--- title: http sidebarTitle: http --- # `fastmcp.server.http` ## Functions ### `set_http_request` ```python set_http_request(request: Request) -> Generator[Request, None, None] ``` ### `create_base_app` ```python create_base_app(routes: list[BaseRoute], middleware: list[Middleware], debug: bool = False, lifespan: Callable | None = None) -> StarletteWithLifespan ``` Create a base Starlette app with common middleware and routes. **Args:** - `routes`: List of routes to include in the app - `middleware`: List of middleware to include in the app - `debug`: Whether to enable debug mode - `lifespan`: Optional lifespan manager for the app **Returns:** - A Starlette application ### `create_sse_app` ```python create_sse_app(server: FastMCP[LifespanResultT], message_path: str, sse_path: str, auth: AuthProvider | None = None, debug: bool = False, routes: list[BaseRoute] | None = None, middleware: list[Middleware] | None = None, host_origin_protection: HostOriginProtection = False, allowed_hosts: Sequence[str] | None = None, allowed_origins: Sequence[str] | None = None) -> StarletteWithLifespan ``` Return an instance of the SSE server app. **Args:** - `server`: The FastMCP server instance - `message_path`: Path for SSE messages - `sse_path`: Path for SSE connections - `auth`: Optional authentication provider (AuthProvider) - `debug`: Whether to enable debug mode - `routes`: Optional list of custom routes - `middleware`: Optional list of middleware - `host_origin_protection`: Whether to validate Host and Origin headers before requests reach the SSE connection and message endpoints. Defaults to False for compatibility. "auto" protects localhost-bound servers and explicit host/origin allowlists. - `allowed_hosts`: Additional hostnames that may appear in the Host header. - `allowed_origins`: Additional browser origins trusted by the request guard. Configure CORS separately when browser JavaScript must read cross-origin responses. Returns: A Starlette application with RequestContextMiddleware ### `create_streamable_http_app` ```python create_streamable_http_app(server: FastMCP[LifespanResultT], streamable_http_path: str, event_store: EventStore | None = None, retry_interval: int | None = None, auth: AuthProvider | None = None, json_response: bool = False, stateless_http: bool = False, debug: bool = False, routes: list[BaseRoute] | None = None, middleware: list[Middleware] | None = None, host_origin_protection: HostOriginProtection = False, allowed_hosts: Sequence[str] | None = None, allowed_origins: Sequence[str] | None = None, session_idle_timeout: float | Literal['auto'] | None = 'auto') -> StarletteWithLifespan ``` Return an instance of the StreamableHTTP server app. **Args:** - `server`: The FastMCP server instance - `streamable_http_path`: Path for StreamableHTTP connections - `event_store`: Optional event store for SSE polling/resumability - `retry_interval`: Optional retry interval in milliseconds for SSE polling. Controls how quickly clients should reconnect after server-initiated disconnections. Requires event_store to be set. Defaults to SDK default. - `auth`: Optional authentication provider (AuthProvider) - `json_response`: Whether to use JSON response format - `stateless_http`: Whether to use stateless mode (new transport per request) - `debug`: Whether to enable debug mode - `routes`: Optional list of custom routes - `middleware`: Optional list of middleware - `host_origin_protection`: Whether to validate Host and Origin headers before requests reach the MCP endpoint. Defaults to False for compatibility. "auto" protects localhost-bound servers and explicit host/origin allowlists. - `allowed_hosts`: Additional hostnames that may appear in the Host header. - `allowed_origins`: Additional browser origins trusted by the request guard. Configure CORS separately when browser JavaScript must read cross-origin responses. - `session_idle_timeout`: Maximum time in seconds a session may remain idle before it is terminated. The deadline is pushed forward on every request. Defaults to "auto", which uses the MCP SDK's default (1800 seconds as of SDK 2.2). When None, sessions never expire from inactivity. Only applies to stateful HTTP sessions. **Returns:** - A Starlette application with StreamableHTTP support ## Classes ### `FastMCPStreamableHTTPSessionManager` Session manager that scopes resumability storage per transport session. **Methods:** #### `event_store` ```python event_store(self) -> EventStore | None ``` #### `event_store` ```python event_store(self, event_store: EventStore | None) -> None ``` ### `StreamableHTTPASGIApp` ASGI application wrapper for Streamable HTTP server transport. ### `HostOriginGuardMiddleware` Validate Host and Origin headers before requests reach MCP sessions. ### `StarletteWithLifespan` **Methods:** #### `lifespan` ```python lifespan(self) -> Lifespan[Starlette] ``` ### `RequestContextMiddleware` Middleware that stores each request in a ContextVar and sets transport type.