Commit graph

1,288 commits

Author SHA1 Message Date
William Easton
7ef5a14d6b
Add doc example validation test (syntax + import checks)
Uses pytest-examples to extract 1,448 Python code blocks from
docs/*.mdx and checks:
- Syntax: every example parses as valid Python
- Imports: every `from fastmcp.x import y` resolves

Current baseline (26 known failures):
- 8 syntax errors (error output as python, unquoted URLs, f-string backticks)
- 18 broken imports (renamed classes, wrong module paths, removed features)

Baselines ratchet down as doc examples are fixed.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 09:49:48 -05:00
Bill Easton
d0bcec979c
fix: TransformedTool sync fn crash and schema mutation (#3823)
* fix: TransformedTool sync fn crash, schema mutation, output_schema=False

- Handle sync transform_fn in run() using is_coroutine_function check
  instead of unconditionally awaiting (fixes TypeError crash)
- Deep copy parent property schemas to prevent mutation corruption
- Accept output_schema=False via BeforeValidator (converts to None)
- Remove inaccurate docstring claiming str/None shorthand for transform_args

Fixes #3821

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add regression tests for sync transform_fn and schema mutation

🤖 Generated with Claude Code

Co-authored-by: Jeremiah Lowin <jeremiah@lowin.dev>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jeremiah@lowin.dev>
2026-04-11 11:50:23 -04:00
Bill Easton
4b59e0d94b
Fix json_schema_to_type crashes on keywords, boolean schemas, empty enums, and name collisions (#3818)
* Fix crash bugs in json_schema_to_type

- Handle boolean schemas (True/False) at the public entry point
- Append trailing underscore to Python keyword property names (PEP 8)
- Return Any for empty enum values instead of crashing Pydantic
- Deduplicate field names after sanitization to prevent collisions
  (e.g. "foo-bar" and "foo_bar" both sanitizing to "foo_bar")

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Move local imports to module level in test_json_schema_type

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-11 11:29:26 -04:00
Bill Easton
468559978a
Add real-world schema crash test against APIs.guru directory (#3826)
Integration test that runs json_schema_to_type against 232K schemas
from 4,120 real-world OpenAPI specs (APIs.guru openapi-directory).
Snapshots crash counts as regression baselines so future changes
can't silently increase the crash rate.

Current baseline (openapi-directory@f7207cf0):
  TypeErrors:   2,342 (datetime serialization)
  SchemaErrors:   273 (invalid regexes in specs)
  Timeouts:         0
  Other:            0

Skipped unless openapi-directory is cloned locally.
Run with: pytest -m integration tests/.../test_real_world_schemas.py

🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-11 11:23:55 -04:00
Bill Easton
eec52b1f02
fix: materialize generators before result conversion, handle bytes gracefully (#3830)
- Detect async/sync generators after tool execution and materialize
  into lists before the result conversion pipeline processes them
- Generator materialization runs inside timeout scope so slow generators
  respect the configured timeout
- Handle bytes return types: UTF-8 bytes as text, non-UTF-8 as base64
- Suppress output_schema for bytes return types (can't be structured JSON)
- Catch UnicodeDecodeError alongside PydanticSerializationError in
  convert_result for robustness

Fixes #3829

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-11 11:23:51 -04:00
Bill Easton
c946664a16
Validate actual base64 data size in FileUpload, not client-reported size (#3816)
The store_files tool checked the client-provided `size` field to enforce
max_file_size, but this field is untrusted input. A client could set
size=1 while sending a multi-megabyte payload, bypassing the limit.

Now computes actual size from the base64 data length instead.

🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-11 11:23:49 -04:00
Chris Guidry
db9e2685fb
Bump pydocket>=0.19.0, drop fakeredis pin (#3822)
pydocket 0.19.0 fixes the fakeredis 2.35.0 FakeConnection rename
internally, so we no longer need to carry the fakeredis ceiling
ourselves. Removes the direct fakeredis[lua]<2.35.0 dependency from the
tasks extra entirely — it's just a transitive of pydocket now.

🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 13:41:18 -04:00
Jeremiah Lowin
faf5f86e09
Version-check is_docket_available() to avoid transitive pydocket crash (#3807) 2026-04-09 21:52:21 -04:00
Jeremiah Lowin
6592aaa70e
fix: accept both client_id and identifier_uri as Azure audience (#3797) 2026-04-08 20:25:42 -04:00
aimable100
556fd8fa42
Harden client tool result error handling (#3778) 2026-04-08 13:57:10 -04:00
Jeremiah Lowin
f5be772403
fix: bump ty to >=0.0.29 and suppress new false positives (#3790) 2026-04-07 19:49:09 -04:00
Jeremiah Lowin
2b9d3eee0f
fix: use identifier_uri as audience for Azure token validation (#3787)
* fix: use identifier_uri as audience for Azure token validation

* fix test expectations for identifier_uri audience
2026-04-07 18:37:52 -04:00
Jeremiah Lowin
e1ea133fb7
fix: Cognito token verification checks client_id instead of aud (#3786)
* fix: Cognito token verification checks client_id instead of aud

* fix: Cognito token verification checks client_id instead of aud

* handle list audience values in Cognito client_id check
2026-04-07 18:09:43 -04:00
Kakarlamudi Venkata Dhanush
042db1d0e3
Fix OpenAPI 3.0 nullable fields in tool input schemas (#3768)
* Fix OpenAPI 3.0 nullable fields leaking into tool input schemas

* fix: convert nullable fields in input schemas and fix recursion

* Fix unused loop variable in OpenAPI converter

* Refactor OpenAPI nullable conversion and add tests

* Clean up and add integration tests for nullable input schemas

---------

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-07 18:09:26 -04:00
Jeremiah Lowin
e5b96343d1
Fix boolean property schemas in JSON Schema parsing (#3785) 2026-04-07 17:55:51 -04:00
Jeremiah Lowin
8ee81b3037
fix: boolean false values dropped in form submissions (#3776)
* fix: boolean false values dropped in form submissions

* revert apps_dev.py boolean coercion
2026-04-07 11:23:34 -04:00
Fatia Kusuma Dewi
5587cb7c43
changeable allowed_client_redirect_uris (#3772) 2026-04-06 20:58:09 -04:00
Kakarlamudi Venkata Dhanush
c642d6a5cf
fix: propagate upstream_claims in load_access_token (#3750) 2026-04-06 19:55:26 -04:00
Kakarlamudi Venkata Dhanush
07e950ec09
fix: FastAPI TestClient compatibility and lifespan re-initialization (#3736) 2026-04-06 19:53:27 -04:00
Rishav Mitra
99eaeb8af4
fix: substitute server variable defaults when building base URL from OpenAPI spec (#3770)
* fix: resolve OpenAPI 3.x server variables in _create_default_client

When an OpenAPI spec defines server variables (e.g. `https://{region}.api.example.com/v1`),
the default values are now substituted before constructing the httpx client base URL.
Previously, the URL was used as-is, causing all requests to fail for specs that use
server variable templating.

Fixes #1681

* fix: use str.replace instead of format_map for server variable substitution

format_map applies Python string formatting rules, so variable names
like {api.version} would be treated as attribute access and raise errors.
Literal token replacement handles all valid OpenAPI variable names safely.
2026-04-06 19:48:30 -04:00
Jeremiah Lowin
4bbc4eec3b
fix: ResponseLimitingMiddleware no longer breaks outputSchema tools (#3756) 2026-04-05 10:36:38 -04:00
Chris Guidry
d41bcb2c9e
Unify background task context forwarding, fix concurrent dependency bugs (#3710)
* Unify background task context forwarding and fix concurrent dependency bugs

We've been getting a steady trickle of edge-case reports around background tasks
and contextual dependencies over the last few months (#3654, #3656, #3569). Each
one pointed at a different symptom, but they all traced back to the same area:
the way context is negotiated between the "frontend" server and Docket workers
was grown piecemeal, with each new piece of context (access tokens, HTTP headers,
origin request IDs) getting its own Redis key, its own restore function, and its
own ContextVar. This made it hard to reason about what state was available where,
and the shared-instance Dependency pattern made concurrent tasks stomp on each
other's cleanup state.

