ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-09 15:19:10 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,631 commits 152 branches 114 tags 96 MiB
Commit graph

3,631 commits

This branch
This branch
All branches
Author SHA1 Message Date
Jeremiah Lowin
7d76c9d055
 		Add examples/ to the ty static-analysis gate (#4466) 
* Add examples/ to ty static-analysis gate

* Fix example type errors and stale SDK idioms for ty

* Use typing_extensions.TypedDict for the quiz tool-param type

Question is a take_quiz parameter, so FastMCP builds a Pydantic schema
for it; typing.TypedDict raises PydanticUserError on Python 3.10/3.11
(only 3.12+ accepts it). ty and 3.12 runs miss this, so it slipped in.

* Guard get_access_token() None case in huggingface_oauth example

Caught by the ty gate this PR adds: the example, merged separately,
had never been type-checked against examples/. Matches the existing
aws_oauth/keycloak_oauth pattern.

* Print actual YAML text in custom serializer example
 2026-07-18 19:44:13 -04:00
Kevin J Gao
3fdeedb567
 		Improve DescopeProvider scope discovery and well-known URL support (#4489) 
* Improve DescopeProvider scope discovery and well-known URL support

Co-authored-by: Cursor <cursoragent@cursor.com>

* Simplify DescopeProvider scope and URL handling

Co-authored-by: Cursor <cursoragent@cursor.com>

* Make DescopeProvider scope discovery async and lazy

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🤖 Generated with Claude Code

* Use generic scope in Descope tests

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🤖 Generated with Claude Code

* Address Descope discovery edge cases

* Deduplicate Descope metadata fallback

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-07-18 16:18:45 -04:00
dependabot[bot]
c241cd4698
 		chore(deps): bump mcp from 1.26.0 to 1.27.2 in /examples/testing_demo in the uv group across 1 directory (#4514) 
Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-18 15:49:30 -04:00
Jeremiah Lowin
7e077186fc
 		Clean up task sessions on connection exit (#4535) 2026-07-18 15:45:11 -04:00
Jeremiah Lowin
16383a64d6
 		Preserve component metadata in response cache (#4521) 2026-07-18 15:42:20 -04:00
Jeremiah Lowin
00cab8ba8f
 		Fix docs banner contrast (#4522) 
* Fix docs banner contrast

* Banner: readable animated brand-rainbow in both themes
 2026-07-18 15:38:03 -04:00
Jeremiah Lowin
d7eda92a2b
 		Fix OAuth request annotation (#4534) 2026-07-18 15:29:32 -04:00
Jeremiah Lowin
981a69d839
 		Handle expired OAuth client registrations (#4520) 2026-07-18 15:16:27 -04:00
Jeremiah Lowin
18b5ab5852
 		Migrate to MCP SDK v2.0.0b2 (httpx2) (#4503) 2026-07-18 15:12:47 -04:00
Jeremiah Lowin
66c0270bc1
 		Stabilize upgraded ty checks (#4526) 2026-07-17 17:46:53 -04:00
Jeremiah Lowin
bdb76ef4b2
 		Clean up disconnected task sessions (#4519) 2026-07-17 17:46:13 -04:00
Jeremiah Lowin
a3ecd1edb1
 		Clarify PR-reopen flow and fix label-race that broke auto-reopen (#4518) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
 2026-07-17 17:43:05 -04:00
Jeremiah Lowin
d779414f8a
 		Screen templated resource parameters for path traversal by default (#4482) 
* Add ResourceSecurity screening for templated resources (defaults on)

* Add tests for resource path-security screening

* Document resource path-security; fix ty in tests

* Carry child template security policy through provider mount

Preserve a mounted template's explicit ResourceSecurity (per-param
exemptions or a deliberate opt-out) through FastMCPProviderResourceTemplate.wrap
so the parent read chokepoint honours it instead of the parent default.

