Commit graph

3,331 commits

Author SHA1 Message Date
Jeremiah Lowin
6592aaa70e
fix: accept both client_id and identifier_uri as Azure audience (#3797) v3.2.2 2026-04-08 20:25:42 -04:00
dependabot[bot]
9f0d8d3d12
chore(deps): bump the uv group across 2 directories with 1 update (#3795)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 20:08:26 -04:00
aimable100
556fd8fa42
Harden client tool result error handling (#3778) v3.2.1 2026-04-08 13:57:10 -04:00
marvin-context-protocol[bot]
e064ba69de
chore: Update SDK documentation (#3791)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-04-07 21:42:16 -04:00
marvin-context-protocol[bot]
a3c5cc12d3
chore: Update SDK documentation (#3757)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-04-07 19:49:20 -04:00
Jeremiah Lowin
f5be772403
fix: bump ty to >=0.0.29 and suppress new false positives (#3790) 2026-04-07 19:49:09 -04:00
Jeremiah Lowin
f14456d63a
docs: document forward_resource parameter on OAuthProxy (#3788) 2026-04-07 19:42:10 -04:00
Jeremiah Lowin
2b9d3eee0f
fix: use identifier_uri as audience for Azure token validation (#3787)
* fix: use identifier_uri as audience for Azure token validation

* fix test expectations for identifier_uri audience
2026-04-07 18:37:52 -04:00
Jeremiah Lowin
e1ea133fb7
fix: Cognito token verification checks client_id instead of aud (#3786)
* fix: Cognito token verification checks client_id instead of aud

* fix: Cognito token verification checks client_id instead of aud

* handle list audience values in Cognito client_id check
2026-04-07 18:09:43 -04:00
Kakarlamudi Venkata Dhanush
042db1d0e3
Fix OpenAPI 3.0 nullable fields in tool input schemas (#3768)
* Fix OpenAPI 3.0 nullable fields leaking into tool input schemas

* fix: convert nullable fields in input schemas and fix recursion

* Fix unused loop variable in OpenAPI converter

* Refactor OpenAPI nullable conversion and add tests

* Clean up and add integration tests for nullable input schemas

---------

Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-07 18:09:26 -04:00
Jeremiah Lowin
e5b96343d1
Fix boolean property schemas in JSON Schema parsing (#3785) 2026-04-07 17:55:51 -04:00
Jeremiah Lowin
3ef9130269
fix: cap consent cookie size to prevent header overflow (#3784) 2026-04-07 17:16:14 -04:00
buyua9
3cb5579253
fix(docs): correct FastMCP tool name in welcome docs (#3781) 2026-04-07 14:48:50 -04:00
Jeremiah Lowin
8ee81b3037
fix: boolean false values dropped in form submissions (#3776)
* fix: boolean false values dropped in form submissions

* revert apps_dev.py boolean coercion
2026-04-07 11:23:34 -04:00
Jeremiah Lowin
bbccc52b60
fix: broken link in changelog (#3775) 2026-04-06 21:16:01 -04:00
Fatia Kusuma Dewi
5587cb7c43
changeable allowed_client_redirect_uris (#3772) 2026-04-06 20:58:09 -04:00
kaiisfree
0212a718c7
Remove deprecated asyncio.iscoroutinefunction fallback (#3767)
The `asyncio.iscoroutinefunction` call is deprecated in Python 3.14
and slated for removal in 3.16. Since `is_coroutine_function` already
unwraps `functools.partial` layers before checking, the asyncio
fallback is redundant on all supported Python versions — it can never
return True when `inspect.iscoroutinefunction` returned False on the
unwrapped function.

Fixes #3765

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-06 20:00:14 -04:00
Kakarlamudi Venkata Dhanush
c642d6a5cf
fix: propagate upstream_claims in load_access_token (#3750) 2026-04-06 19:55:26 -04:00
Kakarlamudi Venkata Dhanush
07e950ec09
fix: FastAPI TestClient compatibility and lifespan re-initialization (#3736) 2026-04-06 19:53:27 -04:00
Rishav Mitra
99eaeb8af4
fix: substitute server variable defaults when building base URL from OpenAPI spec (#3770)
* fix: resolve OpenAPI 3.x server variables in _create_default_client

When an OpenAPI spec defines server variables (e.g. `https://{region}.api.example.com/v1`),
the default values are now substituted before constructing the httpx client base URL.
Previously, the URL was used as-is, causing all requests to fail for specs that use
server variable templating.

