ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-21 13:04:18 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,522 commits 156 branches 116 tags 71 MiB
Commit graph

193 commits

Author SHA1 Message Date
Jeremiah Lowin
3b8538e242
 		Allow private JWT headers (#4290) 2026-06-06 02:23:48 +01:00
Jeremiah Lowin
e58f386bac
 		Log refresh-token misses in OAuthProxy instead of failing silently (#4276) 2026-06-03 11:22:35 -04:00
Jeremiah Lowin
58e0f5320b
 		Decouple FastMCP access token lifetime from upstream expires_in (#4254) 2026-05-30 11:48:23 -04:00
Jeremiah Lowin
53b20168c8
 		Close upstream OAuth clients (#4248) 2026-05-27 19:45:45 -04:00
Bill Easton
802ceaaa6b
 		Add targeted coverage tests (#4230) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-05-25 18:57:28 -04:00
Jeremiah Lowin
b8c9d58d61
 		Migrate auth JWTs to joserfc (#4221) 2026-05-23 09:29:04 -04:00
rgillinlz
81a16ed27f
 		fix(auth): unprefix Azure scopes echoed back to MCP clients (#4130) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-05-20 12:22:24 -04:00
mohanram
0022d8518f
 		Add token_expiry_threshold_seconds for proactive token refresh (#4142) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-05-20 10:47:26 -04:00
Shigechika AIKAWA
2a262438fa
 		fix(auth): add /.well-known/openid-configuration alias for OAuth server metadata (#4167) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 10:36:01 -04:00
Tiago Surjus Kaneta
b0fb2c3ae6
 		Add valid_scopes and extra_authorize_params to WorkOSProvider (#4135) 2026-05-20 10:31:48 -04:00
Bill Easton
344a4f81b5
 		fix(auth): disambiguate auth-denied vs missing component messages (#4165) 2026-05-20 09:36:27 -04:00
Bill Easton
11951585c0
 		fix(tests): hoist azure-identity import out of the OBO test timeout window (#4176) 2026-05-20 09:35:56 -04:00
Kiran Thakkar
cf59a4511f
 		Fix OCI Provider issue in 3.x version. Add OCI auth provider example … (#4116) 
* Fix OCI Provider issue in 3.x version. Add OCI auth provider example and test

* Fix OCI Provider issue in 3.x version. Add OCI auth provider example and test. Fixed a couple of minor issues in README.

* Rerun CI
 2026-05-10 10:08:00 -04:00
Taylor Wilsdon
61e56c683e
 		enh: Add public API for updating OAuthProxy scopes after initialization (#4091) 2026-05-04 15:49:12 -04:00
Carlos Rian
eebdc8c031
 		feat: add AzureB2CProvider for Azure AD B2C user flows (#3995) 2026-04-22 09:24:09 -04:00
Jeremiah Lowin
2d6143c6d8
 		fix: honor upstream refresh token expiry in OAuthProxy (#3990) 2026-04-20 14:03:57 -04:00
Jeremiah Lowin
801385df44
 		fix: bound _refresh_locks with LRU eviction to prevent memory leak (#3968) 2026-04-18 11:07:38 -04:00
Jeremiah Lowin
1e67c53a17
 		Reject dot-segments in redirect URI allowlist matching (#3963) 2026-04-17 17:49:25 -04:00
Jeremiah Lowin
7fb037f20c
 		Harden OAuth Proxy silent consent against AS-in-the-middle (#3960) 2026-04-17 16:39:50 -04:00
Jeremiah Lowin
eb1426251c
 		Allow upstream client_id to be used directly without DCR (#3957) 
Co-authored-by: Claude <noreply@anthropic.com>
 2026-04-17 15:22:44 -04:00
Jeremiah Lowin
82f310fe61
 		AuthKit: auto-bind token audience to resource URL (RFC 8707) (#3905) 2026-04-13 17:11:17 -04:00
Adam Azzam
f21e51794c
 		Allow auth providers to override protected resource base URLs (#3900) 
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-04-13 13:36:55 -04:00
Stephan Eberle
99bf81c64f
 		Add Keycloak OAuth Provider for Enterprise Authentication and local dev (#1937) 2026-04-13 12:23:10 -04:00
Jeremiah Lowin
1d39e26025
 		Fix CIMD clients getting required_scopes instead of valid_scopes (#3836) 2026-04-12 16:34:56 -04:00
Jeremiah Lowin
6592aaa70e
 		fix: accept both client_id and identifier_uri as Azure audience (#3797) 2026-04-08 20:25:42 -04:00
Jeremiah Lowin
2b9d3eee0f
 		fix: use identifier_uri as audience for Azure token validation (#3787) 
* fix: use identifier_uri as audience for Azure token validation

