---
title: "FastMCP Updates"
sidebarTitle: "Updates"
icon: "sparkles"
tag: NEW
---

<Update label="FastMCP 4.0.0b4" description="August 26, 2026" tags={["Releases"]}>
<Card
title="FastMCP v4.0.0b4: Calm Befour the Storm"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.0.0b4"
cta="Read the release notes"
>
FastMCP 4 beta 4 is the final hardening pass before the stable release, improving modern multi-server clients, operational tooling, and security boundaries.

🌐 **Modern multi-server clients** — proxy-backed client configurations now preserve modern protocol support instead of forcing the legacy handshake.

☁️ **Horizon accounts** — new commands manage Prefect Horizon account authentication from the FastMCP CLI.

🔐 **Safer boundaries** — HTTP proxies no longer forward cookies, MCP transport headers reach their backends correctly, and CIMD caches stay bounded.

🔎 **Sharper tools** — BM25 search handles Unicode tokens and MCP inspect reports server instructions correctly.
</Card>
</Update>

<Update label="FastMCP 4.0.0b3" description="August 14, 2026" tags={["Releases"]}>
<Card
title="FastMCP v4.0.0b3: Fast Fourward"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.0.0b3"
cta="Read the release notes"
>
FastMCP 4 beta 3 moves the v4 line toward general availability with new authentication and dependency-injection capabilities, plus compatibility hardening across OAuth, proxies, OpenAPI, and Python 3.14.

🔐 **Authentication foundations** — Prefect Horizon gains a native authentication client and local state, Google token verification can pin audiences, and Scalekit issuer updates preserve backward compatibility.

🧰 **Tool dependencies** — `CallArgument` and `Depends` bindings from `uncalled-for` 0.4 work in regular tools and background tasks.

🔄 **Runtime reliability** — stateful proxy clients reconnect after session failures, consent transactions keep valid earlier CSRF tokens, and partial parameter hints work on Python 3.14.

🧾 **OpenAPI fidelity** — parameter-level `example` and `examples` values now flow into generated tool schemas.
</Card>
</Update>

<Update label="FastMCP 3.4.7" description="August 10, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.4.7: Know Your Audience"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.7"
cta="Read the release notes"
>
FastMCP 3.4.7 restores CIMD `private_key_jwt` authentication for bare-origin OAuth proxy deployments by validating client assertions against the exact token endpoint advertised to clients.
</Card>
</Update>

<Update label="FastMCP 3.4.6" description="August 5, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.4.6: Trust, but Proxy"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.6"
cta="Read the release notes"
>
FastMCP 3.4.6 adds trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches on the 3.x line. Deployments can route these requests through a mandated corporate proxy while preserving custom CA certificates, and FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.
</Card>
</Update>

<Update label="FastMCP 4.0.0b1" description="July 28, 2026" tags={["Releases"]}>
<Card
title="FastMCP v4.0.0b1: Fourgone Conclusion"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v4.0.0b1"
cta="Read the release notes"
>
FastMCP 4 makes stateful MCP applications work on the sessionless protocol while one deployment continues serving handshake-era clients. The engine underneath changed completely, but FastMCP absorbs nearly all of it — most FastMCP 3 servers upgrade untouched.

🌐 **Every protocol era** — one server answers both the sessionless `2026-07-28` protocol and the older session-based handshake, negotiated per connection.

💬 **Interactive tools** — tools ask follow-up questions across complete request-response rounds, with shared request-state keys for load balancing and worker restarts.

💾 **State without a session** — `UserSession` and `SessionId` give tools explicit server-side state on a protocol that deliberately has none, keyed per user when the request is authenticated.

⏳ **Background tasks** — the `io.modelcontextprotocol/tasks` extension in the new `fastmcp-tasks` package, on the same Docket engine FastMCP 3 used.

🧩 **Server extensions** — `add_extension()` turns capability-negotiated protocol features into a supported plugin surface.

🔐 **Enterprise auth** — server-side identity assertion (SEP-990), `require_roles`, scope step-up challenges, and DCR `application_type`.

⚠️ **Breaking** — server-initiated sampling and roots are removed from the server API, and the 3.x-era compatibility shims are gone. See the [upgrade guide](/getting-started/upgrading/from-fastmcp-3).
</Card>
</Update>

<Update label="FastMCP 3.4.5" description="July 27, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.4.5: Key Change"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.5"
cta="Read the release notes"
>
A maintenance release for the 3.x line. A single unrecognized JWKS key — Ed25519, which Rauthy and Ory Hydra publish by default — no longer poisons the entire key cache, alongside fixes for Azure scope fallback, OpenAPI `deepObject` query serialization, schema compression, and transformed tool `required` ordering.
</Card>
</Update>

<Update label="FastMCP 3.4.4" description="July 8, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.4.4: Host in Translation"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.4"
cta="Read the release notes"
>
A compatibility patch for HTTP deployments affected by the 3.4.3 Host/Origin guard defaults. FastMCP 3.x now keeps strict Host and Origin validation available for explicit opt-in deployments without rejecting existing ASGI, serverless, and reverse-proxy traffic by default.