Fixes #1681

* fix: use str.replace instead of format_map for server variable substitution

format_map applies Python string formatting rules, so variable names
like {api.version} would be treated as attribute access and raise errors.
Literal token replacement handles all valid OpenAPI variable names safely.
2026-04-06 19:48:30 -04:00
Jeremiah Lowin
eac646e744
chore: split SDK navigation into standalone $ref file (#3773) 2026-04-06 11:18:14 -04:00
Jeremiah Lowin
4bbc4eec3b
fix: ResponseLimitingMiddleware no longer breaks outputSchema tools (#3756) 2026-04-05 10:36:38 -04:00
mateeaaaaaaa
34e632db7f
fix: add proxy timeouts and modernize networking in apps dev (#3741)
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
2026-04-05 09:39:34 -04:00
Jeremiah Lowin
e2f72d863c
chore: split v2 docs navigation into separate file (#3762) 2026-04-04 21:17:39 -04:00
Chris Guidry
d41bcb2c9e
Unify background task context forwarding, fix concurrent dependency bugs (#3710)
* Unify background task context forwarding and fix concurrent dependency bugs

We've been getting a steady trickle of edge-case reports around background tasks
and contextual dependencies over the last few months (#3654, #3656, #3569). Each
one pointed at a different symptom, but they all traced back to the same area:
the way context is negotiated between the "frontend" server and Docket workers
was grown piecemeal, with each new piece of context (access tokens, HTTP headers,
origin request IDs) getting its own Redis key, its own restore function, and its
own ContextVar. This made it hard to reason about what state was available where,
and the shared-instance Dependency pattern made concurrent tasks stomp on each
other's cleanup state.

This takes a step back and reworks the whole thing as a single unified system:

- Dependency subclasses (_CurrentContext, Progress, _CurrentAccessToken, etc.)
  are now stateless factories — __aenter__ returns a fresh per-invocation
  object, so concurrent tasks never share mutable state. Fixes #3654, #3656.

- The three individual context-snapshot Redis keys (access_token, http_headers,
  origin_request_id) are collapsed into a single TaskContextSnapshot stored as
  one JSON key per task. The three _restore_task_* functions and two ContextVars
  they populated are gone.

- Sync functions like get_http_request() and get_access_token() now find the
  snapshot transparently in background tasks via a 3-tier sync fallback:
  ContextVar (set by _CurrentContext for functions with deps) → in-memory dict
  (same-process workers) → sync Redis GET (out-of-process workers). No function
  wrapping needed.

- The _wrap_for_task_http_headers hack is deleted. FunctionTool registers its
  raw function with Docket so Docket sees and resolves ALL dependencies,
  including Docket-native ones like Retry and Timeout.

- ProxyTool.from_mcp_tool() now propagates execution.taskSupport metadata from
  remote tools. Fixes #3569.

- Removed redundant _current_docket/_current_worker ContextVar management from
  Context.__aenter__/__aexit__ (they're only set in the lifespan now).

Closes #3654
Closes #3656
Closes #3569

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Address code review feedback

- _OptionalCurrentContext: guard __aexit__ against cleaning up contexts it
  didn't create (check is_background_task before delegating)
- Narrow except clauses in snapshot loading (OSError, JSONDecodeError, etc.
  instead of bare Exception)
- Fix docstrings on register_with_docket for resources/prompts/templates
- Simplify Progress: read ExecutionProgress directly from current_execution
  instead of creating and manually entering a DocketProgress wrapper

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Use pop-on-access transfer buffer instead of bounded LRU cache for snapshots

The in-memory snapshot dict is a transfer mechanism, not a cache. Entries go
in at submission and come out at the worker's first access. Using pop instead
of get means the dict only holds entries during the brief submission-to-execution
window, bounded by task concurrency (~10) rather than a 10,000-entry LRU limit.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Drop in-memory transfer buffer, use sync Redis for all backends

Instead of maintaining an in-memory dict to bridge the async/sync gap, use
a sync Redis client directly. For memory:// backends (fakeredis), shares the
same FakeServer instance via docket._redis.get_memory_server() so data written
by the async Docket client is visible to sync reads. For real Redis, creates a
standard sync connection. No in-process state to manage at all.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Move snapshot operations to TaskContextSnapshot methods

capture(), from_json(), to_json(), save() are now classmethod/instance methods
on the dataclass instead of free functions. Deduplicates JSON parsing that was
copy-pasted between the async and sync load paths.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Trim implementation details from register_with_docket docstrings

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Clarify docket lookup comment in submit_to_docket

