ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-27 07:50:43 +02:00
Code Issues Projects Releases Packages Wiki Activity
2,965 commits 157 branches 117 tags 73 MiB
Commit graph

575 commits

Author SHA1 Message Date
Chris Guidry
6e22914360 Move relay logic to elicitation.py, fix related-task metadata key 
Moves relay_elicitation() into elicitation.py so it can reuse
handle_task_input() for the Redis push instead of duplicating that logic.
notifications.py just detects the trigger and calls it.

Also fixes the related-task metadata key from modelcontextprotocol.io/ to
io.modelcontextprotocol/ to match the current spec:
https://modelcontextprotocol.io/specification/2025-11-25/basic/utilities/tasks

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-10 16:00:01 -05:00
Chris Guidry
361eb08f42 Relay task elicitation through standard MCP protocol 
When a background task calls ctx.elicit(), the notification subscriber now
detects the input_required notification and sends a standard elicitation/create
request to the client via session.elicit(). The client's elicitation_handler
fires, and the relay pushes the response to Redis for the blocked worker.

This means clients can respond to background task elicitation using the same
elicitation_handler they'd use for any other elicitation — no need to interact
with Redis or call handle_task_input() directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-10 14:58:19 -05:00
Chris Guidry
3809f0c77b
 		Merge branch 'main' into fix/statusMessage-not-forwarded 2026-02-10 14:22:58 -05:00
Jeremiah Lowin
1d0c0adeab
 		Add validate_output option for OpenAPI tools (#3134) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-10 13:29:45 -05:00
Jeremiah Lowin
a715176499
 		Fix unhandled exceptions in OpenAPI POST tool calls (#3133) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-10 13:13:45 -05:00
Jeremiah Lowin
40e80d60e5
 		Fix session visibility marks leaking across sessions (#3132) 2026-02-10 11:42:43 -05:00
Chris Guidry
f7c47f498c
 		Merge branch 'main' into fix/statusMessage-not-forwarded 2026-02-10 11:34:05 -05:00
Bill Easton
cdad99583e
 		Fix Windows test timeouts in OAuth proxy provider tests (#3123) 
Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-02-09 20:54:16 -05:00
Jeremiah Lowin
45af482e73
 		Add Azure OBO dependencies, auth token injection, and documentation (#2918) 2026-02-09 20:06:57 -05:00
Guillaume FORTAINE
3d665d48c0 fix: stabilize task notification integration tests 
🤖 Generated with Codex
 2026-02-08 15:20:22 +01:00
Guillaume FORTAINE
1f84e5055e test: rewrite as integration tests with zero mocks 
Replace 1300+ lines of mock-heavy unit tests with 391 lines of integration
tests using real Client(mcp) connections and memory:// Docket backend.

- test_context_background_task.py: 17 tests covering report_progress delta
  tracking, elicitation flow, edge cases, and fail-fast on push failure
- test_notifications.py: 2 E2E tests for notification queue lifecycle
 2026-02-08 01:59:07 +01:00
Jeremiah Lowin
d12d46b049
 		Exclude content-type header from get_http_headers() to prevent HTTP 415 errors (#3104) 
Fixes #3097

When using FastMCP.from_openapi() with APIs that require specific
Content-Type headers (e.g., application/vnd.api+json), the transport
connection's content-type: application/json was being injected into
downstream API requests, causing HTTP 415 (Unsupported Media Type) errors.

This change adds content-type to the exclude_headers set in get_http_headers(),
similar to how accept is already excluded. The MCP transport's content type
has no relevance to downstream API calls and should not be forwarded.

