Commit graph

3,377 commits

Author SHA1 Message Date
William Easton
34945abf09
Fix ty errors: assert event.attributes is not None before subscript
🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-13 08:21:46 -05:00
strawgate
13d6412741 feat: instrument ctx.sample() / sampling loop with OpenTelemetry spans
Add OTEL tracing to the sampling pipeline:
- `sampling/createMessage` span wrapping sample_impl() with attributes for
  temperature, max_tokens, tool_count, result_type, and iteration count
- `sampling/createMessage step` child spans per loop iteration with
  iteration index and stop reason
- `sampling.execute_tool <name>` spans for tool calls within sampling,
  including error status on failures
- Validation failure and text response retry events on the parent span
- Opt-in content capture via OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT

Also adds is_recording() guards to server_span, delegate_span, and
client_span to avoid unnecessary attribute serialization when sampling is
disabled, and sets error.type using __qualname__ for better nested class
names.

Closes #3891

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-13 01:28:07 -05:00
strawgate
8e8c7e8c9d fix: add is_recording() guards and use __qualname__ for error.type
Wrap attribute-setting blocks in server_span, delegate_span, and
client_span with `if span.is_recording():` to avoid unnecessary work
on non-recording spans. Add error.type attribute using
`type(e).__qualname__` for proper exception class identification.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-13 01:28:03 -05:00
Jeremiah Lowin
0a921f5372
refactor: unify object-schema conversion through _object_schema_to_type (#3884) 2026-04-12 21:33:22 -04:00
marvin-context-protocol[bot]
e8f2fefb06
chore: Update SDK documentation (#3876)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-04-12 21:23:37 -04:00
Jeremiah Lowin
fa9ad6cb81
fix: strip titles from bare-metadata nodes (Gemini 2.5 Flash) (#3881) 2026-04-12 21:06:27 -04:00
Ke Wang
f23599283c
fix: resolve list[dict] return type producing Root() instead of dicts (#3880)
When a tool returns `list[dict]`, the client deserializes each dict as a
`Root()` dataclass with no fields instead of preserving the original dict
data.

The root cause is in `_get_from_type_handler`: its `"object"` branch
always fell through to `_create_dataclass` for schemas without
`properties`, creating an empty dataclass named `Root`. The top-level
`json_schema_to_type` already handled this case correctly (returning
`dict[str, Any]`), but that logic was not shared with `_schema_to_type`
which is used when converting nested schemas (e.g., array items).

Extract `_object_schema_to_type` to unify the four object-schema cases
(dict, typed dict, BaseModel with extra, dataclass) so both top-level
and nested paths produce the correct type.

Fixes #3867

Co-authored-by: Ke Wang <ke@pika.art>
2026-04-12 17:54:00 -04:00
Jeremiah Lowin
9a447cb08d
test: bump OpenAPI init perf threshold to 200ms for Windows CI (#3879) 2026-04-12 17:17:14 -04:00
vincent
673e6bb0f7
docs: add uv-managed dependencies and uvx examples to mcp-json configuration (#3843)
Closes #1707

- Add example for configuring mcp.json with uv-managed projects (pyproject.toml)
- Add examples for running published pip packages via uvx
- Update both main and v2 docs

