ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-24 06:24:18 +02:00
Code Issues Projects Releases Packages Wiki Activity
2,922 commits 155 branches 116 tags 72 MiB
Commit graph

557 commits

Author SHA1 Message Date
Nathan
76f054e957
 		fix: enforce redirect URI validation when allowed_client_redirect_uris is supplied (#3066) 
* fix: enforce redirect URI validation when patterns are explicitly configured

Security fix: When allowed_redirect_uri_patterns is explicitly set, reject redirect URIs that don't match the patterns instead of falling back to parent validation. This prevents unauthorized OAuth clients from bypassing the allowlist and accessing protected resources.

* Update models.py

no need to return twice

* fix redirect uri access issue

* update style

* feat: add unit test to enforce fallback not applied when redirect uri's supplied

* fix: improve test case

* apply linter

* refactor: simplify logic and do not exposed allowed redirect patterns

---------

Co-authored-by: Nathan <2381793w@student.gla.ac.uk>
 2026-02-04 17:33:33 -05:00
Jeremiah Lowin
5fd41b2e15
 		Remove OpenAPI timeout parameter, make client optional, surface timeout errors (#3067) 
* Remove OpenAPI timeout param, make client optional, surface timeout errors

* Close auto-created httpx client via provider lifespan
 2026-02-03 21:08:09 -05:00
Bill Easton
32017f7fb1
 		Merge branch 'main' into claude/issue-3049-20260131-2232 2026-02-02 19:08:11 -06:00
Jeremiah Lowin
b076b2154c
 		Add AzureJWTVerifier for Managed Identity token verification (#3058) 2026-02-02 19:59:13 -05:00
Bill Easton
c09e748a12
 		Merge branch 'main' into claude/issue-3049-20260131-2232 2026-02-02 18:52:05 -06:00
Guillaume FORTAINE
08974e50d9
 		feat(context): Add background task support for Context (SEP-1686) (#2905) 2026-02-02 19:28:42 -05:00
claude[bot]
cec40b378d Use MemoryStore for OAuth proxy tests 
Updated all OAuthProxy test instantiations to use MemoryStore instead of defaulting to DiskStore, avoiding SQLite timeout issues on Windows and improving test performance.

Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>
 2026-02-01 02:30:05 +00:00
Jeremiah Lowin
e17d50e0e8
 		fix: use MCP spec error code -32002 for resource not found (#3041) 2026-01-31 10:57:05 -05:00
Jonas Krüger Svensson
8b3010825e
 		fix: automatically include offline_access as a scope in the Azure provider to enable automatic token refreshing (#3001) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-01-29 09:15:09 -05:00
Jeremiah Lowin
f4842cd3e6
 		Fix ty 0.0.14 compatibility and upgrade dependencies (#3027) 2026-01-29 09:10:42 -05:00
Jonas Krüger Svensson
46e0e01066
 		fix: correctly send resource when exchanging code for the upstream to… (#3013) 2026-01-29 08:39:12 -05:00
Jonas Krüger Svensson
fa5b136205
 		feat: option to add upstream claims to the FastMCP proxy JWT (#2997) 2026-01-28 15:57:24 -05:00
Samir Amin
6edd5e699e
 		fix: broaden combine_lifespans type to accept Mapping return types (#3005) 2026-01-28 15:54:59 -05:00
Abhijeeth Padarthi
cee99d1210
 		Normalize resource URLs before comparison to support RFC 8707 query parameters (#2967) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-01-22 19:41:02 -05:00
Jeremiah Lowin
c1f50e49be
 		Add enabled field to ToolTransformConfig (#2991) 2026-01-22 17:44:38 -05:00
Jeremiah Lowin
0e4d519c86
 		Rename Enabled transform to Visibility (#2950) 2026-01-19 20:46:58 -05:00
Jeremiah Lowin
16ffc9432f
 		Add Skills Provider for exposing agent skills as MCP resources (#2944) 2026-01-19 18:29:16 -05:00
Jeremiah Lowin
c0ef90e713
 		Add PromptsAsTools transform (#2946) 2026-01-19 18:19:53 -05:00
Jeremiah Lowin
d3327269d7
 		Add ResourcesAsTools transform (#2943) 2026-01-19 17:40:31 -05:00
Jeremiah Lowin
4d2feb0c29
 		Refactor transform list methods to pure function pattern (#2942) 2026-01-19 16:21:35 -05:00
Jeremiah Lowin
23bfdf0680
 		Consolidate test fixtures and refactor large test files (#2941) 2026-01-19 15:18:35 -05:00
Jeremiah Lowin
e376bfcfb2
 		Refactor server.py into mixins (#2939) 2026-01-19 11:36:00 -05:00
Jeremiah Lowin
c99e0c6351
 		Refactor OAuthProxy into focused modules (#2935) 2026-01-19 10:10:07 -05:00
Jeremiah Lowin
352ff82eab
 		Refactor Client class into mixins and add timeout utilities (#2933) 2026-01-19 09:54:47 -05:00
Jeremiah Lowin
71d6f49e14
 		Bump dependencies (#2931) 2026-01-19 08:38:48 -05:00
Jeremiah Lowin
b25ac3f5fa
 		Move session visibility logic to enabled.py (#2924) 2026-01-19 08:29:23 -05:00
Jeremiah Lowin
d8ab493664
 		Add session-specific visibility control via Context (#2917) 2026-01-18 22:31:06 -05:00
Jeremiah Lowin
c3111a8978
 		Unify discovery API: deduplicate at protocol layer only (#2919) 2026-01-18 21:01:53 -05:00
Jeremiah Lowin
ed0587d683
 		Immutable transform wrapping for providers (#2913) 2026-01-18 19:37:29 -05:00
Jeremiah Lowin
510738b52e Support VersionSpec in enable/disable for range-based filtering 
Change version parameter from str to VersionSpec in enable()/disable()
to support range-based version filtering.