🌐 **HTTP compatibility restored** — existing hosted deployments keep accepting their public Host headers unless strict host/origin protection is configured.

🔐 **Guard remains available** — deployments that know their public host and browser origins can still enable strict validation with `host_origin_protection=True`, `allowed_hosts`, and `allowed_origins`.

🤗 **Hugging Face auth** — new OAuth provider support covers public and private Hugging Face apps, with docs and examples for PKCE, Dynamic Client Registration, and CIMD.
</Card>
</Update>

<Update label="FastMCP 3.4.3" description="July 5, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.4.3: The Fast and the Secure-ious"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.3"
cta="Read the release notes"
>
A month of SSRF and OAuth hardening lands in one patch. NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP validates Host and Origin before session handling to block DNS rebinding, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs.

🛡️ **SSRF allow-list hardening** — every IPv6 transition form (NAT64, 6to4, Teredo, ISATAP) now unwraps to its embedded IPv4 target and gets checked against the same policy.

🌐 **DNS rebinding protection** — Streamable HTTP validates `Host` and browser `Origin` before session handling, closing a path to localhost-bound unauthenticated servers.

🔐 **Stricter OAuth redirects** — unsafe redirect schemes are rejected before registration, and DCR clients are bound to the redirect URIs they registered.

🧵 **Reliability fixes** — proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller fixes across middleware and resource templates.
</Card>
</Update>

<Update label="FastMCP 3.4.2" description="June 6, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.4.2: Heads Up"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.2"
cta="Read the release notes"
>
A compatibility patch. `JWTVerifier` now accepts JWTs carrying private, non-critical JWS header parameters (like Clerk's `cat`) instead of rejecting them before signature and claim validation, while unsupported critical headers are still rejected.
</Card>
</Update>

<Update label="FastMCP 3.4.1" description="June 5, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.4.1: Floor It"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.1"
cta="Read the release notes"
>
A security patch. FastMCP now floors Starlette at `>=1.0.1`, so installs can no longer resolve to a version affected by CVE-2026-48710 — previously the dependency was only constrained transitively through `mcp`. OAuthProxy also logs refresh-token cache misses instead of failing silently.
</Card>
</Update>

<Update label="FastMCP 3.4.0" description="June 2, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.4.0: Remote Control"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.0"
cta="Read the release notes"
>
The remote release. `fastmcp-remote` is a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP, with OAuth enabled automatically for HTTPS. The proxy layer underneath it is hardened so bridges fail loudly on a missing or misconfigured upstream, and FastMCP-issued tokens can now outlive short-lived upstream tokens to survive long idle periods.

🌉 **fastmcp-remote** — `uvx fastmcp-remote https://example.com/mcp` bridges a remote server back to a stdio-only host.

🔌 **Bridges fail loudly** — proxies forward `initialize` upstream, so a missing backend or wrong URL fails the handshake instead of returning an empty-but-connected proxy.

🔐 **Longer-lived tokens** — `fastmcp_access_token_expiry_seconds` decouples the client-facing token lifetime from a short upstream `expires_in`.

⚠️ **Returnable tool errors** — `ToolResult(..., is_error=True)` hands back rich errors the model can act on instead of only raising.
</Card>
</Update>

<Update label="FastMCP 3.3.1" description="May 15, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.3.1: Loop There It Is"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.3.1"
cta="Read the release notes"
>
Hotfix for the 3.3 packaging split: standalone component imports like `from fastmcp.tools import tool` no longer pull in the server stack or trip a circular import. Component-level auth and task primitives moved to lightweight utility modules, with the old import paths preserved as compatibility re-exports.
</Card>
</Update>

<Update label="FastMCP 3.3.0" description="May 15, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.3.0: Slim Reaper"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.3.0"
cta="Read the release notes"
>
The `fastmcp-slim` release. A dependency-light distribution that ships FastMCP's client and transport layer without Starlette, Uvicorn, or the server stack — the import namespace is unchanged. It also closes out a backlog of OAuth proxy hardening, MCP-compliant OTEL instrumentation, and auth additions.

🪶 **fastmcp-slim** — install the client without the server footprint for CI, agents, and library dependencies.

🔐 **OAuth proxy hardening** — silent-consent AS-in-the-middle guard, dot-segment redirect rejection, and per-token response cache partitioning.

🔑 **Auth additions** — `AzureB2CProvider` user flows and a public `update_scopes()` API on `OAuthProxy`.

🧵 **Thread affinity** — `@mcp.tool(run_in_thread=False)` for tools bound to a specific thread.
</Card>
</Update>

<Update label="FastMCP 3.2.4" description="April 14, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.2.4: Patch Me If You Can"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.2.4"
cta="Read the release notes"
>
A grab bag of fixes and hardening. Background tasks are now scoped to the authorization context instead of the MCP session — a breaking change for anyone relying on session-scoped semantics — and parameter descriptions are extracted from docstrings automatically.

🔐 **Security** — `FileUpload` validates decoded base64 size, the proxy stops forwarding inbound headers to unrelated servers, and AuthKit binds token audience per RFC 8707.