This takes a step back and reworks the whole thing as a single unified system:

- Dependency subclasses (_CurrentContext, Progress, _CurrentAccessToken, etc.)
  are now stateless factories — __aenter__ returns a fresh per-invocation
  object, so concurrent tasks never share mutable state. Fixes #3654, #3656.

- The three individual context-snapshot Redis keys (access_token, http_headers,
  origin_request_id) are collapsed into a single TaskContextSnapshot stored as
  one JSON key per task. The three _restore_task_* functions and two ContextVars
  they populated are gone.

- Sync functions like get_http_request() and get_access_token() now find the
  snapshot transparently in background tasks via a 3-tier sync fallback:
  ContextVar (set by _CurrentContext for functions with deps) → in-memory dict
  (same-process workers) → sync Redis GET (out-of-process workers). No function
  wrapping needed.

- The _wrap_for_task_http_headers hack is deleted. FunctionTool registers its
  raw function with Docket so Docket sees and resolves ALL dependencies,
  including Docket-native ones like Retry and Timeout.

- ProxyTool.from_mcp_tool() now propagates execution.taskSupport metadata from
  remote tools. Fixes #3569.

- Removed redundant _current_docket/_current_worker ContextVar management from
  Context.__aenter__/__aexit__ (they're only set in the lifespan now).

Closes #3654
Closes #3656
Closes #3569

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Address code review feedback

- _OptionalCurrentContext: guard __aexit__ against cleaning up contexts it
  didn't create (check is_background_task before delegating)
- Narrow except clauses in snapshot loading (OSError, JSONDecodeError, etc.
  instead of bare Exception)
- Fix docstrings on register_with_docket for resources/prompts/templates
- Simplify Progress: read ExecutionProgress directly from current_execution
  instead of creating and manually entering a DocketProgress wrapper

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Use pop-on-access transfer buffer instead of bounded LRU cache for snapshots

The in-memory snapshot dict is a transfer mechanism, not a cache. Entries go
in at submission and come out at the worker's first access. Using pop instead
of get means the dict only holds entries during the brief submission-to-execution
window, bounded by task concurrency (~10) rather than a 10,000-entry LRU limit.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Drop in-memory transfer buffer, use sync Redis for all backends

Instead of maintaining an in-memory dict to bridge the async/sync gap, use
a sync Redis client directly. For memory:// backends (fakeredis), shares the
same FakeServer instance via docket._redis.get_memory_server() so data written
by the async Docket client is visible to sync reads. For real Redis, creates a
standard sync connection. No in-process state to manage at all.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Move snapshot operations to TaskContextSnapshot methods

capture(), from_json(), to_json(), save() are now classmethod/instance methods
on the dataclass instead of free functions. Deduplicates JSON parsing that was
copy-pasted between the async and sync load paths.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Trim implementation details from register_with_docket docstrings

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Clarify docket lookup comment in submit_to_docket

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Restore docket/worker ContextVar bridge in Context.__aenter__

Servers that own the Docket (the parent) re-set _current_docket/_current_worker
from their instance attributes when entering a Context. Mounted children skip
this (their _docket is None), so they inherit the parent's value. This is needed
for ASGI deployments where ContextVars set during the lifespan don't propagate
to request handlers.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Key snapshot cache by task_id to prevent cross-task context leakage