* Defer mcp SDK import so fastmcp.resources loads without the [mcp] extra

* Make resource path-security docs examples self-contained and runnable

* Match exempt_params under both hyphen and underscore spellings

Template placeholders like {git-ref} extract as git_ref, so an exemption
written with the natural URI-template spelling never matched.

* Docs: describe net-depth traversal rule accurately; make example runnable

The screening only rejects .. segments that escape the starting depth
(foo/../bar passes) — saying any standalone .. is rejected overstated
the guarantee. Also define DOCS_ROOT so the example runs.
 2026-07-17 17:42:48 -04:00
Jeremiah Lowin
918b85f9b2
 		Reject positional-only tool parameters (#4524) 2026-07-17 17:37:28 -04:00
Jeremiah Lowin
ff2fc234b2
 		Trace client task management requests (#4525) 2026-07-17 17:37:12 -04:00
Jeremiah Lowin
b623c23183
 		Serialize deep object query parameters (#4523) 2026-07-17 17:33:57 -04:00
Grégoire
977f02347b
 		Forward upstream instructions through create_proxy (#4512) 
Co-authored-by: Mistral Vibe <vibe@mistral.ai>
 2026-07-17 17:29:15 -04:00
WinkleMad
6202008cf3
 		Don't mutate the caller's schema in compress_schema (#4492) 2026-07-17 17:29:01 -04:00
Burt Matthews
1fca15abe6
 		Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#4517) 2026-07-17 17:28:43 -04:00
石岳峰
291fab8789
 		fix(server): omit ScalarElicitationType wrapper title from elicitation schemas (#4502) 2026-07-17 17:28:30 -04:00
Jeremiah Lowin
a04f6fd911
 		Add telemetry off-switch and mcp.protocol.version span attribute (#4481) 
* Turn OpenTelemetry instrumentation on by default with explicit off-switch

Add FASTMCP_ENABLE_TELEMETRY setting (default true) and mcp.protocol.version
span attribute for SDK parity.

* Make disabled telemetry a transparent pass-through, not a NoOpTracer

The stock NoOpTracer.start_as_current_span attaches a NonRecordingSpan, hijacking the current OTel context from any enclosing application span. When telemetry is disabled, get_tracer() now returns a non-attaching pass-through tracer so trace.get_current_span() inside handlers still resolves to the caller's span.
 2026-07-17 17:02:48 -04:00
Jeremiah Lowin
266c129b62
 		Test lifespan fires once per process over HTTP (#4480) 
* Add regression test: HTTP lifespan fires once per process across sessions

* Drop redundant enter-count assertion at teardown (CodeQL)

* Assert session-manager lifespan entry directly, not user-lifespan count
 2026-07-17 17:02:26 -04:00
Jeremiah Lowin
836ceac30e
 		Add KeyValueResponseCacheStore for distributed client response caching (#4479) 
* Add KeyValueResponseCacheStore adapter for client response cache