🔑 **Keycloak** — new OAuth provider for enterprise auth and local dev.
</Card>
</Update>

<Update label="FastMCP 3.2.3" description="April 9, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.2.3: Redis or Not"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.2.3"
cta="Read the release notes"
>
Pins `fakeredis<2.35.0` in the `tasks` extra: a 2.35.0 rename broke pydocket's `memory://` backend and made `fastmcp[tasks]` installs fail at startup with an `ImportError`.
</Card>
</Update>

<Update label="FastMCP 3.2.2" description="April 9, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.2.2: Audience Appreciation"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.2.2"
cta="Read the release notes"
>
Fixes the Azure audience regression from 3.2.1 — both the bare client ID GUID and a custom `identifier_uri` are now accepted as the token audience.
</Card>
</Update>

<Update label="FastMCP 3.2.1" description="April 8, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.2.1: Audience Participation"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.2.1"
cta="Read the release notes"
>
A patch focused on auth-provider audience validation: Cognito validates on `client_id`, Azure honors `identifier_uri`, and consent cookies are LRU-capped to avoid header overflow. Also fixes OpenAPI 3.0 `nullable` fields leaking into tool input schemas and server-variable substitution in base URLs.
</Card>
</Update>

<Update label="FastMCP 3.2.0" description="March 30, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.2.0: Show Don't Tool"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.2.0"
cta="Read the release notes"
>
The Apps release. Your tools can return interactive UIs — charts, dashboards, forms, maps — rendered right inside the conversation.

🎨 **FastMCPApp** — separate the tools the LLM sees (`@app.ui()`) from the backend tools the UI calls (`@app.tool()`), built on Prefab.

🧩 **Built-in providers** — FileUpload, Approval, Choice, FormInput, and GenerativeUI.

🖥️ **Dev server** — `fastmcp dev apps` previews app tools in the browser with an MCP message inspector.

🔒 **Security pass** — SSRF/path-traversal prevention, JWT algorithm restrictions, OAuth scope enforcement, and CSRF fixes.
</Card>
</Update>

<Update label="FastMCP 3.1.1" description="March 14, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.1.1: 'Tis But a Patch"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.1.1"
cta="Read the release notes"
>
Pins `pydantic-monty<0.0.8` to fix a breaking change in Monty that affects code mode.
</Card>
</Update>

<Update label="FastMCP 3.1.0" description="March 3, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.1.0: Code to Joy"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.1.0"
cta="Read the release notes"
>
The Code Mode release. Instead of loading the entire tool catalog into context, `CodeMode` gives LLMs meta-tools: search for relevant tools on demand, inspect their schemas, then write Python that chains `call_tool()` calls in a sandbox. Also ships search transforms, early Prefab Apps integration, `MultiAuth` for composing multiple token verification sources, and PropelAuth support.
</Card>
</Update>

<Update label="FastMCP 3.0.2" description="February 22, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.0.2: Threecovery Mode II"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.0.2"
cta="Read the release notes"
>
Two community-contributed fixes: auth headers from MCP transport no longer leak through to downstream OpenAPI APIs, and background task workers now correctly receive the originating request ID. Plus a new docs example for context-aware tool factories.
</Card>
</Update>

<Update label="FastMCP 3.0.1" description="February 20, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.0.1: Three-covery Mode"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.0.1"
cta="Read the release notes"
>
First patch after 3.0 — mostly smoothing out rough edges discovered in the wild. The big ones: middleware state that wasn't surviving the trip to tool handlers now does, `Tool.from_tool()` accepts callables again, OpenAPI schemas with circular references no longer crash discovery, and decorator overloads now return the correct types in function mode.

🔐 **OIDC `verify_id_token`** — New option for providers that issue opaque access tokens but standard JWT id_tokens. Verifies identity via the id_token while using the access_token for upstream API calls.

🐞 **11 bug fixes** — State serialization, future annotations with `Context`/`Depends`, OpenAI handler deprecation warnings, type checker compatibility, and more.
</Card>
</Update>

<Update label="FastMCP 3.0.0" description="February 18, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.0.0: Three at Last"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.0.0"
cta="Read the release notes"
img="assets/updates/release-3-0.png"
>
FastMCP 3.0 is stable. Two betas, two release candidates, 21 new contributors, and more than 100,000 pre-release installs later — the architecture held up, the upgrade path was smooth, and we're shipping it.

The surface API is largely unchanged — `@mcp.tool()` still works exactly as before. What changed is everything underneath: a provider/transform architecture that makes FastMCP extensible, observable, and composable in ways v2 couldn't support.

🔌 **Build servers from anything** — `FileSystemProvider`, `OpenAPIProvider`, `ProxyProvider`, `SkillsProvider`, and composable transforms that rename, namespace, filter, version, and secure components as they flow to clients.

🔐 **Ship to production** — Component versioning, granular authorization with async auth checks, CIMD, Static Client Registration, Azure OBO, OpenTelemetry tracing, and background tasks with distributed Redis notification.

💾 **Adapt per session** — Session state persists across requests, and `ctx.enable_components()` / `ctx.disable_components()` let servers adapt dynamically per client.