Docket workers may reuse the same asyncio context for sequential tasks.
The ContextVar cache now stores (task_id, snapshot) tuples so stale entries
from previous tasks are automatically ignored.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 10:48:27 -04:00
Jeremiah Lowin
333aaddff5
fix: remove CSP from tool metadata, keep on resource only (#3754) 2026-04-03 10:22:33 -04:00
AIKAWA Shigechika
5be249ada3
fix(google): use sub (user ID) for client_id instead of aud (app ID) (#3722) 2026-03-31 10:33:58 -04:00
Mostafa Kamal
57a7f121d4
Add Clerk OAuth provider (#3677) 2026-03-29 11:01:22 -04:00
Jeremiah Lowin
2c08edecec
Add FormInput provider, bump prefab-ui to 0.15.0 (#3687) 2026-03-28 21:15:13 -04:00
Jeremiah Lowin
beb35a4ed8
Add Approval and Choice providers (#3686) 2026-03-28 20:58:17 -04:00
Jeremiah Lowin
8c10bb8881
fix: remove stale ty:ignore directives for ty 0.0.26 (#3684) 2026-03-28 20:02:40 -04:00
Jeremiah Lowin
923695bd9a
fix: strip discriminator after dereferencing schemas (#3682) 2026-03-28 19:46:05 -04:00
Jeremiah Lowin
5338629474
Add FileUpload provider (#3669) 2026-03-28 19:45:43 -04:00
Miguel Miranda Dias
5879119de5
fix: HTTP request headers not accessible in background task workers (#3631)
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-03-27 21:48:33 -04:00
Jeremiah Lowin
5683c0f495
Merge pull request #3667 from PrefectHQ/app-tool-prefixed-names 2026-03-27 21:46:37 -04:00
Anthony James Padavano
16eb2ffcb0
fix: serialize object query params per OpenAPI style/explode rules (#3662)
Object-typed query parameters with explode=true (the default) were
passed as raw Python dicts to httpx, which called str() on them —
producing Python repr syntax (single quotes, capitalized booleans)
instead of proper query parameter serialization.

Per the OpenAPI specification, style=form with explode=true on objects
expands each property as a separate query parameter (e.g.
?myAttribute=true). This change handles dict values in both the
explode=true and explode=false branches of _serialize_query_params,
using the existing _query_scalar_to_str helper for correct boolean
formatting.

Fixes #2857
2026-03-27 21:42:36 -04:00
Jeremiah Lowin
773f6586e0
Route app tool calls via ___-prefixed names instead of _meta
Hosts (Goose, MCP Jam) don't forward _meta on callServerTool, which
broke app tool routing entirely. Encode the app identity in the tool
name on the wire instead: the resolver writes "AppName___tool_name",
and the server parses it to route via get_app_tool.
2026-03-27 21:31:16 -04:00
Jeremiah Lowin
b9ea53618d
fix: resolve CurrentFastMCP/ctx.fastmcp to child server in mounted background tasks (#3651) 2026-03-27 10:24:17 -04:00
Jeremiah Lowin
b7cb7cea81
Add PrefabAppConfig for customizable Prefab tool setup (#3648) 2026-03-27 10:08:48 -04:00
Jeremiah Lowin
ce7758e9b3
Add GenerativeUI provider, bump prefab-ui 0.14.0 (#3647) 2026-03-27 09:20:40 -04:00
Miguel Miranda Dias
59a126a0b6
fix(server): preserve mounted tool task metadata (#3632)
* fix(server): preserve mounted tool task metadata

* fix(server): move task execution metadata to base tool

* cleanup: remove stale import, tighten execution metadata guard

---------

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-03-27 09:15:33 -04:00
Bill Easton
b1505ba5d7
Run MCP conformance tests in CI (#3628)
🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 22:19:13 -04:00
Bill Easton
f5804f4761
fix: recover StdioTransport after subprocess exits (#3630)
* fix: recover StdioTransport after subprocess exits

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: improve Windows reliability for stdio crash recovery

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 22:16:54 -04:00
Bill Easton
65ea57963a
fix: filesystem provider import machinery (#3626)
* fix: filesystem provider import machinery