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Restore docket/worker ContextVar bridge in Context.__aenter__

Servers that own the Docket (the parent) re-set _current_docket/_current_worker
from their instance attributes when entering a Context. Mounted children skip
this (their _docket is None), so they inherit the parent's value. This is needed
for ASGI deployments where ContextVars set during the lifespan don't propagate
to request handlers.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Key snapshot cache by task_id to prevent cross-task context leakage

Docket workers may reuse the same asyncio context for sequential tasks.
The ContextVar cache now stores (task_id, snapshot) tuples so stale entries
from previous tasks are automatically ignored.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 10:48:27 -04:00
marvin-context-protocol[bot]
697426b39e
chore: Update SDK documentation (#3755)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-04-03 10:44:08 -04:00
dependabot[bot]
75583a6b1f
chore(deps): bump anthropic from 0.86.0 to 0.87.0 in the uv group across 1 directory (#3742)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-03 10:43:57 -04:00
Jeremiah Lowin
333aaddff5
fix: remove CSP from tool metadata, keep on resource only (#3754) 2026-04-03 10:22:33 -04:00
Justin Quick (C4ADS)
927a03bee1
use result.object otherwise CallToolResult not scriptable (#3753) 2026-04-03 10:17:53 -04:00
marvin-context-protocol[bot]
a52ab0e92d
chore: Update SDK documentation (#3725)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-03-31 19:32:38 -04:00
dependabot[bot]
1cccdc2d27
chore(deps): bump fastmcp from 3.1.1 to 3.2.0 in /examples/testing_demo in the uv group across 1 directory (#3728)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 19:32:25 -04:00
Adam Azzam
c3c41b4402
[codex] Add FastMCP docs telemetry (#3727) 2026-03-31 19:32:09 -04:00
marvin-context-protocol[bot]
4f7668807a
chore: Update SDK documentation (#3712)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-03-31 12:02:59 -04:00
Jeremiah Lowin
61f3feec6a
fix: use explicit None checks for JWT exp validation (#3724) 2026-03-31 12:02:44 -04:00
AIKAWA Shigechika
5be249ada3
fix(google): use sub (user ID) for client_id instead of aud (app ID) (#3722) 2026-03-31 10:33:58 -04:00
Jeremiah Lowin
665514e19a
Add forward_resource flag to OAuthProxy (#3711) v3.2.0 2026-03-30 15:55:23 -04:00
Jeremiah Lowin
f189d1f7fb
Bump pydantic-monty to 0.0.9 (#3707)
Co-authored-by: Claude <noreply@anthropic.com>
2026-03-30 11:09:39 -04:00
Jeremiah Lowin
6faa2d61f8
Remove hardcoded prefab-ui version from pinning warnings (#3708) 2026-03-30 11:09:26 -04:00
marvin-context-protocol[bot]
dd8816c6cc
chore: Update SDK documentation (#3701)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-03-30 09:33:47 -04:00
Jeremiah Lowin
d27495960a
docs: note that custom routes are unauthenticated (#3706) 2026-03-30 09:32:38 -04:00
Jeremiah Lowin
4a54be2d5f
Add examples gallery page (#3705) 2026-03-30 09:21:32 -04:00
Jeremiah Lowin
961dd50456
Add interactive map example with geocoding (#3702) 2026-03-30 08:43:58 -04:00
Jeremiah Lowin
f01d0c581c
Add quiz example app, fix dev server empty string args (#3700) 2026-03-29 21:17:53 -04:00
marvin-context-protocol[bot]
85b7efd746
chore: Update SDK documentation (#3694)
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
2026-03-29 21:03:58 -04:00
Jeremiah Lowin
27abe3c3f0
Add sales dashboard and live system monitor examples, bump prefab-ui to 0.17 (#3696) 2026-03-29 21:00:15 -04:00
Jeremiah Lowin
493989f231
Improve quickstart: pie chart, interactive row selection, screenshots (#3699) 2026-03-29 16:15:42 -04:00
Jeremiah Lowin
dd7d89aaae
fix: dev apps log panel UX improvements (#3698) 2026-03-29 12:51:05 -04:00
Jeremiah Lowin
9b89eb192d
Add apps quickstart tutorial (#3695) 2026-03-29 12:08:50 -04:00
Jeremiah Lowin
60d2817245
Polish apps docs for 3.2 release (#3693) 2026-03-29 11:01:38 -04:00
Mostafa Kamal
57a7f121d4
Add Clerk OAuth provider (#3677) 2026-03-29 11:01:22 -04:00