⚡ **Develop faster** — `--reload`, standalone decorators, automatic threadpool dispatch, tool timeouts, pagination, and concurrent tool execution.

🖥️ **CLI** — `fastmcp list`, `fastmcp call`, `fastmcp discover`, `fastmcp generate-cli`, and `fastmcp install` for Claude Desktop, Cursor, and Goose.
</Card>
</Update>

<Update label="FastMCP 3.0.0rc1" description="February 12, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.0.0rc1: RC-ing is Believing"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.0.0rc1"
cta="Read the release notes"
>
FastMCP 3 RC1 means we believe the API is stable. Beta 2 drew a wave of real-world adoption — production deployments, migration reports, integration testing — and the feedback overwhelmingly confirmed that the architecture works. This release closes gaps that surfaced under load: auth flows that needed to be async, background tasks that needed reliable notification delivery, and APIs still carrying beta-era naming. If nothing unexpected surfaces, this is what 3.0.0 looks like.

🚨 **Breaking Changes** — The `ui=` parameter is now `app=` with a unified `AppConfig` class, and 16 `FastMCP()` constructor kwargs have been removed after months of deprecation warnings.

🔐 **Auth Improvements** — Async `auth=` checks, Static Client Registration for servers without DCR, and declarative Azure OBO flows via dependency injection.

⚡ **Concurrent Sampling** — `context.sample()` can now execute multiple tool calls in parallel with `tool_concurrency=0`.

📡 **Background Task Notifications** — A distributed Redis queue replaces polling for progress updates and elicitation relay.

✅ **OpenAPI Output Validation** — `validate_output=False` disables strict schema checking for imperfect backend APIs.
</Card>
</Update>

<Update label="FastMCP 3.0.0b2" description="February 7, 2026" tags={["Releases"]}>
<Card
title="FastMCP v3.0.0b2: 2 Fast 2 Beta"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.0.0b2"
cta="Read the release notes"
>
Beta 2 reflects the huge number of people that kicked the tires on Beta 1. Seven new contributors landed changes, and early migration reports went smoother than expected. Most of Beta 2 is refinement — fixing what people found, filling gaps from real usage, hardening edges — but a few new features landed along the way.

🖥️ **Client CLI** — `fastmcp list`, `fastmcp call`, `fastmcp discover`, and `fastmcp generate-cli` turn any MCP server into something you can poke at from a terminal.

🔐 **CIMD** (Client ID Metadata Documents) adds an alternative to Dynamic Client Registration for OAuth.

📱 **MCP Apps** — Spec-level compliance for the MCP Apps extension with `ui://` resource scheme and typed UI metadata.

⏳ **Background Task Context** — `Context` now works transparently in Docket workers with Redis-based coordination.

🛡️ **ResponseLimitingMiddleware** caps tool response sizes with UTF-8-safe truncation.

🪿 **Goose Integration** — `fastmcp install goose` for one-command server installation into Goose.
</Card>
</Update>

<Update label="FastMCP 3.0.0b1" description="January 20, 2026" tags={["Releases"]}>
<Card
title="FastMCP 3.0.0b1: This Beta Work"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v3.0.0b1"
cta="Read the release notes"
>
FastMCP 3.0 rebuilds the framework around three primitives: components, providers, and transforms. Providers source components dynamically—from decorators, filesystems, OpenAPI specs, remote servers, or anywhere else. Transforms modify components as they flow to clients. The features that required specialized subsystems in v2 now compose naturally from these building blocks.

🔌 **Provider Architecture** unifies how components are sourced with `FileSystemProvider`, `SkillsProvider`, `OpenAPIProvider`, and `ProxyProvider`.

🔄 **Transforms** add middleware for components—namespace, rename, filter by version, control visibility.

📋 **Component Versioning** lets you register multiple versions of the same tool with automatic highest-version selection.

💾 **Session-Scoped State** persists across requests, with per-session visibility control.

⚡ **DX Improvements** include `--reload` for development, automatic threadpool dispatch, tool timeouts, pagination, and OpenTelemetry tracing.
</Card>
</Update>

<Update label="FastMCP 2.14.7" description="April 13, 2026" tags={["Releases"]}>
<Card
title="FastMCP 2.14.7: Fake It Till You Break It"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.14.7"
cta="Read the release notes"
>
A 2.x backport of the fakeredis pin: fakeredis 2.35.0 renamed a connection class that pydocket's `memory://` backend relied on, crashing `fastmcp[tasks]` installs at startup. Caps `fakeredis<2.35.0` on the 2.x line.
</Card>
</Update>

<Update label="FastMCP 2.14.6" description="March 27, 2026" tags={["Releases"]}>
<Card
title="FastMCP 2.14.6: $Ref Dead Redemption"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.14.6"
cta="Read the release notes"
>
v2.14.4 backported `dereference_refs()` but never wired it into the tool schema pipeline — `$ref` and `$defs` were still sent to MCP clients. Now fixed: schemas are fully inlined before reaching clients.
</Card>
</Update>

