ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-26 15:34:18 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,871 commits 156 branches 116 tags 73 MiB
Commit graph

1,599 commits

Author SHA1 Message Date
nate nowack
822c82c93f
 		Add audience pinning to GoogleTokenVerifier (#4827) 
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-08-13 15:59:16 -04:00
Trevor Hudson
19d9360cc1
 		Keep earlier consent CSRF tokens valid within a transaction (#4818) 
Co-authored-by: nate nowack <thrast36@gmail.com>
 2026-08-13 15:24:02 -04:00
Shaik Mohammed Kaif
2061bc46c7
 		fix(openapi): extract parameter-level example and examples (#4793) 2026-08-13 12:03:56 -04:00
nate nowack
6be0ac8e15
 		Fix partial hint resolution on Python 3.14 (#4796) 
🤖 Generated with OpenAI Codex
 2026-08-11 12:14:34 -05:00
Eddie
bba8c44f7b
 		Add Prefect Horizon authentication client and local state (#4785) 
* feat: add Horizon authentication client and state

* fix: apply Windows state ACLs to existing descriptors

* fix: distinguish public route authorization failures

* fix: harden Horizon state boundaries
 2026-08-10 17:06:42 -04:00
Sai Mouli
06fee6d300
 		Serialize the event store's stream list read-modify-write (#4758) 
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-08-06 20:09:36 -04:00
Chris Guidry
1ac8fc6060
 		Encrypt task context snapshots at rest (#4772) 
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-08-06 20:01:40 -04:00
Jeremiah Lowin
04f9971120
 		Delegate typed tool output serialization to Pydantic (#4771) 2026-08-06 19:59:19 -04:00
Jake Kaplan
9feb1f378b
 		Forward proxy server metadata across protocol eras (#4776) 
* Forward proxy negotiation metadata

🤖 Generated with OpenAI Codex

* Limit forwarded proxy metadata

🤖 Generated with OpenAI Codex

* Tighten negotiation metadata forwarding

🤖 Generated with OpenAI Codex

* Tighten proxy metadata docs

🤖 Generated with OpenAI Codex

* Keep proxy metadata middleware with provider

🤖 Generated with OpenAI Codex

* Simplify proxy negotiation middleware API

🤖 Generated with OpenAI Codex

* Name proxy metadata middleware directly

🤖 Generated with OpenAI Codex

* Preserve discovery middleware contracts

🤖 Generated with OpenAI Codex

* Clarify proxy metadata ownership

🤖 Generated with OpenAI Codex

* Align proxy metadata wording

🤖 Generated with OpenAI Codex

* Call forwarded values server metadata

🤖 Generated with OpenAI Codex

* Harden proxy metadata reads

🤖 Generated with OpenAI Codex

* Expose configured discovery result

🤖 Generated with OpenAI Codex

* Preserve proxy discovery compatibility

🤖 Generated with OpenAI Codex

* Preserve deprecated initialization middleware

🤖 Generated with OpenAI Codex

* Harden proxy metadata boundaries

🤖 Generated with OpenAI Codex

* Restore deprecated middleware location

🤖 Generated with OpenAI Codex

* Simplify proxy metadata client lifecycle

🤖 Generated with OpenAI Codex

* Clarify proxy metadata lifecycle

🤖 Generated with OpenAI Codex

* Preserve proxy factory errors

🤖 Generated with OpenAI Codex

* Detach forwarded proxy metadata

🤖 Generated with OpenAI Codex

* Simplify proxy metadata implementation

🤖 Generated with OpenAI Codex

* Distinguish proxy metadata failures

🤖 Generated with OpenAI Codex

* Narrow proxy metadata validation fallback

🤖 Generated with OpenAI Codex

* Retrigger CI

🤖 Generated with OpenAI Codex
 2026-08-06 19:09:05 -04:00
nate nowack
75fb116e36
 		Support EdDSA verification in JWTVerifier (#4752) 2026-08-06 14:09:37 -04:00
Jeremiah Lowin
875e8e18bd
 		Preserve legacy httpx compatibility without importing it (#4766) 2026-08-05 18:09:16 -04:00
Jake Kaplan
959daf2321
 		Sanitize forwarded request metadata where the proxy copies it (#4770) 
* Separate proxy protocol policy from client construction

🤖 Generated with OpenAI Codex

* Strip connection-owned request metadata at the proxy backend boundary

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Sanitize forwarded request metadata where the proxy copies it

