ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-27 15:51:33 +02:00
Code Issues Projects Releases Packages Wiki Activity
2,407 commits 157 branches 117 tags 74 MiB
Commit graph

21 commits

Author SHA1 Message Date
Jeremiah Lowin
1ca53b4134
 		Add base_authority parameter to AzureProvider for Azure Government support (#2306) 2025-10-29 14:06:21 -04:00
Jeremiah Lowin
ba47db9b8c
 		Fix Azure scope validation (#2269) 
* Update docs for required scopes

* add scopes

* Fix Azure scope validation

Azure returns unprefixed scopes in JWT tokens but requires prefixed scopes in authorization requests. The previous implementation incorrectly validated tokens against prefixed scopes, causing "invalid_token" errors.

Simplified AzureProvider to use standard JWTVerifier with unprefixed scopes for validation. Scopes are only prefixed when building the Azure authorization URL via _build_upstream_authorize_url() override.

Closes #2263
 2025-10-26 11:41:22 -04:00
William Easton
c002bc389c
 		Small Clean-up (#2247) 
* Project Clean-up

* Move pytest-asyncio to dev dependencies and update agents.md
 2025-10-24 19:11:01 -04:00
William Easton
063ffe9f64
 		Derive jwt_signing_key from Client Secret, default to Encrypted Disk Store (#2223) 
* Checkpoint progress

* Checkpoint progress

* add derive b64 method

* PR clean-up

* refactor da proxy

* Updates to tests

* Make jwt_signing_key required for oauth proxy

* use typing_extensions and fix tests

* PR Cleanup

* also adjust integration tests

* Update docs, use client secret to derive jwt signing key

* You win some you lose some, gg claude

* check for both in derive

* update documentation / clean up

* Update http.mdx

---------

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2025-10-24 19:08:58 -04:00
Jeremiah Lowin
a1a5cca765
 		Fix Azure scope mismatch causing MCP client validation errors (#2243) 
* Fix Azure scope mismatch causing MCP client validation errors

The AzureProvider was prefixing scopes during authorization but not in
token validation or Protected Resource Metadata, causing MCP clients to
reject tokens with "Server granted unauthorized scopes".

Changes:
- Prefix required_scopes once during __init__ and use consistently
- Pass prefixed scopes to JWTVerifier for token validation
- PRM now advertises prefixed scopes to MCP clients
- Remove unnecessary idempotent prefixing logic in authorize()
- Update comprehensive documentation explaining scope handling
- Update tests to reflect corrected behavior

Closes #2151

* Clarify that identifier_uri is optional in docstring
 2025-10-24 17:45:49 -04:00
Jeremiah Lowin
3321644ad3
 		Replace subprocess tests with in-process async servers (#2006) 
* Use anyio as testing backend

* Remove asyncio markers

* Update streamable http tests

* Replace all subprocess tests

* Replace anyio task groups with asyncio context managers in tests

- Convert run_server_async from anyio task group pattern to asyncio.create_task with async context manager
- Remove task_group fixture from conftest
- Update all test fixtures to use async with run_server_async pattern
- Remove TaskGroup imports from all test files
- Tests now work with pytest-asyncio instead of pytest-anyio

* Update test_github_provider_integration.py
 2025-10-19 10:47:54 -04:00
Jeremiah Lowin
52e9af1214
 		Add RFC 7662 token introspection provider (#2074) 2025-10-16 10:57:06 -04:00
Jeremiah Lowin
7b7e277d5d
 		Prevent confused deputy attacks in OAuth proxy (#2056) 2025-10-11 10:53:54 -04:00
Adam Azzam
a8d2a667d6
 		Add supabase auth (#1997) 2025-10-08 20:27:55 -04:00
Anders Julton
82cf3888dd
 		Azure (Entra) OAuth: Validate token against FastMCP app, not Graph. (#1891) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2025-10-08 09:06:35 -04:00
Akshay Parihar
7bcf8b562c
 		Add Scalekit Provider for Enterprise Authentication (#1927) 
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ravi Madabhushi <ravi.madabhushi@scalekit.com>
Co-authored-by: Ravi Madabhushi <innovativeravi@gmail.com>
Co-authored-by: saif-at-scalekit <saif.shaik@scalekit.com>
 2025-09-26 16:58:03 -04:00
Stephan Eberle
5486b5a3b9
 		Add AWS Cognito OAuth Provider for Enterprise Authentication (#1873) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2025-09-25 11:08:45 -04:00
nate nowack
04831b75c2
 		optimize test suite (#1893) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-09-22 20:07:04 -04:00
Anvi Banga
59e250a98e
 		feat: Add support for Descope Authentication (#1853) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2025-09-19 13:46:44 -04:00
Ruhul Alam
2df8a0f915
 		chore: Set redirect_path default in function (#1833) 2025-09-15 18:33:44 -04:00
Ruhul Alam
972521146f
 		feat: Add support for OIDC configuration (#1817) 2025-09-14 14:54:48 -04:00
William Easton
fe4f31c2c7
 		Enable more type checking rules (#1775) 2025-09-07 11:11:44 -04:00
Jeremiah Lowin
d36ea42b92
 		Fix OAuth resource URL handling and WWW-Authenticate header (#1706) 2025-09-02 15:14:05 -04:00
Jeremiah Lowin
aef6d23fb9
 		refactor: move scope parser to utilities (#1642) 2025-08-26 10:50:54 -04:00
Jeremiah Lowin
c3d1176a69
 		Add WorkOS and Azure OAuth providers (#1550) 2025-08-20 16:22:03 -04:00
Jeremiah Lowin
ec015de3b0
 		Add OAuth proxy that allows authentication with social IDPs without DCR support (#1434) 2025-08-18 13:39:58 -04:00