<Update label="FastMCP 2.14.5" description="February 3, 2026" tags={["Releases"]}>
<Card
title="FastMCP 2.14.5: Sealed Docket"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.14.5"
cta="Read the release notes"
>
Fixes a memory leak in the memory:// docket broker where cancelled tasks accumulated instead of being cleaned up. Bumps pydocket to ≥0.17.2.
</Card>
</Update>

<Update label="FastMCP 2.14.4" description="January 22, 2026" tags={["Releases"]}>
<Card
title="FastMCP 2.14.4: Package Deal"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.14.4"
cta="Read the release notes"
>
Fixes a fresh install bug where the packaging library was missing as a direct dependency, plus backports $ref dereferencing in tool schemas and a task capabilities location fix.
</Card>
</Update>

<Update label="FastMCP 2.14.3" description="January 12, 2026" tags={["Releases"]}>
<Card
title="FastMCP 2.14.3: Time After Timeout"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.14.3"
cta="Read the release notes"
>
Sometimes five seconds just isn't enough. This release fixes an HTTP transport bug that was cutting connections short, along with OAuth and Redis fixes, better ASGI support, and CLI update notifications so you never miss a beat.

⏱️ **HTTP transport timeout fix** restores MCP's 30-second default connect timeout, which was incorrectly defaulting to 5 seconds.

🔧 **Infrastructure fixes** including OAuth token storage TTL, Redis key prefixing for ACL isolation, and ContextVar propagation for ASGI-mounted servers with background tasks.
</Card>
</Update>

<Update label="FastMCP 2.14.2" description="December 31, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.14.2: Port Authority"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.14.2"
cta="Read the release notes"
>
A wave of community contributions arrives safely in the 2.x line. Important backports from 3.0 improve OpenAPI 3.1 compatibility, MCP spec compliance for output schemas and elicitation, and correct a subtle base_url fallback issue.

🔧 **OpenAPI 3.1 support** fixes version detection to properly handle 3.1 specs alongside 3.0.

📋 **MCP spec compliance** for root-level `$ref` resolution in output schemas and titled enum elicitation schemas.
</Card>
</Update>

<Update label="FastMCP 2.14.1" description="December 15, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.14.1: 'Tis a Gift to Be Sample"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.14.1"
cta="Read the release notes"
>
FastMCP 2.14.1 introduces sampling with tools (SEP-1577), enabling servers to pass tools to `ctx.sample()` for agentic workflows where the LLM can automatically execute tool calls in a loop.

🤖 **Sampling with tools** lets servers leverage client LLM capabilities for multi-step agentic workflows. The new `ctx.sample_step()` method provides single LLM calls with tool inspection, while `result_type` enables structured outputs via validated Pydantic models.

🔧 **AnthropicSamplingHandler** joins the existing OpenAI handler, and both are now promoted from experimental to production-ready status with a unified API.
</Card>
</Update>

<Update label="FastMCP 2.14.0" description="December 11, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.14.0: Task and You Shall Receive"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.14.0"
cta="Read the release notes"
>
FastMCP 2.14 begins adopting the MCP 2025-11-25 specification, introducing protocol-native background tasks that enable long-running operations to report progress without blocking clients.

⏳ **Background Tasks (SEP-1686)** let you add `task=True` to any async tool decorator. Powered by [Docket](https://github.com/chrisguidry/docket) for enterprise task scheduling—in-memory backends work out-of-the-box, Redis enables persistence and horizontal scaling.

🔧 **OpenAPI Parser Promoted** from experimental to standard with improved performance through single-pass schema processing.

📋 **MCP Spec Updates** including SSE polling (SEP-1699), multi-select elicitation (SEP-1330), and tool name validation (SEP-986). Also removes deprecated APIs accumulated across 2.x.
</Card>
</Update>

<Update label="FastMCP 2.13.3" description="December 3, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.13.3: Pin-ish Line"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.13.3"
cta="Read the release notes"
>
Pins `mcp<1.23` as a precaution due to MCP SDK changes related to the 11/25/25 protocol update that break certain FastMCP patches and workarounds. FastMCP 2.14 introduces proper support for the updated protocol.
</Card>
</Update>

<Update label="FastMCP 2.13.2" description="December 1, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.13.2: Refreshing Changes"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.13.2"
cta="Read the release notes"
>
Polishes the authentication stack with improvements to token refresh, scope handling, and multi-instance deployments.

🎮 **Discord OAuth provider** added as a built-in authentication option.

🔄 **Token refresh fixes** for Azure and Google providers, plus OAuth proxy improvements for multi-instance deployments.

🎨 **Icon support** added to proxy classes for richer UX.
</Card>
</Update>

<Update label="FastMCP 2.13.1" description="November 15, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.13.1: Heavy Meta"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.13.1"
cta="Read the release notes"
>
Introduces meta parameter support for `ToolResult`, enabling tools to return supplementary metadata alongside results for patterns like OpenAI's Apps SDK.

🏷️ **Meta parameters** let tools return supplementary metadata alongside results.

🔐 **New auth providers** for OCI and Supabase, plus custom token verifiers with DebugTokenVerifier for development.