Co-authored-by: Emily Chen <emilychen.techwriter@gmail.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-12 17:09:15 -04:00
Jeremiah Lowin
57f1b1bced
fix: drop configurable dedupe from AggregateProvider, always warn (#3877) 2026-04-12 17:03:02 -04:00
Jeremiah Lowin
dfe9b307bd
Rename filesystem-provider example dir to avoid mcp/ collision (#3878) 2026-04-12 17:01:58 -04:00
Jeremiah Lowin
1d39e26025
Fix CIMD clients getting required_scopes instead of valid_scopes (#3836) 2026-04-12 16:34:56 -04:00
Jeremiah Lowin
7f80f78906
ci: speed up schema crash test (CSafeLoader + xdist-safe aggregation) (#3873) 2026-04-12 16:34:13 -04:00
dependabot[bot]
82253ad0f5
chore(deps-dev): bump pydantic-monty from 0.0.9 to 0.0.10 (#3809)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-12 16:13:20 -04:00
dependabot[bot]
6a82eb3ead
chore(deps): bump actions/checkout from 4 to 6 (#3864)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-12 15:39:34 -04:00
dependabot[bot]
9264728330
chore(deps): bump astral-sh/setup-uv from 6 to 7 (#3865)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-12 15:39:24 -04:00
Lars Kiesow
06f58eb617
Fix MCP tool on docs welcome page (#3874) 2026-04-12 15:39:09 -04:00
dependabot[bot]
683ce919e3
chore(deps): bump extractions/setup-just from 3 to 4 (#3863)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-12 13:53:48 -04:00
marvin-context-protocol[bot]
56456cb188
chore: Update SDK documentation (#3808)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-04-12 13:53:38 -04:00
Jeremiah Lowin
f3c00ba1b7
Extract parameter descriptions from docstrings (#3872) 2026-04-12 13:43:48 -04:00
Bill Easton
fb03e85592
Fix high-severity test quality issues (#3854)
- Delete entirely commented-out test_run_server.py (99 lines dead code)
- Fix test_pydantic_model_with_stringified_json_no_strict: replace
  try/except-both-branches-pass with clear pytest.raises assertion
- Fix test_path_traversal_blocked: remove dead assertions after
  pytest.raises (lines after raise never execute)

Error handling middleware test fixes are in a separate PR (#3858)
which also fixes the underlying RetryMiddleware bug.

🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 13:14:52 -04:00
Bill Easton
cae9333f4f
fix: cap consecutive final_response validation retries (#3851)
* Cap consecutive final_response validation retries to 3

Previously, when the LLM repeatedly called final_response with data that
failed validation, the retry loop would continue up to 100 times (the
shared max_iterations limit), wasting tokens on a model that cannot
satisfy the schema.

Add _MAX_VALIDATION_RETRIES (default 3) that caps consecutive validation
failures. The counter resets when the LLM calls other tools (not
final_response), so the cap only applies to consecutive failures.

Fixes #3848

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add tests for consecutive validation retry cap

Tests cover:
- Validation failures within cap followed by success
- Consecutive validation failures exceeding cap (raises RuntimeError)
- Counter reset when LLM calls other tools between validation failures

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Slim down validation retry cap tests

Reduce boilerplate with helper functions.
Simplify counter-reset test from 5 calls to 4.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix static analysis: move imports to module level and format

Move CreateMessageResultWithTools and ToolUseContent imports to the
top of the test file so ty can resolve the names used in return-type
annotations of the helper functions. Also fix ruff import sorting
and formatting issues.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Align validation retry semantics with text-response retries

Change `>=` to `>` so _MAX_VALIDATION_RETRIES means "number of
retries after the initial attempt" (total = N+1), matching the
convention used by _MAX_TEXT_RESPONSE_RETRIES in the text-response
retry path.

Before: _MAX=3 meant 3 total attempts (>= comparison)
After:  _MAX=3 means 1 initial + 3 retries = 4 total (> comparison)

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 13:14:06 -04:00
Bill Easton
d5a3d54662
fix: GoogleGenaiSamplingHandler leaks thought parts and gives unhelpful errors on empty responses (#3849)
* Fix GoogleGenaiSamplingHandler thought part leaking and unhelpful errors

- Filter thought parts (part.thought=True) from response content instead
  of leaking them as TextContent in _response_to_result_with_tools
- Include finish_reason in error messages when no content is found, so
  safety-filtered responses (SAFETY, RECITATION, etc.) are distinguishable
- Add specific error message for thinking-only responses in
  _response_to_create_message_result

Fixes #3846

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add tests for thought part filtering and error message improvements

Tests cover:
- Thought parts filtered from tool-path responses
- Thought-only responses produce descriptive errors
- Safety-filtered responses include finish_reason in error
- Normal responses (text + function calls) unaffected

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix ruff format and ty check issues

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix ty check errors in tests

Remove unused ty: ignore comments from lines where isinstance() narrows
the type, and add correct ty: ignore[invalid-argument-type] and
ty: ignore[not-subscriptable] comments on lines in newly added test
functions where ty cannot infer the union type is a list. Also apply
ruff format fix in test_task_return_types.py.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix: use all() not any() for thinking-only detection

