce ResourceResult as canonical resource return type (#2734) 2025-12-25 21:21:55 -05:00
Jeremiah Lowin
e7128b0295
Fix Provider.get_tasks() to include custom component subclasses (#2729) 2025-12-25 10:49:48 -05:00
Jeremiah Lowin
b05801d66f
Consolidate execution method chains into single public API (#2728) 2025-12-25 10:38:12 -05:00
Jeremiah Lowin
125f79ff39
Consolidate get_* and _list_* methods into single API (#2719) 2025-12-24 22:26:52 -05:00
Jeremiah Lowin
aef1ccc026
Add type-prefixed keys for globally unique component identification (#2704) 2025-12-24 08:39:43 -05:00