🔒 **Security fixes** for CVE-2025-61920 and safer Cursor deeplink URL validation on Windows.
</Card>
</Update>

<Update label="FastMCP 2.13.0" description="October 25, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.13.0: Cache Me If You Can"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.13.0"
cta="Read the release notes"
>
FastMCP 2.13 "Cache Me If You Can" represents a fundamental maturation of the framework. After months of community feedback on authentication and state management, this release delivers the infrastructure FastMCP needs to handle production workloads: persistent storage, response caching, and pragmatic OAuth improvements that reflect real-world deployment challenges.

💾 **Pluggable storage backends** bring persistent state to FastMCP servers. Built on [py-key-value-aio](https://github.com/strawgate/py-key-value), a new library from FastMCP maintainer Bill Easton ([@strawgate](https://github.com/strawgate)), the storage layer provides encrypted disk storage by default, platform-aware token management, and a simple key-value interface for application state. We're excited to bring this elegantly designed library into the FastMCP ecosystem - it's both powerful and remarkably easy to use, including wrappers to add encryption, TTLs, caching, and more to backends ranging from Elasticsearch, Redis, DynamoDB, filesystem, in-memory, and more!

🔐 **OAuth maturity** brings months of production learnings into the framework. The new consent screen prevents confused deputy and authorization bypass attacks discovered in earlier versions, while the OAuth proxy now issues its own tokens with automatic key derivation. RFC 7662 token introspection support enables enterprise auth flows, and path prefix mounting enables OAuth-protected servers to integrate into existing web applications. FastMCP now supports out-of-the-box authentication with [WorkOS](https://gofastmcp.com/integrations/workos) and [AuthKit](https://gofastmcp.com/integrations/authkit), [GitHub](https://gofastmcp.com/integrations/github), [Google](https://gofastmcp.com/integrations/google), [Azure](https://gofastmcp.com/integrations/azure) (Entra ID), [AWS Cognito](https://gofastmcp.com/integrations/aws-cognito), [Auth0](https://gofastmcp.com/integrations/auth0), [Descope](https://gofastmcp.com/integrations/descope), [Scalekit](https://gofastmcp.com/integrations/scalekit), [JWTs](https://gofastmcp.com/servers/auth/token-verification#jwt-token-verification), and [RFC 7662 token introspection](https://gofastmcp.com/servers/auth/token-verification#token-introspection-protocol).

⚡ **Response Caching Middleware** dramatically improves performance for expensive operations, while **Server lifespans** provide proper initialization and cleanup hooks that run once per server instance instead of per client session.

✨ **Developer experience improvements** include Pydantic input validation, icon support, RFC 6570 query parameters for resource templates, improved Context API methods, and async file/directory resources.
</Card>
</Update>

<Update label="FastMCP 2.12.5" description="October 17, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.12.5: Safety Pin"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.12.5"
cta="Read the release notes"
>
Pins MCP SDK version below 1.17 to ensure the `.well-known` payload appears in the expected location when using FastMCP auth providers with composite applications.
</Card>
</Update>

<Update label="FastMCP 2.12.4" description="September 26, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.12.4: OIDC What You Did There"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.12.4"
cta="Read the release notes"
>
FastMCP 2.12.4 adds comprehensive OIDC support and expands authentication options with AWS Cognito and Descope providers. The release also includes improvements to logging middleware, URL handling for nested resources, persistent OAuth client registration storage, and various fixes to the experimental OpenAPI parser.

🔐 **OIDC Configuration** brings native support for OpenID Connect, enabling seamless integration with enterprise identity providers.

🏢 **Enterprise Authentication** expands with AWS Cognito and Descope providers, broadening the authentication ecosystem.

🛠️ **Improved Reliability** through enhanced URL handling, persistent OAuth storage, and numerous parser fixes based on community feedback.
</Card>
</Update>

<Update label="FastMCP 2.12.3" description="September 17, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.12.3: Double Time"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.12.3"
cta="Read the release notes"
>
FastMCP 2.12.3 focuses on performance and developer experience improvements. This release includes optimized auth provider imports that reduce server startup time, enhanced OIDC authentication flows, and automatic inline snapshot creation for testing.
</Card>
</Update>

<Update label="FastMCP 2.12.2" description="September 3, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.12.2: Perchance to Stream"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.12.2"
cta="Read the release notes"
>
Hotfix for streamable-http transport validation in fastmcp.json configuration files, resolving a parsing error when CLI arguments were merged against the configuration spec.
</Card>
</Update>

<Update label="FastMCP 2.12.1" description="September 3, 2025" tags={["Releases"]}>
<Card
title="FastMCP 2.12.1: OAuth to Joy"
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.12.1"
cta="Read the release notes"
>
FastMCP 2.12.1 strengthens OAuth proxy implementation with improved client storage reliability, PKCE forwarding, configurable token endpoint authentication methods, and expanded scope handling based on extensive community testing.
</Card>
</Update>

<Update label="FastMCP 2.12" description="August 31, 2025" tags={["Releases"]}>
<Card 
title="FastMCP 2.12: Auth to the Races" 
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.12.0" 
cta="Read the release notes"  
>
FastMCP 2.12 represents one of our most significant releases to date. After extensive testing and iteration with the community, we're shipping major improvements to authentication, configuration, and MCP feature adoption.