* fix test expectations for identifier_uri audience
 2026-04-07 18:37:52 -04:00
Jeremiah Lowin
e1ea133fb7
 		fix: Cognito token verification checks client_id instead of aud (#3786) 
* fix: Cognito token verification checks client_id instead of aud

* fix: Cognito token verification checks client_id instead of aud

* handle list audience values in Cognito client_id check
 2026-04-07 18:09:43 -04:00
Fatia Kusuma Dewi
5587cb7c43
 		changeable allowed_client_redirect_uris (#3772) 2026-04-06 20:58:09 -04:00
Kakarlamudi Venkata Dhanush
c642d6a5cf
 		fix: propagate upstream_claims in load_access_token (#3750) 2026-04-06 19:55:26 -04:00
AIKAWA Shigechika
5be249ada3
 		fix(google): use sub (user ID) for client_id instead of aud (app ID) (#3722) 2026-03-31 10:33:58 -04:00
Mostafa Kamal
57a7f121d4
 		Add Clerk OAuth provider (#3677) 2026-03-29 11:01:22 -04:00
Jeremy Simon
492db9972f
 		fix: resolve EntraOBOToken dependency injection through MultiAuth (#3609) 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-03-25 10:58:19 -04:00
AIKAWA Shigechika
c3f0223bbb
 		fix(google): replace deprecated /oauth2/v1/tokeninfo with /oauth2/v3/userinfo (#3603) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
 2026-03-25 10:39:34 -04:00
Jeremiah Lowin
c397e68d39
 		Update ty ignore comments for 0.0.25 compatibility (#3614) 2026-03-24 20:26:26 -04:00
Rushabh Doshi
204e566227
 		Fix loopback redirect URI port matching per RFC 8252 §7.3 (#3589) 
🤖 Generated with Claude Code

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-22 19:35:02 -04:00
Jeremiah Lowin
52feff6878
 		Transparently refresh upstream token in OAuthProxy.load_access_token() (#3584) 
* Transparently refresh upstream token in OAuthProxy.load_access_token()

When upstream token validation fails during load_access_token, attempt
to refresh using the stored refresh token before returning None. This
prevents premature 401s that force clients into expensive full re-auth
flows when the upstream token expires.

Co-authored-by: Claude <noreply@anthropic.com>

* Gate transparent refresh on token expiry, add advisory lock

Only attempt upstream refresh when the token is actually expired, not
on any validation failure (scope mismatch, revocation, etc.). Add
per-token advisory lock to prevent concurrent async tasks from racing
to refresh the same upstream token.

* Re-check expiry inside lock, reload from storage after refresh failure

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-03-22 10:43:44 -04:00
Jeremiah Lowin
269c9c9f46
 		Extract TokenCache utility, add caching to GitHubTokenVerifier (#3547) 
* feat: add TokenCache utility and caching to GitHubTokenVerifier

Extract the caching machinery from IntrospectionTokenVerifier into a
shared TokenCache class in fastmcp.utilities.token_cache, then wire
it into both IntrospectionTokenVerifier and GitHubTokenVerifier.

* Remove dead constant, validate negative cache params

* Fix overwrite eviction bug, skip cache on scope lookup failure
 2026-03-18 15:26:09 -04:00
Jeremiah Lowin
bb37c3bb6b
 		fix: reject refresh tokens used as Bearer access tokens (#3524) 2026-03-15 15:21:30 -04:00
Jeremiah Lowin
8fdb3cc27c
 		fix: CSRF double-submit cookie check in consent flow (#3519) 
* Upgrade examples/testing_demo lockfile, drops diskcache (CVE-2025-69872)

* fix: add CSRF double-submit cookie check to consent flow (GHSA-rww4-4w9c-7733)

* fix: preserve CSRF state across concurrent flows, fix test isolation

* fix: reject non-__Host consent-state cookie on HTTPS
 2026-03-15 14:22:01 -04:00
Jeremiah Lowin
32dfe50f39
 		Treat refresh_expires_in=0 as missing, fall back to 30-day default (#3514) 
Keycloak returns refresh_expires_in=0 for offline tokens (offline_access scope),
meaning "no fixed time-based expiry". The truthiness check on this value caused
the proxy to skip issuing a PROXY_RT, forcing browser re-auth every hour.

