ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-14 09:39:11 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,018 commits 162 branches 115 tags 99 MiB
Commit graph

102 commits

Author SHA1 Message Date
Jeremiah Lowin
657298112b
 		Fix MDX parsing error and update card images (#3213) 
* Fix MDX parsing error and add broken link CI check

Escape curly braces in docstring example that broke MDX parsing,
update card images, and add docs broken link check to CI.

* Revert CI broken link check — Mintlify runs this already

* Use code fence instead of inline backticks for MDX escaping

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-18 13:04:45 -05:00
Jeremiah Lowin
7aba0df323
 		Cache OBO credentials on AzureProvider for token reuse (#3212) 
* Cache OBO credentials on AzureProvider for token reuse

* chore: Update SDK documentation

* Close evicted OBO credentials properly

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-18 11:43:36 -05:00
Jeremiah Lowin
9b248a15b3
 		Update repository references for transfer to prefecthq (#3207) 
* Update repository references from jlowin/fastmcp to prefecthq/fastmcp

* Retrigger CI after repo transfer

* chore: Update SDK documentation

* Only run deep triage on bug issues for jlowin

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-18 10:33:56 -05:00
Jeremiah Lowin
a8b100eb8c
 		Add JWT audience validation and RFC 8707 warnings to auth providers (#3204) 
* Add JWT audience validation and RFC 8707 warnings to auth providers

* chore: Update SDK documentation

* Update AuthKit example README env var name

* Move RFC 8707 warnings inside default verifier guard

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-17 18:16:05 -05:00
Jeremiah Lowin
016b9f90e0
 		Fix confused deputy attack via consent binding cookie (#3201) 
* Add consent binding cookie to prevent confused deputy attacks (GHSA-rww4-4w9c-7733)

The OAuthProxy's consent page verified user intent but didn't bind the
consenting browser to the IdP callback. An attacker could intercept the
upstream authorization URL after consent and send it to a victim, whose
browser would complete the flow without having the consent cookie.

This adds a signed consent binding cookie set during consent approval
(both manual and auto-approve paths) and verified in the IdP callback
handler. A different browser won't have this cookie and gets a 403.

* Use startswith for URL assertion in consent binding test

* Store consent bindings as per-transaction map to support parallel flows

* Only accept __Host- consent binding cookie on HTTPS

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-17 10:24:07 -05:00
Jeremiah Lowin
5dd8cde2f9
 		Drop diskcache dependency (CVE-2025-69872) (#3185) 
* Drop diskcache dependency (CVE-2025-69872)

Switch default OAuth proxy storage from DiskStore (backed by diskcache,
which uses pickle serialization) to FileTreeStore (file-per-key JSON).
This removes diskcache from the dependency tree entirely, resolving
CVE-2025-69872 for pip-audit and similar scanners.

* chore: Update SDK documentation

* Add comments explaining FileTreeStore warning suppression

* chore: Update SDK documentation

* Isolate storage by encryption key, gracefully handle decryption failures

* chore: Update SDK documentation

* Bump py-key-value-aio lower bound to 0.4.2 for FileTreeStore security hardening

* chore: Update SDK documentation

* Document storage backend change and update DiskStore references

* Bump py-key-value-aio lower bound to 0.4.3

* Bump py-key-value-aio to 0.4.4, remove warning suppression

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-16 16:43:15 -05:00
marvin-context-protocol[bot]
edac1e5427 chore: Update SDK documentation 2026-02-14 03:43:26 +00:00
Jeremiah Lowin
ccfe5047bf
 		Fix include_tags/exclude_tags ignored without tools in MCPConfig (#3186) 
* Fix include_tags/exclude_tags ignored without tools in MCPConfig

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-13 20:38:56 -05:00
Jeremiah Lowin
5f941be5a3
 		Fix stale request context in StatefulProxyClient handlers (#3172) 
* fix: restore request context in StatefulProxyClient handlers

StatefulProxyClient reuses sessions across requests, so its receive-loop
task inherits a stale request_ctx ContextVar from the first request.
Server-initiated messages (elicitation, sampling, etc.) that depend on
related_request_id routing get sent to a closed stream and hang forever.

Closes #3169

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-12 17:13:23 -05:00
Jeremiah Lowin
b62ed3408b
 		Support non-serializable values in Context.set_state (#3171) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-12 15:06:42 -06:00
Jeremiah Lowin
175479f65f
 		fix: guard client pagination loops against misbehaving servers (#3167) 
* fix: guard client pagination loops against misbehaving servers

Treat empty/falsy nextCursor as end-of-pagination and detect cursor
cycles across all client list methods and the server context proxy
helper.