* Test KeyValueResponseCacheStore round-trip, isolation, and distributed sharing

* Document distributed response cache store
 2026-07-17 16:41:35 -04:00
nate nowack
1d932cc778
 		Fix Azure scope fallback (#4469) 2026-07-09 15:29:50 -04:00
Jeremiah Lowin
9f251bad00
 		Forward-port Hugging Face auth provider (#4475) 2026-07-08 20:56:07 -04:00
Jeremiah Lowin
4ad78a60ef
 		Forward-port HTTP host guard compatibility (#4474) 2026-07-08 20:55:56 -04:00
Jeremiah Lowin
00a7745994
 		Docs: forward-port v3.4.4 changelog entries (#4476) 2026-07-08 20:55:43 -04:00
Jeremiah Lowin
fd5d98bd13
 		Test: HTTP lifespan fires once per process across sessions (#4470) 2026-07-08 20:55:26 -04:00
Jeremiah Lowin
8ba5b89918
 		Add server-level cache hints (SEP-2549) (#4464) 2026-07-08 09:10:41 -04:00
Jeremiah Lowin
3c43038860
 		Fix stale mcp.types imports in examples (#4452) 2026-07-07 08:07:07 -04:00
Jeremiah Lowin
515a2244a2
 		Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache (#4450) 2026-07-07 08:00:45 -04:00
Jeremiah Lowin
f30f847e1f
 		Merge pull request #4449 from PrefectHQ/modernize/path-security 
Route skill file access through SDK path-security primitives
 2026-07-07 08:00:21 -04:00
Jeremiah Lowin
f0e350942f
 		Merge pull request #4448 from PrefectHQ/modernize/sampling-deprecation 
Deprecate ctx.sample and add clear errors for push features on 2026 connections
 2026-07-07 08:00:08 -04:00
Jeremiah Lowin
7832f884c6
 		Merge pull request #4453 from PrefectHQ/remove/deprecated-params 
Remove 3.x deprecated parameters and object-mode decorators
 2026-07-07 07:59:53 -04:00
Jeremiah Lowin
3cb34034d2
 		Merge pull request #4451 from PrefectHQ/remove/server-method-deprecations 
Remove 3.0-deprecated FastMCP server methods
 2026-07-07 07:59:40 -04:00
Jeremiah Lowin
bf3a079f87
 		Merge pull request #4447 from PrefectHQ/remove/module-shims 
Remove 3.x deprecated module shims and dead parameters
 2026-07-07 07:59:16 -04:00
Jeremiah Lowin
4a8852af10
 		Docs: register removed deprecations in v4 change register 2026-07-07 07:53:12 -04:00
Jeremiah Lowin
7c2133a52f
 		Remove deprecated component-import __getattr__ shims 2026-07-07 07:53:12 -04:00
Jeremiah Lowin
805ce96689
 		Remove deprecated decorator_mode setting and object-mode machinery 2026-07-07 07:53:12 -04:00
Jeremiah Lowin
45475bd072
 		Remove deprecated exclude_args tool parameter 2026-07-07 07:53:12 -04:00
Jeremiah Lowin
da5754671b
 		Document as_proxy backend keyword migration 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
7f032bb82e
 		Remove deprecated tool-level serializer parameter 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
396fb876d3
 		Apply ruff-format: drop now-unused imports and reflow 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
508a08475f
 		Docs: mark removed-in-4.0 deprecations in upgrade guide and change register 
Annotates the v2->v3 upgrade guide's deprecated server methods as removed in
v4, and adds a Removed in 4.0 section to the change register.
 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
6a6fdcb2bb
 		Repoint tests and examples off removed deprecations 
Replaces FastMCP.as_proxy() helper calls with create_proxy(), rewrites the
mount() as_proxy=/prefix= kwarg tests to plain mount() (the params are gone),
and deletes deprecation-only tests for as_proxy() and remove_tool().
 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
14373cc60b
 		Repoint examples off removed shim paths 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
e5d9d1f17d
 		Remove deprecated FastMCP server methods for 4.0 
Removes deprecations that shipped replacements in 3.0:
- FastMCP.as_proxy() classmethod -> create_proxy()
- import_server() -> mount()
- mount(prefix=) -> namespace=
- mount(as_proxy=) -> now meaningless; mounts always invoke lifespan/middleware
- add_tool_transformation() -> add_transform(ToolTransform({...}))
- remove_tool_transformation() -> pure no-op that warned callers it had no
  effect; removed entirely
- FastMCP.remove_tool() -> mcp.local_provider.remove_tool()

Also drops the now-unused URI_PATTERN/re import and FastMCPDeprecationWarning
import. The _REMOVED_KWARGS TypeError shim is retained.
 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
be8aee3a96
 		Skip live-import validation for frozen v2 doc snapshots 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
ad02710e9b
 		Docs: register 4.0 deprecation removals in change register 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
36cbef6813
 		Remove no-op sse_read_timeout param from StreamableHttpTransport 
Tier 2 aggressive-window removal: the parameter was a deprecated no-op
on the streamable-HTTP transport (the SDK v2 client no longer supports
it). SSETransport still accepts sse_read_timeout.
 2026-07-07 07:53:10 -04:00