ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-21 13:04:18 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,044 commits 156 branches 116 tags 71 MiB
Commit graph

341 commits

Author SHA1 Message Date
Manrique Vargas
c71840631e
 		docs: add context-aware tool factory example (#3264) 
Fixes PrefectHQ/fastmcp#1841

Signed-off-by: machov <mv1742@nyu.edu>
 2026-02-22 11:24:22 -05:00
Jeremiah Lowin
a2efd686a9
 		Normalize repo references to PrefectHQ/fastmcp casing (#3218) 2026-02-18 14:51:18 -05:00
Jeremiah Lowin
958e657521
 		Update docs for 3.0 GA release (#3216) 
* Update docs for 3.0 GA release

* Add upgrade command to v2 migration section

* Revert "Add upgrade command to v2 migration section"

This reverts commit ee03d0d847.
 2026-02-18 14:29:28 -05:00
Jeremiah Lowin
9b248a15b3
 		Update repository references for transfer to prefecthq (#3207) 
* Update repository references from jlowin/fastmcp to prefecthq/fastmcp

* Retrigger CI after repo transfer

* chore: Update SDK documentation

* Only run deep triage on bug issues for jlowin

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-18 10:33:56 -05:00
Jeremiah Lowin
016b9f90e0
 		Fix confused deputy attack via consent binding cookie (#3201) 
* Add consent binding cookie to prevent confused deputy attacks (GHSA-rww4-4w9c-7733)

The OAuthProxy's consent page verified user intent but didn't bind the
consenting browser to the IdP callback. An attacker could intercept the
upstream authorization URL after consent and send it to a victim, whose
browser would complete the flow without having the consent cookie.

This adds a signed consent binding cookie set during consent approval
(both manual and auto-approve paths) and verified in the IdP callback
handler. A different browser won't have this cookie and gets a 403.

* Use startswith for URL assertion in consent binding test

* Store consent bindings as per-transaction map to support parallel flows

* Only accept __Host- consent binding cookie on HTTPS

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-17 10:24:07 -05:00
Jeremiah Lowin
5dd8cde2f9
 		Drop diskcache dependency (CVE-2025-69872) (#3185) 
* Drop diskcache dependency (CVE-2025-69872)

Switch default OAuth proxy storage from DiskStore (backed by diskcache,
which uses pickle serialization) to FileTreeStore (file-per-key JSON).
This removes diskcache from the dependency tree entirely, resolving
CVE-2025-69872 for pip-audit and similar scanners.

* chore: Update SDK documentation

* Add comments explaining FileTreeStore warning suppression

* chore: Update SDK documentation

* Isolate storage by encryption key, gracefully handle decryption failures

* chore: Update SDK documentation

* Bump py-key-value-aio lower bound to 0.4.2 for FileTreeStore security hardening

* chore: Update SDK documentation

* Document storage backend change and update DiskStore references

* Bump py-key-value-aio lower bound to 0.4.3

* Bump py-key-value-aio to 0.4.4, remove warning suppression

* chore: Update SDK documentation

---------

Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-16 16:43:15 -05:00
Jeremiah Lowin
62804e2f06
 		Add cache key identity note to middleware docs 2026-02-16 08:52:28 -05:00
Jeremiah Lowin
e5553177d7
 		docs: update all references from 3.0.0b2 to 3.0.0rc1 (#3173) 2026-02-12 16:39:16 -06:00
Jeremiah Lowin
b62ed3408b
 		Support non-serializable values in Context.set_state (#3171) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-12 15:06:42 -06:00
Jeremiah Lowin
a307e9c3cc
 		Expose local_provider property, deprecate FastMCP.remove_tool() (#3155) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 19:37:19 -06:00
Jeremiah Lowin
fe57c3d689
 		Make $ref dereferencing optional via FastMCP(dereference_refs=...) (#3151) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 13:45:37 -05:00
Jeremiah Lowin
50b23299f8
 		Support async auth checks (#3152) 
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
 2026-02-11 12:48:51 -05:00
Bill Easton
5bab188106
 		Add concurrent tool execution with sequential flag (#3022) 
Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-02-09 20:43:53 -05:00
Jeremiah Lowin
45af482e73
 		Add Azure OBO dependencies, auth token injection, and documentation (#2918) 2026-02-09 20:06:57 -05:00
Jeremiah Lowin
806aa8c579
 		Update docs to reference beta 2 (#3112) 2026-02-07 10:33:12 -05:00
Jeremiah Lowin
931d6f878c
 		Remove require_auth; fix auth docs re: component-level enforcement (#3103) 
🤖 Generated with Claude Code

https://claude.ai/code/session_01WWzwcBfLWnxoN9XNs5Fhxr

Co-authored-by: Claude <noreply@anthropic.com>
 2026-02-06 20:08:50 -05:00
Jeremiah Lowin
ad3b1b9d1b
 		Fix CIMD redirect allowlist bypass and cache revalidation (#3098) 
* Harden CIMD redirect and cache handling

