ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-09 15:19:10 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,620 commits 152 branches 114 tags 96 MiB
Commit graph

3,620 commits

This branch
This branch
All branches
Author SHA1 Message Date
Jeremiah Lowin
a3ecd1edb1
 		Clarify PR-reopen flow and fix label-race that broke auto-reopen (#4518) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
 2026-07-17 17:43:05 -04:00
Jeremiah Lowin
d779414f8a
 		Screen templated resource parameters for path traversal by default (#4482) 
* Add ResourceSecurity screening for templated resources (defaults on)

* Add tests for resource path-security screening

* Document resource path-security; fix ty in tests

* Carry child template security policy through provider mount

Preserve a mounted template's explicit ResourceSecurity (per-param
exemptions or a deliberate opt-out) through FastMCPProviderResourceTemplate.wrap
so the parent read chokepoint honours it instead of the parent default.

* Defer mcp SDK import so fastmcp.resources loads without the [mcp] extra

* Make resource path-security docs examples self-contained and runnable

* Match exempt_params under both hyphen and underscore spellings

Template placeholders like {git-ref} extract as git_ref, so an exemption
written with the natural URI-template spelling never matched.

* Docs: describe net-depth traversal rule accurately; make example runnable

The screening only rejects .. segments that escape the starting depth
(foo/../bar passes) — saying any standalone .. is rejected overstated
the guarantee. Also define DOCS_ROOT so the example runs.
 2026-07-17 17:42:48 -04:00
Jeremiah Lowin
918b85f9b2
 		Reject positional-only tool parameters (#4524) 2026-07-17 17:37:28 -04:00
Jeremiah Lowin
ff2fc234b2
 		Trace client task management requests (#4525) 2026-07-17 17:37:12 -04:00
Jeremiah Lowin
b623c23183
 		Serialize deep object query parameters (#4523) 2026-07-17 17:33:57 -04:00
Grégoire
977f02347b
 		Forward upstream instructions through create_proxy (#4512) 
Co-authored-by: Mistral Vibe <vibe@mistral.ai>
 2026-07-17 17:29:15 -04:00
WinkleMad
6202008cf3
 		Don't mutate the caller's schema in compress_schema (#4492) 2026-07-17 17:29:01 -04:00
Burt Matthews
1fca15abe6
 		Skip unsupported JWKS keys instead of failing the whole key set (#4515) (#4517) 2026-07-17 17:28:43 -04:00
石岳峰
291fab8789
 		fix(server): omit ScalarElicitationType wrapper title from elicitation schemas (#4502) 2026-07-17 17:28:30 -04:00
Jeremiah Lowin
a04f6fd911
 		Add telemetry off-switch and mcp.protocol.version span attribute (#4481) 
* Turn OpenTelemetry instrumentation on by default with explicit off-switch

Add FASTMCP_ENABLE_TELEMETRY setting (default true) and mcp.protocol.version
span attribute for SDK parity.

* Make disabled telemetry a transparent pass-through, not a NoOpTracer

The stock NoOpTracer.start_as_current_span attaches a NonRecordingSpan, hijacking the current OTel context from any enclosing application span. When telemetry is disabled, get_tracer() now returns a non-attaching pass-through tracer so trace.get_current_span() inside handlers still resolves to the caller's span.
 2026-07-17 17:02:48 -04:00
Jeremiah Lowin
266c129b62
 		Test lifespan fires once per process over HTTP (#4480) 
* Add regression test: HTTP lifespan fires once per process across sessions

* Drop redundant enter-count assertion at teardown (CodeQL)

* Assert session-manager lifespan entry directly, not user-lifespan count
 2026-07-17 17:02:26 -04:00
Jeremiah Lowin
836ceac30e
 		Add KeyValueResponseCacheStore for distributed client response caching (#4479) 
* Add KeyValueResponseCacheStore adapter for client response cache