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Forward hop-safe request metadata for proxied resources, templates, and prompts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-08-05 15:46:10 -04:00
Jeremiah Lowin
e4d8ca648a
 		Avoid loading MCP and CLI stacks during lightweight imports (#4763) 2026-08-05 10:56:13 -04:00
Sai Mouli
4f28dceac8
 		Don't cache error results in ResponseCachingMiddleware (#4705) 2026-08-04 17:15:01 -04:00
LHMQ878
db92d44ef5
 		Serve empty list results from the response cache (#4738) 2026-08-04 17:11:42 -04:00
Jeremiah Lowin
886776f5fc
 		Canonicalize response cache arguments (#4753) 
Co-authored-by: LHMQ878 <LHMQ878@users.noreply.github.com>
 2026-08-04 15:25:46 -04:00
nate nowack
a7e9b70919
 		Fix static analysis with latest ty (#4739) 
* Fix upgrade static analysis

Generated with Codex

* Preserve concrete transport return types

Generated with Codex

* Avoid widening transport return types

Generated with Codex

* Model transforming transport return types

Generated with Codex

* Exclude standalone screenshot examples from ty

Generated with Codex
 2026-08-03 10:53:23 -05:00
Jeremiah Lowin
022547ad8c
 		Preserve string-compatible prompt arguments (#4730) 2026-08-02 14:56:05 -04:00
Jeremiah Lowin
34bdd480c9
 		Improve HTTP server startup performance (#4729) 2026-08-02 14:11:26 -04:00
Shuying
c428a08fea
 		fix: preserve valid servers during CLI discovery (#4714) 
Co-authored-by: Shuying <zsy@u.northwestern.edu>
 2026-08-02 09:42:26 -04:00
YAO_001
9034a2eb4b
 		Fix CodeMode tool error propagation (#4704) 
Co-authored-by: nate nowack <thrast36@gmail.com>
 2026-08-02 09:41:36 -04:00
nate nowack
40c3e122e8
 		Write downloaded skill text as UTF-8 (#4715) 2026-08-02 09:33:32 -04:00
Jake Kaplan
bc07264529
 		Fix self-referential connection error causes (#4720) 
🤖 Generated with OpenAI Codex
 2026-07-30 16:23:33 -04:00
Jeremiah Lowin
baced6281c
 		Always emit a tool title, derived from name when unset (#4694) 
* Always emit a tool title, derived from name when unset

Some MCP clients (e.g. ChatGPT) drop tools with no `title` instead of
falling back to `name` for display as the spec allows. Deriving a
default title in Tool.to_mcp_tool() fixes this for every tool built on
top of it, including the search-transform, code-mode, and session
proxy tools that never set one explicitly.

Fixes #4414

* Derive fallback title from the overridden name, document it

Addresses Codex review on #4694.

* Resolve title precedence from effective overrides

* Normalize mapping annotations before deriving the title
 2026-07-28 17:30:20 -04:00
Jeremiah Lowin
8b76710e66
 		Move to the stable MCP Python SDK 2.0.0 (#4655) 2026-07-28 16:31:49 -04:00
Jeremiah Lowin
81b1e818e5
 		Apply app visibility where no host can (#4692) 2026-07-28 16:12:38 -04:00
Jeremiah Lowin
a8b5da9770
 		Late-bind app tool names so UIs survive composition (#4682) 2026-07-28 10:54:19 -04:00
Jeremiah Lowin
0175bc9235
 		Split the SDK upgrade guides by SDK version (#4684) 2026-07-28 10:47:39 -04:00
Jeremiah Lowin
d6b9daecb1
 		Read CLI-scanned MCP config files as UTF-8 explicitly (#4690) 2026-07-28 08:12:17 -04:00
Jeremiah Lowin
7674645761
 		Flatten OpenAPI discriminator subtypes into request bodies (#4677) 
* Flatten OpenAPI discriminator subtypes into request bodies

* Resolve schema-name discriminator mappings and union conflicting variant fields

* Advertise discriminator values for propertyless variants and document the behavior
 2026-07-27 16:06:54 -04:00
Bill Easton
75b9f92504
 		feat: Add telemetry interop mode for FastMCP (#4046) 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-07-27 16:05:29 -04:00
苏紫辰
c3cbe8b9a3
 		Fix OpenAPI allOf reference fields (#4653) 
* Fix OpenAPI allOf reference fields

🤖 Generated with Codex

* Add allOf reference crash regression

🤖 Generated with Codex

* Handle OpenAPI component refs in allOf

🤖 Generated with Codex

---------

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-07-27 15:25:22 -04:00
Eduardo Cruz Guedes
794bfe9567
 		Add valid_scopes parameter to OIDC proxy valid scopes (#4660) 
* Accept valid_scopes on OIDCProxy