- Temporary sys.path entries (both package and non-package mode) now removed
  immediately after exec_module via try/finally, eliminating permanent process-wide pollution
- Non-package files use bare stem as sys.modules key only if unclaimed; falls back
  to private hash-based key to prevent stdlib shadowing (e.g. json.py clobbering json)
- Reload of private-key modules uses spec.loader.exec_module directly instead of
  importlib.reload, which cannot find files by their private synthetic name
- _find_package_root gains stop_at parameter; discover_and_import passes provider_root
  to prevent package root discovery from escaping above the provider boundary

Closes #3625 (issues 2, 3, 6)

🤖 Generated with Claude Code

* fix: use contextlib.suppress for SIM105 linting

🤖 Generated with Claude Code

* test: add import machinery regression tests

🤖 Generated with Claude Code

* fix: resolve provider_root before path comparison; improve tests

- Resolve provider_root in import_module_from_file so the stop_at boundary
  in _find_package_root works correctly when provider_root is a relative path
  (e.g. FileSystemProvider(Path("./mcp"))) — previously the resolved file_path
  and unresolved stop_at.parent would never compare equal
- Fix test_stdlib_not_shadowed: use unconditional finally to restore sys.modules["json"]
- Strengthen test_same_stem_files: assert mod_a is not mod_b and that sys.modules["helpers"]
  was not clobbered by the second import
- Replace direct _find_package_root unit test with an integration test through
  import_module_from_file(provider_root=...) that also verifies the module name
  and that tmp_path is not added to sys.path

🤖 Generated with Claude Code
2026-03-26 17:53:12 -04:00
Jeremy Simon
492db9972f
fix: resolve EntraOBOToken dependency injection through MultiAuth (#3609)
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-03-25 10:58:19 -04:00
AIKAWA Shigechika
c3f0223bbb
fix(google): replace deprecated /oauth2/v1/tokeninfo with /oauth2/v3/userinfo (#3603)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-03-25 10:39:34 -04:00
Jeremiah Lowin
1eabe7f74a
Move app modules to fastmcp.apps package (#3616) 2026-03-24 21:51:20 -04:00
Jeremiah Lowin
c397e68d39
Update ty ignore comments for 0.0.25 compatibility (#3614) 2026-03-24 20:26:26 -04:00
Jeremiah Lowin
ca76b82878
Respect OpenAPI content type in request body serialization (#3611) 2026-03-24 18:39:37 -04:00
Jeremiah Lowin
c04ce8972f
Apps Phase 1: docs, examples, app-only tool filtering (#3593)
* Apps Phase 1: docs, examples, app-only tool filtering, Rx() migration

* Clarify architecture page is Prefab-specific

* Fix component reference inaccuracies and DataTable search prop

- Charts import: clarify they must come from prefab_ui.components.charts
- DataTable: searchable→search (the actual prop name), remove nonexistent
  table-level sortable prop
- Select: remove nonexistent options prop, show SelectOption children
- Tabs: default_value→value
- Fix search=True in inventory, patterns, datatable examples

* Consistent Rx usage across all examples, fix imports

* Address review: fix chart imports, Select import, docstring --stdio claims
2026-03-24 13:35:29 -04:00
Jeremiah Lowin
6f30e89dd1
Fix query parameter serialization to respect OpenAPI explode/style settings (#3595)
* Fix query parameter serialization to respect OpenAPI explode setting

* Support pipeDelimited and spaceDelimited query param styles

* Lowercase booleans in comma/pipe/space-joined query values

* Omit empty arrays from query string when explode=false

* Handle object query params with explode=false
2026-03-23 15:19:55 -04:00
Jeremiah Lowin
e5dce51286
Fix app tool routing: visibility check and middleware propagation (#3591) 2026-03-22 19:59:23 -04:00
Rushabh Doshi
204e566227
Fix loopback redirect URI port matching per RFC 8252 §7.3 (#3589)
🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 19:35:02 -04:00