Addresses review feedback: any() would misclassify mixed responses
(thought + function_call) as thinking-only, hiding the real error.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 13:10:55 -04:00
Jeremiah Lowin
f71680c427
docs: require agents to respect DNM markers on PRs (#3871) 2026-04-12 12:58:17 -04:00
Bill Easton
73deedf3a4
Enable 4 ruff rules (DTZ, ERA, ISC, INP) and fix 9 violations (#3842)
- DTZ: Use timezone-aware datetime.now(timezone.utc)
- ERA: Remove commented-out code, clarify ambiguous comment
- ISC: Convert explicit string concatenation to implicit
- INP: Add missing __init__.py in auth/handlers/

🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 12:54:52 -04:00
Bill Easton
901453902f
Fix broken code examples in docs (#3869)
* Fix broken code examples in docs

- Tag error output blocks as ```text instead of ```python (anthropic,
  openai integration docs + v2 mirrors)
- Quote unquoted URL in Descope config example (+ v2 mirror)
- Fix GoogleGenAISamplingHandler → GoogleGenaiSamplingHandler casing
  in sampling docs
- Fix import path: handlers.GoogleGenaiSamplingHandler →
  handlers.google_genai.GoogleGenaiSamplingHandler in v3-features

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix remaining broken doc examples and add skip tags for false positives

- BearerTokenAuth → StaticTokenVerifier in deployment/http.mdx
- providers.oauth → server.auth import in authentication.mdx
- ListToolsNext → updated list_tools API in v3-features.mdx
- OAuthClientProvider → OAuth in v2/storage-backends.mdx
- Add test="skip" for upgrade guides, contrib placeholders, f-string backticks

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Ratchet doc example baselines to zero

All 1444 examples now pass syntax and import checks.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add pytest-examples dev dep, fix client_id in StaticTokenVerifier example, commit missed openapi fixes

- Add pytest-examples to dev dependencies (fixes CI ModuleNotFoundError)
- Include required client_id in StaticTokenVerifier token payload
- Commit previously unstaged HTTPRoute import fixes in openapi.mdx

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update deprecated import paths across docs

- fastmcp.server.openapi → fastmcp.server.providers.openapi
- fastmcp.server.proxy → fastmcp.server.providers.proxy
- fastmcp.server.apps → fastmcp.apps
- Tag upgrade guide "Before" examples with test="skip"

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 12:53:04 -04:00
Bill Easton
d6b55c0b2f
Raise on unhandled content types in sampling handler dispatch chains (#3857)
* Raise on unhandled content types in sampling handler dispatch chains

The Anthropic and OpenAI sampling handlers have isinstance chains that
dispatch on MCP content types but silently drop unhandled variants like
EmbeddedResource and ResourceLink. This adds explicit else-raise guards
to match the Gemini handler's behavior and the single-content dispatch
paths that already raise.

Raising is the right choice over warn-and-skip: a partial conversion
produces a plausible-but-wrong LLM response (the model confidently
answers based on incomplete input), which is worse than a clear error
that tells the user exactly what isn't supported.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add tests for unsupported content type raises in sampling handlers

Tests the new ValueError raises for unsupported content types
(e.g. EmbeddedResource) in the Anthropic and OpenAI message
conversion loops. Uses model_construct to bypass Pydantic's
union validation since the raise is a defensive guard for
future SDK content types.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 12:52:31 -04:00
Bill Easton
f26c8fad3e
fix: retry when LLM returns text instead of calling final_response (#3850)
* Retry when LLM returns text instead of calling final_response tool

Instead of raising RuntimeError immediately when the LLM returns a text
response instead of calling the `final_response` tool for structured
output, retry up to 3 times with an explicit nudge message asking the
model to use the tool. This mirrors the existing retry behavior for
validation errors but with a separate, smaller cap.

Fixes #3847

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add tests for text response retry logic

Tests cover:
- Text response followed by successful final_response (retry works)
- Text response exceeding max retries (raises RuntimeError)
- Nudge message appended to history on retry
- No retry when result_type is None (text is valid)

Addresses review feedback from PR review tool (v1 flagged missing tests as high severity).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Slim down text response retry tests

Remove test_nudge_message_in_history (implementation detail).
Reduce boilerplate in remaining 3 tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix ruff format

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 12:52:16 -04:00
Jeremiah Lowin
af957e773f
Replace ___ with hash-based backend tool routing and per-tool prefab resources (#3824)
Replaces the ___ separator for FastMCPApp backend tool routing with a
deterministic hash(app_name, tool_name) prefix, and replaces the shared
singleton prefab renderer resource with per-tool resources synthesized
on demand.