🔐 **OAuth Proxy** bridges the gap for providers that don't support Dynamic Client Registration, enabling authentication with GitHub, Google, WorkOS, and Azure through minimal configuration.

📋 **Declarative JSON Configuration** introduces `fastmcp.json` as the single source of truth for server settings, making MCP servers as portable and shareable as container images.

🧠 **Sampling API Fallback** tackles adoption challenges by letting servers generate completions server-side when clients don't support the feature, encouraging innovation while maintaining compatibility.
</Card>
</Update>

<Update label="FastMCP 2.11" description="August 1, 2025" tags={["Releases"]}>
<Card 
title="FastMCP 2.11: Auth to a Good Start" 
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.11.0" 
cta="Read the release notes"  
>
FastMCP 2.11 brings enterprise-ready authentication and dramatic performance improvements.

🔒 **Comprehensive OAuth 2.1 Support** with WorkOS AuthKit integration, Dynamic Client Registration, and support for separate resource and authorization servers.

⚡ **Experimental OpenAPI Parser** delivers dramatic performance gains through single-pass schema processing and optimized memory usage (enable with environment variable).

💾 **Enhanced State Management** provides persistent state across tool calls with a simple dictionary interface, improving context handling and type annotations.

This release emphasizes speed and simplicity while setting the foundation for future enterprise features.
</Card>
</Update>

<Update label="FastMCP 2.10" description="July 2, 2025" tags={["Releases"]}>
<Card 
title="FastMCP 2.10: Great Spec-tations" 
href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.10.0" 
cta="Read the release notes"  
>
FastMCP 2.10 achieves full compliance with the 6/18/2025 MCP specification update, introducing powerful new communication patterns.

💬 **Elicitation Support** enables dynamic server-client communication and "human-in-the-loop" workflows, allowing servers to request additional information during execution.

📊 **Output Schemas** provide structured outputs for tools, making results more predictable and easier to parse programmatically.

🛠️ **Enhanced HTTP Routing** with OpenAPI extensions support and configurable algorithms for more flexible API integration.

This release includes a breaking change to `client.call_tool()` return signatures but significantly expands the interaction capabilities of MCP servers.
</Card>
</Update>

<Update label="FastMCP 2.9" description="June 23, 2025" tags={["Releases", "Blog Posts"]}>
<Card 
title="FastMCP 2.9: MCP-Native Middleware" href="https://www.jlowin.dev/blog/fastmcp-2-9-middleware" 
img="https://jlowin.dev/_image?href=%2F_astro%2Fhero.BkVTdeBk.jpg&w=1200&h=630&f=png" 
cta="Read more"  
>
FastMCP 2.9 is a major release that, among other things, introduces two important features that push beyond the basic MCP protocol. 

🤝 *MCP Middleware* brings a flexible middleware system for intercepting and controlling server operations - think authentication, logging, rate limiting, and custom business logic without touching core protocol code. 

✨ *Server-side type conversion* for prompts solves a major developer pain point: while MCP requires string arguments, your functions can now work with native Python types like lists and dictionaries, with automatic conversion handling the complexity.

These features transform FastMCP from a simple protocol implementation into a powerful framework for building sophisticated MCP applications. Combined with the new `File` utility for binary data and improvements to authentication and serialization, this release makes FastMCP significantly more flexible and developer-friendly while maintaining full protocol compliance.
</Card>
</Update>

<Update label="FastMCP 2.8" description="June 11, 2025" tags={["Releases", "Blog Posts"]}>
<Card 
title="FastMCP 2.8: Transform and Roll Out" href="https://www.jlowin.dev/blog/fastmcp-2-8-tool-transformation" 
img="https://www.jlowin.dev/_image?href=%2F_astro%2Fhero.su3kspkP.png&w=1000&h=500&f=webp" 
cta="Read more"  
>
FastMCP 2.8 is here, and it's all about taking control of your tools.

This release is packed with new features for curating the perfect LLM experience:

🛠️ Tool Transformation

The headline feature lets you wrap any tool—from your own code, a third-party library, or an OpenAPI spec—to create an enhanced, LLM-friendly version. You can rename arguments, rewrite descriptions, and hide parameters without touching the original code.

This feature was developed in close partnership with Bill Easton. As Bill brilliantly [put it](https://www.linkedin.com/posts/williamseaston_huge-thanks-to-william-easton-for-providing-activity-7338011349525983232-Mw6T?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAAd6d0B3uL9zpCsq9eYWKi3HIvb8eN_r_Q), "Tool transformation flips Prompt Engineering on its head: stop writing tool-friendly LLM prompts and start providing LLM-friendly tools."

🏷️ Component Control

Now that you're transforming tools, you need a way to hide the old ones! In FastMCP 2.8 you can programmatically enable/disable any component, and for everyone who's been asking what FastMCP's tags are for—they finally have a purpose! You can now use tags to declaratively filter which components are exposed to your clients.

