Defer auth providers (JWTVerifier, OAuthProxy, OIDCProxy) and Client
to avoid eagerly importing authlib, cryptography, key_value.aio, and
beartype on every `from fastmcp import FastMCP`.
* Fix background Context request correlation
* Make OptionalCurrentContext type-safe
Refactor OptionalCurrentContext to wrap CurrentContext instead of overriding __aenter__ with a wider return type. Adds a background-task origin_request_id round-trip test and applies ruff formatting.
* fix: prevent MCP transport auth header from leaking to downstream OpenAPI APIs (#3260)
Two issues in OpenAPITool.run():
1. get_http_headers() does not exclude 'authorization', so the MCP
client's auth token is included in forwarded headers.
2. mcp_headers.update() overwrites existing request headers, including
the Authorization header that was already set from the httpx client's
configured API key.
Fix:
- Add 'authorization' to exclude_headers in get_http_headers() to
prevent MCP transport credentials from being forwarded by default.
- Change mcp_headers forwarding to use the same non-overwriting pattern
as client headers (only set if key not already present), making the
behavior consistent and preventing accidental overwrites.
Fixes#3260
* Add include parameter to get_http_headers(); update proxy transports
The authorization exclusion is correct for the default case (OpenAPI
tools should not forward MCP transport credentials), but proxy
transports need auth headers forwarded to upstream MCP servers.
The new `include` parameter lets callers opt specific headers back in
despite the default exclusion set. Proxy transports now explicitly
request authorization forwarding.
* Include authorization header in CurrentHeaders dependency
CurrentHeaders is user-facing — tools use it to inspect the caller's
auth token for custom logic. Reading a header in your own code is safe;
the exclusion is meant to prevent blindly forwarding it to third-party
APIs.
---------
Co-authored-by: User <user@example.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
* Fix ty ignore syntax in OpenAPI provider
* Fix flaky rate limiting and ping timing tests
* Assert rate limit error message in flaky test fix
* Catch only ToolError in rate limiting test
* Fix NameError with future annotations and Context/Depends parameters
Closes#3238, closes#905
* chore: Update SDK documentation
* Drop unnecessary pre-resolution of annotations
Pydantic (even 2.11.7) uses __module__ not __globals__ to resolve
annotations, so setting __module__ alone is sufficient.
* chore: Update SDK documentation
* Restore annotation pre-resolution for Pydantic compat
The wrapper's __globals__ is read-only and points to dependencies.py,
so some Pydantic versions use it instead of __module__ when resolving
string annotations. Pre-resolving via get_type_hints on the original
function ensures annotations are type objects before Pydantic sees them.
* chore: Update SDK documentation
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Fix dedupe bot adding wrong label by making labeling deterministic
* Scope label step to comments from current workflow run
* Fetch newest comments first to avoid pagination miss
* Fix non-serializable state lost between middleware and tools
Inherit _request_state dict from parent Context in __aenter__ so
middleware and tool contexts share the same in-memory state.
Closes#3228
* chore: Update SDK documentation
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Use standard traceparent/tracestate keys per OTel MCP semconv
The OTel semantic conventions for MCP (https://opentelemetry.io/docs/specs/semconv/gen-ai/mcp/)
put `traceparent` and `tracestate` directly in `params._meta` without a prefix.
FastMCP was using `fastmcp.traceparent` / `fastmcp.tracestate`, which meant
non-FastMCP clients sending the standard keys couldn't propagate traces.
Switches injection to the bare keys and adds fallback extraction for the old
prefixed keys so older FastMCP clients still work.
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: Update SDK documentation
* Drop legacy fastmcp.-prefixed trace key fallback
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: Update SDK documentation
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Add upgrade guides for users coming from the MCP SDK
* Fix incorrect Image import path in LLM migration prompt
* Align LLM prompts with prose across all three upgrade guides
* Move upgrade guides under getting-started/upgrading, add install section and --upgrade flag
* Fix MDX parsing error and add broken link CI check
Escape curly braces in docstring example that broke MDX parsing,
update card images, and add docs broken link check to CI.
* Revert CI broken link check — Mintlify runs this already
* Use code fence instead of inline backticks for MDX escaping
* chore: Update SDK documentation
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Update repository references from jlowin/fastmcp to prefecthq/fastmcp
* Retrigger CI after repo transfer
* chore: Update SDK documentation
* Only run deep triage on bug issues for jlowin
---------
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
* Overhaul v3.0 upgrade guide
Rewrites the upgrade guide with educational context for each breaking
change, adds an LLM migration prompt users can copy into any AI assistant,
and covers previously missing items (removed constructor kwargs, module
path deprecations, import_server deprecation).
* Address CodeRabbit review feedback on upgrade guide
Split message_path from other transport kwargs (env-var only, not a
run() kwarg), move decorator change to breaking changes in the LLM
prompt since accessing component attributes will crash, and add
DiskStore/OAuth storage change to the prompt's numbered list.
* Move decorator change under Breaking Changes in prose
* Add before/after pattern to auth provider section
* Add Warning callout, WSTransport and OpenAPI migration examples
* Add missing imports to FastMCPOpenAPI migration example
