* Fix OAuth proxy refresh token storage for multi-instance deployments
- Use pluggable client_storage instead of local dict for refresh tokens
- Store refresh tokens by SHA-256 hash for defense in depth
- Remove unused access token and relationship mapping stores
- Simplify revocation logic
* Address review feedback for refresh token storage
- Use calculated refresh_expires_in for TTL instead of hardcoded 30 days
- Populate expires_at field with actual expiry timestamp
- Add client_id validation in load_refresh_token to prevent cross-client token usage
* fix: add title attribute to ProxyTool, ProxyResource, ProxyTemplate, and ProxyPrompt
* test: add title assertions for proxy tools, resources, and prompts
* Add consent_csp_policy parameter to OAuthProxy
Allows customization or disabling of CSP directives on the consent page.
Fixes#2476.
* Add consent_csp_policy to OIDCProxy and update docs
* Fix HTML injection vulnerability in CSP policy
HTML-escape the CSP policy value before inserting into meta tag to prevent HTML injection when CSP policies contain quotes.
Deep copy parent_defs before passing to compress_schema to prevent
mutation from affecting parent tool schemas when child tools hide
parameters that remove all $ref usage.
Corrects the typo in the VersionBadge component in docs/servers/icons.mdx. The version number was incorrectly displayed as 2.14.0 but should be 2.13.0 to match the actual current version of FastMCP.
Fixes issue #2487
* sk-provider updates - aud not enforce, scopes enforce if present
* updating env_prefix, adding debug logs
* updating docs
* ruff formatting
* not changing prefix for backward compatiblity
* backward compatibility changes
* give more preference to base_url than mcp_url if both passed
* updating docs
* refactor
* updating example server
* updating readme of example
* updating docs
* updating tests to reflect what should ideally go in the parameter
Fixes issue #2431 where exclude_args fails when excluded parameters have
non-serializable types (e.g., ServerSession). The fix excludes parameters
from function annotations before Pydantic tries to serialize them.
Also adds deprecation notice that exclude_args will be deprecated in
FastMCP 2.14 in favor of dependency injection.
Set access_type=offline and prompt=consent by default to ensure
refresh tokens are returned by Google. Also expose extra_authorize_params
so users can customize authorization behavior.
- Add null checks for client_id before using in OAuthTransaction, AuthorizationCode, AccessToken, RefreshToken
- Add null check for redirect_uris before len() call
- Import AuthorizeError from mcp.server.auth.provider
- Add scope validation to InMemoryOAuthProvider.register_client() to match MCP SDK behavior
- Ensures unit tests catch scope-related bugs like the MCP SDK 1.21.1 issue
- Remove debug breakpoint from OAuth client redirect_handler
- Add null checks for client_id before using in OAuthTransaction, AuthorizationCode, AccessToken, RefreshToken
- Add null check for redirect_uris before len() call
- Import AuthorizeError from mcp.server.auth.provider
- Add scope validation to InMemoryOAuthProvider.register_client() to match MCP SDK behavior
- Ensures unit tests catch scope-related bugs like the MCP SDK 1.21.1 issue
- Remove debug breakpoint from OAuth client redirect_handler