* Test KeyValueResponseCacheStore round-trip, isolation, and distributed sharing

* Document distributed response cache store
 2026-07-17 16:41:35 -04:00
nate nowack
1d932cc778
 		Fix Azure scope fallback (#4469) 2026-07-09 15:29:50 -04:00
Jeremiah Lowin
9f251bad00
 		Forward-port Hugging Face auth provider (#4475) 2026-07-08 20:56:07 -04:00
Jeremiah Lowin
4ad78a60ef
 		Forward-port HTTP host guard compatibility (#4474) 2026-07-08 20:55:56 -04:00
Jeremiah Lowin
00a7745994
 		Docs: forward-port v3.4.4 changelog entries (#4476) 2026-07-08 20:55:43 -04:00
Jeremiah Lowin
fd5d98bd13
 		Test: HTTP lifespan fires once per process across sessions (#4470) 2026-07-08 20:55:26 -04:00
Jeremiah Lowin
8ba5b89918
 		Add server-level cache hints (SEP-2549) (#4464) 2026-07-08 09:10:41 -04:00
Jeremiah Lowin
3c43038860
 		Fix stale mcp.types imports in examples (#4452) 2026-07-07 08:07:07 -04:00
Jeremiah Lowin
515a2244a2
 		Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache (#4450) 2026-07-07 08:00:45 -04:00
Jeremiah Lowin
f30f847e1f
 		Merge pull request #4449 from PrefectHQ/modernize/path-security 
Route skill file access through SDK path-security primitives
 2026-07-07 08:00:21 -04:00
Jeremiah Lowin
f0e350942f
 		Merge pull request #4448 from PrefectHQ/modernize/sampling-deprecation 
Deprecate ctx.sample and add clear errors for push features on 2026 connections
 2026-07-07 08:00:08 -04:00
Jeremiah Lowin
7832f884c6
 		Merge pull request #4453 from PrefectHQ/remove/deprecated-params 
Remove 3.x deprecated parameters and object-mode decorators
 2026-07-07 07:59:53 -04:00
Jeremiah Lowin
3cb34034d2
 		Merge pull request #4451 from PrefectHQ/remove/server-method-deprecations 
Remove 3.0-deprecated FastMCP server methods
 2026-07-07 07:59:40 -04:00
Jeremiah Lowin
bf3a079f87
 		Merge pull request #4447 from PrefectHQ/remove/module-shims 
Remove 3.x deprecated module shims and dead parameters
 2026-07-07 07:59:16 -04:00
Jeremiah Lowin
4a8852af10
 		Docs: register removed deprecations in v4 change register 2026-07-07 07:53:12 -04:00
Jeremiah Lowin
7c2133a52f
 		Remove deprecated component-import __getattr__ shims 2026-07-07 07:53:12 -04:00
Jeremiah Lowin
805ce96689
 		Remove deprecated decorator_mode setting and object-mode machinery 2026-07-07 07:53:12 -04:00
Jeremiah Lowin
45475bd072
 		Remove deprecated exclude_args tool parameter 2026-07-07 07:53:12 -04:00
Jeremiah Lowin
da5754671b
 		Document as_proxy backend keyword migration 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
7f032bb82e
 		Remove deprecated tool-level serializer parameter 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
396fb876d3
 		Apply ruff-format: drop now-unused imports and reflow 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
508a08475f
 		Docs: mark removed-in-4.0 deprecations in upgrade guide and change register 
Annotates the v2->v3 upgrade guide's deprecated server methods as removed in
v4, and adds a Removed in 4.0 section to the change register.
 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
6a6fdcb2bb
 		Repoint tests and examples off removed deprecations 
Replaces FastMCP.as_proxy() helper calls with create_proxy(), rewrites the
mount() as_proxy=/prefix= kwarg tests to plain mount() (the params are gone),
and deletes deprecation-only tests for as_proxy() and remove_tool().
 2026-07-07 07:53:11 -04:00
Jeremiah Lowin
14373cc60b
 		Repoint examples off removed shim paths 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
e5d9d1f17d
 		Remove deprecated FastMCP server methods for 4.0 
Removes deprecations that shipped replacements in 3.0:
- FastMCP.as_proxy() classmethod -> create_proxy()
- import_server() -> mount()
- mount(prefix=) -> namespace=
- mount(as_proxy=) -> now meaningless; mounts always invoke lifespan/middleware
- add_tool_transformation() -> add_transform(ToolTransform({...}))
- remove_tool_transformation() -> pure no-op that warned callers it had no
  effect; removed entirely
- FastMCP.remove_tool() -> mcp.local_provider.remove_tool()

Also drops the now-unused URI_PATTERN/re import and FastMCPDeprecationWarning
import. The _REMOVED_KWARGS TypeError shim is retained.
 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
be8aee3a96
 		Skip live-import validation for frozen v2 doc snapshots 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
ad02710e9b
 		Docs: register 4.0 deprecation removals in change register 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
36cbef6813
 		Remove no-op sse_read_timeout param from StreamableHttpTransport 
Tier 2 aggressive-window removal: the parameter was a deprecated no-op
on the streamable-HTTP transport (the SDK v2 client no longer supports
it). SSETransport still accepts sse_read_timeout.
 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
d74f7b5996
 		Remove deprecated PromptToolMiddleware / ResourceToolMiddleware (3.1) 
Use the PromptsAsTools / ResourcesAsTools transforms instead. The
non-deprecated ToolInjectionMiddleware base class is retained.
 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
d1c51ea4db
 		Remove deprecated fastmcp.server.apps / server.app shims (3.2) 
Tier 2 aggressive-window removal: these shims were deprecated in 3.2,
a shorter deprecation window than the usual policy. Canonical imports
are fastmcp.apps / fastmcp.FastMCPApp.
 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
9d95e34e19
 		Remove deprecated experimental openapi shims (2.14) 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
497ed2ea00
 		Remove deprecated fastmcp.server.openapi shim + FastMCPOpenAPI (3.0) 2026-07-07 07:53:10 -04:00
Jeremiah Lowin
e89763d709
 		Remove deprecated fastmcp.server.proxy shim (3.0) 2026-07-07 07:53:09 -04:00
Jeremiah Lowin
6621024ce4
 		Drive the FastMCP lifespan through the SDK session manager (#4446) 2026-07-07 07:49:16 -04:00
Jeremiah Lowin
ac78e6f693
 		Emit one SERVER span per request and adopt spec-correct error codes (#4445) 2026-07-07 07:49:06 -04:00
Jeremiah Lowin
023a578279
 		Capture SharedContext for task-enabled Docket servers (#4443) 2026-07-07 07:48:49 -04:00
Jeremiah Lowin
13b9ab80ab
 		Use a single fastmcp import style in protocol-era tests 2026-07-06 22:06:22 -04:00
Jeremiah Lowin
77131edc00
 		Don't era-gate server-side sampling handlers on modern connections 
The era-gate blocked every ctx.sample/sample_step on a 2026-07-28
connection, but a server-configured sampling handler answers server-side
without the client back-channel. Gate only when the request would hit the
removed client path; force the handler path (client_available=False) on
modern so "fallback" goes straight to the handler instead of a bare
client-attempt failure.
 2026-07-06 21:49:18 -04:00
Jeremiah Lowin
05be554e85
 		Apply ruff formatting to attack corpus tests 2026-07-06 21:32:47 -04:00