* Preserve CIMD cache policy on 304 revalidation

* Refresh 304 cache expiry from cached lifetime
 2026-02-06 20:08:23 -05:00
Jeremiah Lowin
b8d789c1b4
 		Document token passthrough security in OAuth Proxy docs (#3100) 2026-02-06 18:20:17 -05:00
Jeremiah Lowin
32c6826e13
 		Add note about output_schema incongruity when responses are truncated (#3099) 2026-02-06 18:15:57 -05:00
Diogo Santos
30832ced1c
 		Add ResponseLimitingMiddleware for tool response size control (#3072) 2026-02-06 18:13:26 -05:00
Jeremiah Lowin
880d835ccc
 		Add CIMD (Client ID Metadata Document) support for OAuth (#2871) 2026-02-06 13:44:52 -05:00
Jeremiah Lowin
b076b2154c
 		Add AzureJWTVerifier for Managed Identity token verification (#3058) 2026-02-02 19:59:13 -05:00
Jeremiah Lowin
c1f50e49be
 		Add enabled field to ToolTransformConfig (#2991) 2026-01-22 17:44:38 -05:00
Jeremiah Lowin
884b81a0f8
 		Add dependency injection documentation and DI-style dependencies (#2980) 2026-01-22 09:08:20 -05:00
Jeremiah Lowin
41c56481af
 		Pin httpx < 1.0 and simplify beta install docs (#2975) 2026-01-21 21:08:46 -05:00
Jeremiah Lowin
6dba73b69d
 		Restructure docs: move transforms to dedicated section (#2956) 2026-01-20 00:38:35 -05:00
Jeremiah Lowin
0be4cda159
 		Prepare docs for v3.0 beta release (#2954) 2026-01-20 00:13:18 -05:00
Jeremiah Lowin
c14ef132da
 		Clarify installation for FastMCP 3.0 beta (#2953) 2026-01-19 23:24:47 -05:00
Jeremiah Lowin
3df38584cf
 		Fix broken documentation links (#2952) 2026-01-19 23:17:29 -05:00
Jeremiah Lowin
3af9de197a
 		Restructure documentation for FastMCP 3.0 (#2951) 2026-01-19 21:33:35 -05:00
Jeremiah Lowin
0e4d519c86
 		Rename Enabled transform to Visibility (#2950) 2026-01-19 20:46:58 -05:00
Jeremiah Lowin
ba18a716bf
 		Add client utilities for downloading skills (#2948) 2026-01-19 20:10:39 -05:00
Jeremiah Lowin
16ffc9432f
 		Add Skills Provider for exposing agent skills as MCP resources (#2944) 2026-01-19 18:29:16 -05:00
Jeremiah Lowin
c0ef90e713
 		Add PromptsAsTools transform (#2946) 2026-01-19 18:19:53 -05:00
Jeremiah Lowin
d3327269d7
 		Add ResourcesAsTools transform (#2943) 2026-01-19 17:40:31 -05:00
Jeremiah Lowin
4d2feb0c29
 		Refactor transform list methods to pure function pattern (#2942) 2026-01-19 16:21:35 -05:00
Jeremiah Lowin
d8ab493664
 		Add session-specific visibility control via Context (#2917) 2026-01-18 22:31:06 -05:00
Jeremiah Lowin
2d200a887b
 		Fix custom provider docs to show correct interface (#2920) 2026-01-18 21:37:30 -05:00
Jeremiah Lowin
f603fe094a Remove sync notification infrastructure 
Remove send_notification_sync() method, notification queue, and background flusher task. Component add/remove operations happen outside sessions and no longer need notifications.
 2026-01-18 17:31:11 -05:00
Jeremiah Lowin
19526cad65 Fix meta mutation bug; update docs to reflect mark/override semantics 2026-01-18 15:18:15 -05:00
Jeremiah Lowin
84eb35bcb4 Simplify disable calls to use keys only; fix filtering docs 2026-01-18 15:08:39 -05:00
Jeremiah Lowin
84d7d3b281 Support plural names/keys in enable/disable API 
Change enable() and disable() to accept sets: names, keys, tags.
Use key-based disable for decorator enabled=False to scope exactly.
 2026-01-18 14:58:29 -05:00
Jeremiah Lowin
50ba6ea5a4 Refactor visibility to mark-based enabled system 
Rename Visibility to Enabled, collapse VisibilityRule into the transform,
and move enabled filtering from Provider to Server level so server-level
transforms can override provider-level disables.
 2026-01-18 14:36:33 -05:00
Jeremiah Lowin
17d43d7991 Address review feedback: validation and edge cases 2026-01-17 19:50:33 -05:00
Jeremiah Lowin
96d4b1b606 Add pagination documentation 2026-01-17 19:30:33 -05:00
Jeremiah Lowin
33c371cb37
 		Add version discovery and calling a certain version for components (#2897) 2026-01-17 08:27:39 -05:00
Jeremiah Lowin
53e220a99e
 		Rename _fastmcp metadata namespace to fastmcp and make non-optional (#2895) 2026-01-16 21:35:53 -05:00
Jeremiah Lowin
a6cd764b5f
 		Add component versioning and VersionFilter transform (#2894) 2026-01-16 20:53:18 -05:00
Jeremiah Lowin
c8c84ff911
 		Add session-scoped state persistence (#2873) 2026-01-16 14:11:21 -05:00
Marcus Shu
083999ca14
 		Add client_secret_post authentication to IntrospectionTokenVerifier (#2884) 2026-01-16 13:07:33 -05:00