Backend tools are now callable via <hash>_<local_name> instead of
<app_name>___<local_name>. The dispatcher walks the provider tree
recursively via get_tool_by_hash (same pattern as get_app_tool).

Each prefab tool gets its own renderer resource at
ui://prefab/tool/<hash>/renderer.html with per-tool CSP — fixing the
bug where PrefabAppConfig(csp=...) never actually applied.

Closes #3735, closes #3805
2026-04-12 12:52:07 -04:00
Bill Easton
671eaf0f03
fix: strip title fields from tool schemas for Gemini 2.5 Flash compatibility (#3861)
* fix: strip title fields from tool schemas for Gemini compatibility

Gemini 2.5 Flash produces MALFORMED_FUNCTION_CALL when a function
declaration's parameters_json_schema contains 'title' fields (which
Pydantic adds by default). Strip them in _convert_tool_to_google_genai
before passing to the API.

Fixes #3860

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix ty errors and lowest-deps test failure

- Add assertions for non-None before subscripting FunctionDeclaration
  fields (ty check)
- Test compress_schema directly instead of constructing FunctionDeclaration
  which may not support parameters_json_schema in google-genai==1.18.0

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 12:51:49 -04:00
Bill Easton
74797c8cac
fix: don't pass HTTP kwargs to run_async when transport is unspecified (#3838)
When transport is None (the default), run_async resolves it to
settings.transport which defaults to "stdio". The previous guard
`transport != "stdio"` passed HTTP kwargs through for None transport,
causing TypeError in run_stdio_async.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 12:51:34 -04:00
Bill Easton
9e2e602038
fix: cross-provider duplicate detection, error visibility, mask propagation (#3827)
- AggregateProvider._collect_list_results detects duplicate component
  names across providers, respecting the server's on_duplicate setting
- Provider errors logged at WARNING instead of DEBUG
- Parent server re-masks ToolErrors from mounted children at the
  FastMCPError catch boundary instead of mutating the child server

Fixes #3825

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 12:51:21 -04:00
Bill Easton
7825355b98
Promote 7 ty rules from ignore to warn, fix 9 violations (#3852)
Enables stricter type checking by promoting rules that default to
ignore: division-by-zero, possibly-missing-attribute,
possibly-missing-import, possibly-unresolved-reference,
unsupported-dynamic-base, unsupported-operator, unused-ignore-comment.

6 of the 7 rules had zero violations. possibly-unresolved-reference
had 9 (5 in src/, 3 in tests/, 1 walrus-operator false positive
suppressed with ty: ignore).

🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 12:50:56 -04:00
Bill Easton
b99b050e80
Enable 7 zero-violation ruff rules: PLE, LOG, RSE, FA, FLY, SLOT, TID (#3841)
🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 12:50:14 -04:00
Jeremiah Lowin
95102c7d7c
Stop forwarding inbound HTTP headers to unrelated remote servers (#3837) 2026-04-11 12:14:38 -04:00
Bill Easton
d0bcec979c
fix: TransformedTool sync fn crash and schema mutation (#3823)
* fix: TransformedTool sync fn crash, schema mutation, output_schema=False

- Handle sync transform_fn in run() using is_coroutine_function check
  instead of unconditionally awaiting (fixes TypeError crash)
- Deep copy parent property schemas to prevent mutation corruption
- Accept output_schema=False via BeforeValidator (converts to None)
- Remove inaccurate docstring claiming str/None shorthand for transform_args

Fixes #3821

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add regression tests for sync transform_fn and schema mutation

🤖 Generated with Claude Code

Co-authored-by: Jeremiah Lowin <jeremiah@lowin.dev>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jeremiah@lowin.dev>
2026-04-11 11:50:23 -04:00
Bill Easton
790f0bcb47
fix: replace or with is not None checks for config/override merging (#3833)
* fix: replace `or` with `is not None` checks for config/override merging

Falsy-but-valid values like port=0 (OS-assigned), host="" (all interfaces),
and description="" (explicitly cleared) were silently dropped by `x or default`
patterns across CLI, transport, and component registration.