Closes #3509

🤖 Generated with Claude Code

Co-authored-by: Marvin Context Protocol <41898282+Marvin Context Protocol@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
 2026-03-15 11:49:50 -04:00
Jeremiah Lowin
ea529f6a49
 		feat: make upstream_client_secret optional in OAuthProxy (#3486) 
* feat: make upstream_client_secret optional in OAuthProxy

Extract _create_upstream_oauth_client() factory method for subclass
override. Cookie signing falls back to JWT key material when no secret.

* fix: include client_id in revocation requests for public clients

* fix: use factory method for revocation auth
 2026-03-15 11:14:56 -04:00
Jeremiah Lowin
9be42d9013
 		perf: reduce PBKDF2 iterations in tests, fix warnings and timeouts (#3504) 
- Use 10 PBKDF2 iterations in test_mode (vs 1M in production) for
  JWT key derivation — cuts auth test setup from ~2.5s to <0.1s
- Add timeout(15) to subprocess-spawning tests (TestKeepAlive,
  test_mcp_config) that exceed 5s under parallel CI load
- Remove pytestmark filterwarnings overrides in tests/deprecated/
  that were leaking DeprecationWarning to test output
- Fix deprecated add_tool_transformation() usage in test_authorization
- Document new settings in settings.mdx
 2026-03-14 16:42:06 -04:00
Jeremiah Lowin
71ba030380
 		fix: reject empty/OIDC-only required_scopes in AzureProvider (#3503) 
🤖 Generated with Claude Code
 2026-03-14 16:35:43 -04:00
Jeremiah Lowin
e41e1fec10
 		fix: resolve ty 0.0.23 type-checking errors and bump pin (#3481) 2026-03-13 19:45:14 -04:00
Jeremiah Lowin
59a6fb3839
 		fix: normalize Google scope shorthands and surface valid_scopes (#3477) 
* fix: normalize Google scope shorthands and surface valid_scopes

Google accepts shorthand scopes like "email" in authorization requests but
returns full URIs like "https://www.googleapis.com/auth/userinfo.email" in
token responses. The verifier now normalizes shorthands at initialization so
the subset check works regardless of which form was used. GoogleProvider also
now exposes valid_scopes for controlling which scopes clients can request
beyond the required minimum.

Co-authored-by: Claude <noreply@anthropic.com>

* remove unused GOOGLE_SCOPE_ALIASES_REVERSE

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-03-13 18:42:16 -04:00
d 🔹
33c3acfc87
 		fix: use intent-based flag for OIDC scope patch in load_access_token (#3465) 
When OIDCProxy has verify_id_token=True and the IdP issues the same JWT
for both access_token and id_token, the value-equality check
`verification_token != upstream_token_set.access_token` evaluated to
False, skipping the scope patch entirely. This left AccessToken.scopes
empty, causing RequireAuthMiddleware to return 403 insufficient_scope.

Replace the value-equality check with an intent-based virtual method
`_uses_alternate_verification()` that OIDCProxy overrides to return
`self._verify_id_token`. The base OAuthProxy returns False (preserving
existing behavior for non-OIDC providers).

Fixes #3461

Co-authored-by: voidborne-d <voidborne-d@users.noreply.github.com>
 2026-03-13 17:59:03 -04:00
Jeremiah Lowin
5ed14650ab
 		Block insecure HS* JWT verification with JWKS/public keys (#3430) 
* Block HS* JWT verification with public keys/JWKS

🤖 Generated with GPT-5.2-Codex

* Fix ruff format violations

🤖 Generated with Claude Code

* Handle bytes public_key in HS* algorithm PEM check
 2026-03-07 12:20:48 -05:00
Jeremiah Lowin
901d8cdd60
 		Block HS* algorithms when JWTVerifier is configured with JWKS (#3419) 
* Block HS* algorithms with JWKS in JWT verifier

🤖 Generated with GPT-5.2-Codex

* Fix ruff format: remove extra blank line in test_supabase.py

🤖 Generated with Claude Code

Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>

---------

Co-authored-by: Marvin Context Protocol <41898282+Marvin Context Protocol@users.noreply.github.com>
Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>
 2026-03-07 11:41:04 -05:00
Jeremiah Lowin
1708e53d9e
 		Bind AWS Cognito token verification to configured app client (#3406) 
* Bind Cognito verifier audience to client ID

🤖 Generated with GPT-5.2-Codex

* Fix ty error: narrow return type of AWSCognitoProvider.get_token_verifier

🤖 Generated with Claude Code
 2026-03-07 11:40:39 -05:00
Jeremiah Lowin
799c4f1673
 		Escape client_id in OAuth consent details (#3418) 
🤖 Generated with GPT-5.2-Codex
 2026-03-06 17:33:12 -05:00