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
 2026-02-06 20:19:36 -05:00
Jeremiah Lowin
931d6f878c
 		Remove require_auth; fix auth docs re: component-level enforcement (#3103) 
🤖 Generated with Claude Code

https://claude.ai/code/session_01WWzwcBfLWnxoN9XNs5Fhxr

Co-authored-by: Claude <noreply@anthropic.com>
 2026-02-06 20:08:50 -05:00
Jeremiah Lowin
ad3b1b9d1b
 		Fix CIMD redirect allowlist bypass and cache revalidation (#3098) 
* Harden CIMD redirect and cache handling

* Preserve CIMD cache policy on 304 revalidation

* Refresh 304 cache expiry from cached lifetime
 2026-02-06 20:08:23 -05:00
Jeremiah Lowin
85eff33b81
 		Infer MIME types from OpenAPI response definitions (#3101) 
* Infer mime_type from OpenAPI response content types for resources

🤖 Generated with Claude Code

https://claude.ai/code/session_01FZD5ZT8WiQqfBu39ybuQis

* Handle media types without schemas in MIME inference

🤖 Generated with Claude Code

https://claude.ai/code/session_01FZD5ZT8WiQqfBu39ybuQis

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-02-06 20:08:08 -05:00
Diogo Santos
30832ced1c
 		Add ResponseLimitingMiddleware for tool response size control (#3072) 2026-02-06 18:13:26 -05:00
Jeremiah Lowin
880d835ccc
 		Add CIMD (Client ID Metadata Document) support for OAuth (#2871) 2026-02-06 13:44:52 -05:00
Jeremiah Lowin
db650ca7cb
 		Update Anthropic and OpenAI clients to use Omit instead of NotGiven (#3088) 
* Fix ty 0.0.15 type errors: use Omit/omit instead of NotGiven/NOT_GIVEN

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fs5vHiWaUebe826pGq4eCN

* Use kwargs dict to avoid NotGiven/Omit sentinel type issues across SDK versions

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fs5vHiWaUebe826pGq4eCN

* Bump ty minimum to 0.0.15

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fs5vHiWaUebe826pGq4eCN

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-02-05 11:40:25 -05:00
Nathan
76f054e957
 		fix: enforce redirect URI validation when allowed_client_redirect_uris is supplied (#3066) 
* fix: enforce redirect URI validation when patterns are explicitly configured

Security fix: When allowed_redirect_uri_patterns is explicitly set, reject redirect URIs that don't match the patterns instead of falling back to parent validation. This prevents unauthorized OAuth clients from bypassing the allowlist and accessing protected resources.

* Update models.py

no need to return twice

* fix redirect uri access issue

* update style

* feat: add unit test to enforce fallback not applied when redirect uri's supplied

* fix: improve test case

* apply linter

* refactor: simplify logic and do not exposed allowed redirect patterns

---------

Co-authored-by: Nathan <2381793w@student.gla.ac.uk>
 2026-02-04 17:33:33 -05:00
Jeremiah Lowin
5fd41b2e15
 		Remove OpenAPI timeout parameter, make client optional, surface timeout errors (#3067) 
* Remove OpenAPI timeout param, make client optional, surface timeout errors

* Close auto-created httpx client via provider lifespan
 2026-02-03 21:08:09 -05:00
Bill Easton
32017f7fb1
 		Merge branch 'main' into claude/issue-3049-20260131-2232 2026-02-02 19:08:11 -06:00
Jeremiah Lowin
b076b2154c
 		Add AzureJWTVerifier for Managed Identity token verification (#3058) 2026-02-02 19:59:13 -05:00
Bill Easton
c09e748a12
 		Merge branch 'main' into claude/issue-3049-20260131-2232 2026-02-02 18:52:05 -06:00
Guillaume FORTAINE
08974e50d9
 		feat(context): Add background task support for Context (SEP-1686) (#2905) 2026-02-02 19:28:42 -05:00
claude[bot]
cec40b378d Use MemoryStore for OAuth proxy tests 
Updated all OAuthProxy test instantiations to use MemoryStore instead of defaulting to DiskStore, avoiding SQLite timeout issues on Windows and improving test performance.

Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>
 2026-02-01 02:30:05 +00:00
Jeremiah Lowin
e17d50e0e8
 		fix: use MCP spec error code -32002 for resource not found (#3041) 2026-01-31 10:57:05 -05:00
Jonas Krüger Svensson
8b3010825e
 		fix: automatically include offline_access as a scope in the Azure provider to enable automatic token refreshing (#3001) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-01-29 09:15:09 -05:00
Jeremiah Lowin
f4842cd3e6
 		Fix ty 0.0.14 compatibility and upgrade dependencies (#3027) 2026-01-29 09:10:42 -05:00
Jonas Krüger Svensson
46e0e01066
 		fix: correctly send resource when exchanging code for the upstream to… (#3013) 2026-01-29 08:39:12 -05:00
Jonas Krüger Svensson
fa5b136205
 		feat: option to add upstream claims to the FastMCP proxy JWT (#2997) 2026-01-28 15:57:24 -05:00
Samir Amin
6edd5e699e
 		fix: broaden combine_lifespans type to accept Mapping return types (#3005) 2026-01-28 15:54:59 -05:00
Abhijeeth Padarthi
cee99d1210
 		Normalize resource URLs before comparison to support RFC 8707 query parameters (#2967) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-01-22 19:41:02 -05:00
Jeremiah Lowin
c1f50e49be
 		Add enabled field to ToolTransformConfig (#2991) 2026-01-22 17:44:38 -05:00
Jeremiah Lowin
0e4d519c86
 		Rename Enabled transform to Visibility (#2950) 2026-01-19 20:46:58 -05:00
Jeremiah Lowin
16ffc9432f
 		Add Skills Provider for exposing agent skills as MCP resources (#2944) 2026-01-19 18:29:16 -05:00
Jeremiah Lowin
c0ef90e713
 		Add PromptsAsTools transform (#2946) 2026-01-19 18:19:53 -05:00
Jeremiah Lowin
d3327269d7
 		Add ResourcesAsTools transform (#2943) 2026-01-19 17:40:31 -05:00
Jeremiah Lowin
4d2feb0c29
 		Refactor transform list methods to pure function pattern (#2942) 2026-01-19 16:21:35 -05:00
Jeremiah Lowin
23bfdf0680
 		Consolidate test fixtures and refactor large test files (#2941) 2026-01-19 15:18:35 -05:00
Jeremiah Lowin
e376bfcfb2
 		Refactor server.py into mixins (#2939) 2026-01-19 11:36:00 -05:00
Jeremiah Lowin
c99e0c6351
 		Refactor OAuthProxy into focused modules (#2935) 2026-01-19 10:10:07 -05:00
Jeremiah Lowin
352ff82eab
 		Refactor Client class into mixins and add timeout utilities (#2933) 2026-01-19 09:54:47 -05:00
Jeremiah Lowin
71d6f49e14
 		Bump dependencies (#2931) 2026-01-19 08:38:48 -05:00
Jeremiah Lowin
b25ac3f5fa
 		Move session visibility logic to enabled.py (#2924) 2026-01-19 08:29:23 -05:00
Jeremiah Lowin
d8ab493664
 		Add session-specific visibility control via Context (#2917) 2026-01-18 22:31:06 -05:00
Jeremiah Lowin
c3111a8978
 		Unify discovery API: deduplicate at protocol layer only (#2919) 2026-01-18 21:01:53 -05:00
Jeremiah Lowin
ed0587d683
 		Immutable transform wrapping for providers (#2913) 2026-01-18 19:37:29 -05:00
Jeremiah Lowin
510738b52e Support VersionSpec in enable/disable for range-based filtering 
Change version parameter from str to VersionSpec in enable()/disable()
to support range-based version filtering.

- Add match_none parameter to VersionSpec.matches() for controlling
  whether unversioned components match (defaults to True for backward
  compatibility, False for enable/disable filtering)
- Update Enabled transform to use VersionSpec and call matches() with
  match_none=False so unversioned components don't match version specs
- Update enable()/disable() signatures to accept VersionSpec
- Add comprehensive tests for version range matching

Examples:
- disable(version=VersionSpec(eq="v2")) - disable only v2
- disable(version=VersionSpec(gte="v2")) - disable v2 and later
- disable(version=VersionSpec(gte="v1", lt="v3")) - disable v1, v2
 2026-01-18 16:00:05 -05:00
Jeremiah Lowin
c4f506b097 Update test_local_provider.py 2026-01-18 15:01:51 -05:00
Jeremiah Lowin
84d7d3b281 Support plural names/keys in enable/disable API 
Change enable() and disable() to accept sets: names, keys, tags.
Use key-based disable for decorator enabled=False to scope exactly.
 2026-01-18 14:58:29 -05:00