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-12 13:19:02 -06:00
Bill Easton
359575b12f
 		Add helpers for converting FunctionTool and TransformedTool to SamplingTool (#3062) 
Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 19:43:03 -06:00
Jeremiah Lowin
a307e9c3cc
 		Expose local_provider property, deprecate FastMCP.remove_tool() (#3155) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 19:37:19 -06:00
Jeremiah Lowin
fe57c3d689
 		Make $ref dereferencing optional via FastMCP(dereference_refs=...) (#3151) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 13:45:37 -05:00
Jeremiah Lowin
50b23299f8
 		Support async auth checks (#3152) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 12:48:51 -05:00
Jeremiah Lowin
25e2f4da32
 		Remove deprecated FastMCP() constructor kwargs (#3148) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 11:39:34 -05:00
Jeremiah Lowin
0f95ed72cd
 		Stop duplicating path parameter descriptions into tool prose (#3149) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 11:34:11 -05:00
Bill Easton
8e1f662d93
 		Bump py-key-value-aio to >=0.4.0,<0.5.0 (#3143) 
Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 10:03:45 -05:00
marvin-context-protocol[bot]
a53030a806 chore: Update SDK documentation 2026-02-10 21:00:34 +00:00
marvin-context-protocol[bot]
95b4271b3b chore: Update SDK documentation 2026-02-10 20:36:17 +00:00
Jeremiah Lowin
1d0c0adeab
 		Add validate_output option for OpenAPI tools (#3134) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-10 13:29:45 -05:00
Jeremiah Lowin
a715176499
 		Fix unhandled exceptions in OpenAPI POST tool calls (#3133) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-10 13:13:45 -05:00
marvin-context-protocol[bot]
a1cf2aff6e
 		chore: Update SDK documentation (#3116) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-09 20:45:52 -05:00
marvin-context-protocol[bot]
3e3ed76a8c
 		chore: Update SDK documentation (#3089) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-06 20:27:29 -05:00
marvin-context-protocol[bot]
5e0211dd5e
 		chore: Update SDK documentation (#3069) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-04 18:31:07 -05:00
marvin-context-protocol[bot]
f6988c9206
 		chore: Update SDK documentation (#2995) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-03 21:08:20 -05:00
marvin-context-protocol[bot]
fde9068efb
 		chore: Update SDK documentation (#2990) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-22 19:41:15 -05:00
marvin-context-protocol[bot]
8596c09fdf
 		chore: Update SDK documentation (#2949) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-19 21:22:39 -05:00
Jeremiah Lowin
0e4d519c86
 		Rename Enabled transform to Visibility (#2950) 2026-01-19 20:46:58 -05:00
marvin-context-protocol[bot]
7d40b1dd4c
 		chore: Update SDK documentation (#2945) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-19 19:22:38 -05:00
marvin-context-protocol[bot]
a036ad31e2
 		chore: Update SDK documentation (#2940) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-19 16:49:12 -05:00
marvin-context-protocol[bot]
c9c8b41bde
 		chore: Update SDK documentation (#2938) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-19 10:17:10 -05:00
marvin-context-protocol[bot]
e98e04fb83
 		chore: Update SDK documentation (#2932) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-19 10:16:14 -05:00
marvin-context-protocol[bot]
36876c5148
 		chore: Update SDK documentation (#2930) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-19 08:31:18 -05:00
marvin-context-protocol[bot]
5c457f2ef4
 		chore: Update SDK documentation (#2922) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-18 22:35:25 -05:00
Jeremiah Lowin
8b0d016c30
 		Split transports.py into modular structure (#2921) 2026-01-18 22:11:25 -05:00
marvin-context-protocol[bot]
d9f2e67f70
 		chore: Update SDK documentation (#2916) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-18 21:32:20 -05:00
marvin-context-protocol[bot]
197184b7ca chore: Update SDK documentation 2026-01-18 21:18:31 +00:00
Jeremiah Lowin
84d7d3b281 Support plural names/keys in enable/disable API 
Change enable() and disable() to accept sets: names, keys, tags.
Use key-based disable for decorator enabled=False to scope exactly.
 2026-01-18 14:58:29 -05:00
Jeremiah Lowin
50ba6ea5a4 Refactor visibility to mark-based enabled system 
Rename Visibility to Enabled, collapse VisibilityRule into the transform,
and move enabled filtering from Provider to Server level so server-level
transforms can override provider-level disables.
 2026-01-18 14:36:33 -05:00
marvin-context-protocol[bot]
c64c4a1b3c
 		chore: Update SDK documentation (#2896) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-16 21:36:46 -05:00
marvin-context-protocol[bot]
1700bc360b
 		chore: Update SDK documentation (#2834) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-16 21:28:11 -05:00
marvin-context-protocol[bot]
24d500d384
 		chore: Update SDK documentation (#2761) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-01-10 11:49:29 -05:00
marvin-context-protocol[bot]
74eb8a0645
 		chore: Update SDK documentation (#2717) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2025-12-26 16:15:08 -05:00
Jeremiah Lowin
568300e8b5
 		Remove automatic environment variable loading from auth providers (#2752) 2025-12-26 15:37:59 -05:00
marvin-context-protocol[bot]
9d5ffa86b3
 		chore: Update SDK documentation (#2604) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2025-12-24 16:21:31 -05:00
marvin-context-protocol[bot]
9ddea52d93
 		chore: Update SDK documentation (#2592) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2025-12-11 21:43:51 -05:00
marvin-context-protocol[bot]
855e01ed21
 		chore: Update SDK documentation (#2588) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2025-12-09 22:08:03 -05:00
marvin-context-protocol[bot]
d35b867b10
 		chore: Update SDK documentation (#2517) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2025-12-09 21:07:20 -05:00
Jeremiah Lowin
b501f05794
 		Switch to new OpenAPI parser as default (#2513) 
* Switch to new OpenAPI parser as default

Remove the legacy OpenAPI parser and make the experimental parser the
default. The experimental parser (introduced in 2.11) offers better
performance, improved compatibility, and a more maintainable architecture.

- Delete legacy parser (server/openapi.py, utilities/openapi.py)
- Move experimental parser to main locations
- Remove enable_new_openapi_parser feature flag
- Update documentation to remove experimental references

* Add deprecation stubs for experimental OpenAPI imports

* Add deprecated enable_new_openapi_parser setting and deprecation tests

* SDK docs

* REview comments

* Fix docstrings

* Update docstring

* Review comments

* Fix broken links
 2025-12-01 20:29:18 -05:00