4 commits

Author	SHA1	Message	Date
Jeremiah Lowin	18b5ab5852	Migrate to MCP SDK v2.0.0b2 (httpx2) (#4503)	2026-07-18 15:12:47 -04:00
Adam Azzam	f21e51794c	Allow auth providers to override protected resource base URLs (#3900) ... Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-04-13 13:36:55 -04:00
Jeremiah Lowin	4a9f02c87c	Upgrade to MCP 1.17+ with RFC 9728 compliance (#2122) ... * Upgrade to MCP 1.17+ with RFC 9728 compliance Updates FastMCP to require MCP 1.17+ and implements RFC 9728-compliant OAuth protected resource metadata URL handling. The key change is that .well-known/oauth-protected-resource endpoints are now registered at path-aware locations. For example, if an MCP server is mounted at /mcp, the metadata endpoint is now at /.well-known/oauth-protected-resource/mcp instead of /.well-known/oauth-protected-resource. This ensures proper OAuth discovery for path-based resource servers and aligns with the MCP SDK's implementation of RFC 9728 §3.1. Changes include: - Update minimum MCP version from 1.12.4 to 1.17.0 - Use build_resource_metadata_url() for RFC 9728 compliance - Configure CI to test with latest package versions (--upgrade) - Update tests for path-aware metadata URLs - Add icons field to Tool model (introduced in MCP 1.17) * Fix RemoteAuthProvider integration tests for RFC 9728 * Fix parameterized test for nested base URL paths	2025-10-17 09:29:23 -04:00
Jeremiah Lowin	d36ea42b92	Fix OAuth resource URL handling and WWW-Authenticate header (#1706)	2025-09-02 15:14:05 -04:00