* Keep valid_scopes when verify_id_token restores scopes

* Document valid_scopes on the OIDC proxy

---------

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-07-27 15:12:15 -04:00
Jeremiah Lowin
ea7fb8cb2e
 		Remove 3.x-era compatibility shims (#4661) 
* Remove 3.x-era compatibility shims

* Require response_type in ctx.elicit()

* Name the utilities path for the two non-re-exported auth helpers

* Point sampling handler migration at its submodule
 2026-07-27 14:59:43 -04:00
Jeremiah Lowin
1550eea886
 		Copy schemas iteratively so deep nesting still compresses (#4671) 
* Copy schemas iteratively so deep nesting still compresses

* Keep $defs when the reference scan hits its depth limit
 2026-07-27 14:58:13 -04:00
Jeremiah Lowin
95edc1d2f3
 		Record effective scopes on the OAuth transaction (#4670) 2026-07-27 14:33:57 -04:00
Jeremiah Lowin
920cb47778
 		Add require_roles auth check (#4656) 
* Add require_roles auth check

* Make role docs runnable standalone and fully annotated

* Treat a scalar role claim as one role; correct step-up docs

* Add v4 version badge to require_roles docs
 2026-07-27 12:36:58 -04:00
Jeremiah Lowin
0c1c42f151
 		Bind CIMD assertion audience to the advertised token endpoint (#4659) 
A bare-authority base_url renders with a trailing slash, so the expected aud was https://host//token while the metadata advertised https://host/token.
 2026-07-27 11:46:03 -04:00
Jeremiah Lowin
6c4ba6b420
 		Use the snake_case field name in the task return-type test (#4657) 2026-07-27 10:56:03 -04:00
Jeremiah Lowin
a42faab783
 		Use issuer_url for OAuth issuer identity (#4652) 
* Use issuer_url for OAuth issuer identity, not base_url

* Apply ruff format to issuer identity tests

* Align ID-JAG audience docstring with issuer_url

* Make InMemoryOAuthProvider keyword-only like its parent

* Keep ID-JAG audience on base_url, out of scope for issuer identity

* Remove stray scratch script

* Make AuthorizationHandler keyword-only

* Bind ID-JAG audience to the issuer identifier

* Fix double slash in issuer_url well-known log hint
 2026-07-27 10:43:12 -04:00
Jeremiah Lowin
62afdca775
 		Bind ID-JAG audience to the issuer identifier 2026-07-27 09:37:38 -04:00
Jeremiah Lowin
0172e4c4d4
 		Keep the sampling conformance scenario live; fix roots example URIs 2026-07-27 09:35:30 -04:00
Jeremiah Lowin
98ac0402df
 		Keep ID-JAG audience on base_url, out of scope for issuer identity 2026-07-26 17:48:01 -04:00
Jeremiah Lowin
dec25ba6be
 		Merge remote-tracking branch 'origin/main' into r4648 
# Conflicts:
#	tests/conformance/expected-failures.yml
 2026-07-26 17:40:14 -04:00
Jeremiah Lowin
fecced2b5c
 		Merge pull request #4650 from PrefectHQ/claude/mcp-conformance-tests-7ec13f 
Pass the MCP conformance suite's draft and pending scenarios
 2026-07-26 17:38:13 -04:00
Jeremiah Lowin
5745323ecd
 		Cover trace propagation through the modern proxy relay 2026-07-26 17:15:30 -04:00
Jeremiah Lowin
46cd0c7933
 		Format the split guard-components test module 2026-07-26 17:03:04 -04:00
Jeremiah Lowin
f7eed91aa8
 		Forward guard asks through prompt, resource, and template proxies 
A proxy has no back-channel to the real user, so driving a backend ask inside
it failed outright. Surface it as a result for the parent, as ProxyTool does.
 2026-07-26 16:58:58 -04:00
Jeremiah Lowin
8768921fd9
 		Split guard caching tests into their own module 
Keeps test_caching.py under its size limit by topic rather than by
compressing the new tests.
 2026-07-26 16:46:21 -04:00
Jeremiah Lowin
2d3ad9ca0d
 		Make a contended tasks/update wait instead of dropping its answer 
Partial fulfillment means two in-flight updates can carry different answers,
so acknowledging the one that loses the update lock stranded the task on a key
the client had already sent.
 2026-07-26 16:40:33 -04:00