Fixes #3832

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: replace `or` with `is not None` for description in FunctionResourceTemplate

🤖 Generated with Claude Code

Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
2026-04-11 11:50:20 -04:00
Bill Easton
4b59e0d94b
Fix json_schema_to_type crashes on keywords, boolean schemas, empty enums, and name collisions (#3818)
* Fix crash bugs in json_schema_to_type

- Handle boolean schemas (True/False) at the public entry point
- Append trailing underscore to Python keyword property names (PEP 8)
- Return Any for empty enum values instead of crashing Pydantic
- Deduplicate field names after sanitization to prevent collisions
  (e.g. "foo-bar" and "foo_bar" both sanitizing to "foo_bar")

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Move local imports to module level in test_json_schema_type

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-11 11:29:26 -04:00
Bill Easton
468559978a
Add real-world schema crash test against APIs.guru directory (#3826)
Integration test that runs json_schema_to_type against 232K schemas
from 4,120 real-world OpenAPI specs (APIs.guru openapi-directory).
Snapshots crash counts as regression baselines so future changes
can't silently increase the crash rate.

Current baseline (openapi-directory@f7207cf0):
  TypeErrors:   2,342 (datetime serialization)
  SchemaErrors:   273 (invalid regexes in specs)
  Timeouts:         0
  Other:            0

Skipped unless openapi-directory is cloned locally.
Run with: pytest -m integration tests/.../test_real_world_schemas.py

🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-11 11:23:55 -04:00
Bill Easton
eec52b1f02
fix: materialize generators before result conversion, handle bytes gracefully (#3830)
- Detect async/sync generators after tool execution and materialize
  into lists before the result conversion pipeline processes them
- Generator materialization runs inside timeout scope so slow generators
  respect the configured timeout
- Handle bytes return types: UTF-8 bytes as text, non-UTF-8 as base64
- Suppress output_schema for bytes return types (can't be structured JSON)
- Catch UnicodeDecodeError alongside PydanticSerializationError in
  convert_result for robustness

Fixes #3829

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-11 11:23:51 -04:00
Bill Easton
c946664a16
Validate actual base64 data size in FileUpload, not client-reported size (#3816)
The store_files tool checked the client-provided `size` field to enforce
max_file_size, but this field is untrusted input. A client could set
size=1 while sending a multi-megabyte payload, bypassing the limit.

Now computes actual size from the base64 data length instead.

🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-11 11:23:49 -04:00
Chris Guidry
db9e2685fb
Bump pydocket>=0.19.0, drop fakeredis pin (#3822)
pydocket 0.19.0 fixes the fakeredis 2.35.0 FakeConnection rename
internally, so we no longer need to carry the fakeredis ceiling
ourselves. Removes the direct fakeredis[lua]<2.35.0 dependency from the
tasks extra entirely — it's just a transitive of pydocket now.

🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-10 13:41:18 -04:00
Jeremiah Lowin
faf5f86e09
Version-check is_docket_available() to avoid transitive pydocket crash (#3807) 2026-04-09 21:52:21 -04:00
Jeremiah Lowin
ce9c4bcd53
Note generate-notes API in release workflow docs (#3806) 2026-04-09 18:08:57 -04:00
Jeremiah Lowin
d1adb041ea
Pin fakeredis<2.35.0 in tasks extra (#3804) v3.2.3 2026-04-09 16:28:48 -04:00
Jeremiah Lowin
0194c6e8ea
Document session state isolation across mount boundaries (#3801) 2026-04-09 16:15:57 -04:00
Jeremiah Lowin
6592aaa70e
fix: accept both client_id and identifier_uri as Azure audience (#3797) v3.2.2 2026-04-08 20:25:42 -04:00
dependabot[bot]
9f0d8d3d12
chore(deps): bump the uv group across 2 directories with 1 update (#3795)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 20:08:26 -04:00
aimable100
556fd8fa42
Harden client tool result error handling (#3778) v3.2.1 2026-04-08 13:57:10 -04:00
marvin-context-protocol[bot]
e064ba69de
chore: Update SDK documentation (#3791)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-04-07 21:42:16 -04:00