- Add match_none parameter to VersionSpec.matches() for controlling
  whether unversioned components match (defaults to True for backward
  compatibility, False for enable/disable filtering)
- Update Enabled transform to use VersionSpec and call matches() with
  match_none=False so unversioned components don't match version specs
- Update enable()/disable() signatures to accept VersionSpec
- Add comprehensive tests for version range matching

Examples:
- disable(version=VersionSpec(eq="v2")) - disable only v2
- disable(version=VersionSpec(gte="v2")) - disable v2 and later
- disable(version=VersionSpec(gte="v1", lt="v3")) - disable v1, v2
 2026-01-18 16:00:05 -05:00
Jeremiah Lowin
c4f506b097 Update test_local_provider.py 2026-01-18 15:01:51 -05:00
Jeremiah Lowin
84d7d3b281 Support plural names/keys in enable/disable API 
Change enable() and disable() to accept sets: names, keys, tags.
Use key-based disable for decorator enabled=False to scope exactly.
 2026-01-18 14:58:29 -05:00
Jeremiah Lowin
50ba6ea5a4 Refactor visibility to mark-based enabled system 
Rename Visibility to Enabled, collapse VisibilityRule into the transform,
and move enabled filtering from Provider to Server level so server-level
transforms can override provider-level disables.
 2026-01-18 14:36:33 -05:00
Jeremiah Lowin
17d43d7991 Address review feedback: validation and edge cases 2026-01-17 19:50:33 -05:00
Jeremiah Lowin
dada8893a9 Add MCP-compliant pagination for list operations 
Server authors opt-in by setting list_page_size on FastMCP.
Client convenience methods auto-fetch all pages transparently.
Use _mcp methods with cursor parameter for manual pagination.
 2026-01-17 19:30:24 -05:00
Jeremiah Lowin
de1bf9864a fix: update remaining test to use get_prompt 2026-01-17 14:46:58 -05:00
Jeremiah Lowin
850f0a0050 fix: update all tests to use get_prompt instead of _get_prompt 2026-01-17 14:46:21 -05:00
Jeremiah Lowin
2c9cae9a98 refactor: reverse visibility for get_prompt/_get_prompt methods 2026-01-17 14:42:45 -05:00
Jeremiah Lowin
b9e32ca6a6 refactor: reverse visibility for list_resource_templates/_list_resource_templates methods 2026-01-17 14:41:08 -05:00
Jeremiah Lowin
61d98b41d1 refactor: reverse visibility for get_resource/_get_resource methods 2026-01-17 14:40:16 -05:00
Jeremiah Lowin
d6a334257c refactor: reverse visibility for list_resources/_list_resources methods 2026-01-17 14:39:41 -05:00
Jeremiah Lowin
b13e1c7caf refactor: reverse visibility for get_tool/_get_tool methods 2026-01-17 14:38:07 -05:00
Jeremiah Lowin
5fe471dc60 refactor: reverse visibility for list_tools/_list_tools methods 2026-01-17 14:32:53 -05:00
Jeremiah Lowin
3d98862995 Fix auth test to expect None instead of AuthorizationError 2026-01-17 14:25:29 -05:00
Jeremiah Lowin
78ab933dc5 Fix transform application in FastMCPProvider and MCP handlers 
FastMCPProvider now calls _get_* methods instead of get_* to ensure
nested server transforms are applied during lookups. Also converts
string versions to VersionSpec in MCP handlers.
 2026-01-17 12:37:37 -05:00
Jeremiah Lowin
5b24ea393d Refactor FastMCP to use inherited _get_* methods from Provider 
- get_*() now does aggregation + component auth (raises AuthorizationError)
- Deleted _get_*() overrides - inherited from Provider applies transforms
- Simplified AuthMiddleware to global auth only
- Changed version params to VersionSpec | None (not str | None)
- Updated tests to use _get_*() where visibility filtering is expected
 2026-01-17 12:15:01 -05:00
Jeremiah Lowin
5ade5a4838 Simplify Provider transform architecture 
Replace _get_all_transforms() with a .transforms property that returns
[*self._transforms, self._visibility]. This cleanly separates user transforms
from visibility filtering while keeping visibility applied last (outermost).

Also:
- AuthMiddleware now uses get_* instead of _get_* for proper component auth
- Remove redundant _is_component_enabled checks (visibility is a transform)
- Delete dead code (get_component method)
- Add versions field to FastMCPMeta
- Replace asserts with NotFoundError in component_service
 2026-01-17 11:35:47 -05:00
Jeremiah Lowin
ddd2058f97 Merge remote-tracking branch 'origin/main' into refactor-provider-inheritance-v2 
# Conflicts:
#	src/fastmcp/server/server.py
 2026-01-17 08:41:58 -05:00
Jeremiah Lowin
33c371cb37
 		Add version discovery and calling a certain version for components (#2897) 2026-01-17 08:27:39 -05:00
Jeremiah Lowin
6ba5e5d194 Fix type errors and add type ignore comments 
- Add None checks in auth and tool transform tests
- Add assertions in component_service.py for None returns
- Add type ignore comments for max() with version_sort_key
 2026-01-17 07:23:29 -05:00