🚀 Pragmatic by Default

Lastly, to ensure maximum compatibility with the ecosystem, we've made the pragmatic decision to default all OpenAPI routes to Tools, making your entire API immediately accessible to any tool-using agent. When the industry catches up and supports resources, we'll restore the old default -- but no reason you should do extra work before OpenAI, Anthropic, or Google!

</Card>
</Update>

<Update label="FastMCP 2.7" description="June 6, 2025" tags={["Releases"]}>
<Card 
title="FastMCP 2.7: Pare Programming" href="https://github.com/PrefectHQ/fastmcp/releases/tag/v2.7.0" 
img="assets/updates/release-2-7.png" 
cta="Read the release notes"  
>
FastMCP 2.7 has been released!

Most notably, it introduces the highly requested (and Pythonic) "naked" decorator usage:

```python {3}
mcp = FastMCP()

@mcp.tool
def add(a: int, b: int) -> int:
    return a + b
```

In addition, decorators now return the objects they create, instead of the decorated function. This is an important usability enhancement.

The bulk of the update is focused on improving the FastMCP internals, including a few breaking internal changes to private APIs. A number of functions that have clung on since 1.0 are now deprecated.
</Card>
</Update>



<Update label="FastMCP 2.6" description="June 2, 2025" tags={["Releases", "Blog Posts"]}>
<Card 
title="FastMCP 2.6: Blast Auth" href="https://www.jlowin.dev/blog/fastmcp-2-6" 
img="https://www.jlowin.dev/_image?href=%2F_astro%2Fhero.Bsu8afiw.png&w=1000&h=500&f=webp" 
cta="Read more"  
>
FastMCP 2.6 is here!

This release introduces first-class authentication for MCP servers and clients, including pragmatic Bearer token support and seamless OAuth 2.1 integration. This release aligns with how major AI platforms are adopting MCP today, making it easier than ever to securely connect your tools to real-world AI models. Dive into the update and secure your stack with minimal friction.
</Card>
</Update>

<Update description="May 21, 2025" label="Vibe-Testing" tags={["Blog Posts", "Tutorials"]}>
<Card
title="Stop Vibe-Testing Your MCP Server"
href="https://www.jlowin.dev/blog/stop-vibe-testing-mcp-servers"
img="https://www.jlowin.dev/_image?href=%2F_astro%2Fhero.BUPy9I9c.png&w=1000&h=500&f=webp"
cta="Read more"
>

Your tests are bad and you should feel bad.

Stop vibe-testing your MCP server through LLM guesswork. FastMCP 2.0 introduces in-memory testing for fast, deterministic, and fully Pythonic validation of your MCP logic—no network, no subprocesses, no vibes.

</Card>
</Update>


<Update description="May 8, 2025" label="10,000 Stars" tags={["Blog Posts"]}>
<Card
title="Reflecting on FastMCP at 10k stars 🌟"
href="https://www.jlowin.dev/blog/fastmcp-2-10k-stars"
img="https://www.jlowin.dev/_image?href=%2F_astro%2Fhero.Cnvci9Q_.png&w=1000&h=500&f=webp"
cta="Read more"
>

In just six weeks since its relaunch, FastMCP has surpassed 10,000 GitHub stars—becoming the fastest-growing OSS project in our orbit. What started as a personal itch has become the backbone of Python-based MCP servers, powering a rapidly expanding ecosystem. While the protocol itself evolves, FastMCP continues to lead with clarity, developer experience, and opinionated tooling. Here’s to what’s next.

</Card>
</Update>

<Update description="May 8, 2025" label="FastMCP 2.3" tags={["Blog Posts", "Releases"]}>
<Card
title="Now Streaming: FastMCP 2.3"
href="https://www.jlowin.dev/blog/fastmcp-2-3-streamable-http"
img="https://www.jlowin.dev/_image?href=%2F_astro%2Fhero.M_hv6gEB.png&w=1000&h=500&f=webp"
cta="Read more"
>

FastMCP 2.3 introduces full support for Streamable HTTP, a modern alternative to SSE that simplifies MCP deployments over the web. It’s efficient, reliable, and now the default HTTP transport. Just run your server with transport="http" and connect clients via a standard URL—FastMCP handles the rest. No special setup required. This release makes deploying MCP servers easier and more portable than ever.

</Card>
</Update>

<Update description="April 23, 2025" label="Proxy Servers" tags={["Blog Posts", "Tutorials"]}>
<Card
title="MCP Proxy Servers with FastMCP 2.0"
href="https://www.jlowin.dev/blog/fastmcp-proxy"
img="https://www.jlowin.dev/_image?href=%2F_astro%2Frobot-hero.DpmAqgui.png&w=1000&h=500&f=webp"
cta="Read more"
>

Even AI needs a good travel adapter 🔌


FastMCP now supports proxying arbitrary MCP servers, letting you run a local FastMCP instance that transparently forwards requests to any remote or third-party server—regardless of transport. This enables transport bridging (e.g., stdio ⇄ SSE), simplified client configuration, and powerful gateway patterns. Proxies are fully composable with other FastMCP servers, letting you mount or import them just like local servers. Use `FastMCP.from_client()` to wrap any backend in a clean, Pythonic proxy.
</Card>
</Update>

<Update label="FastMCP 2.0" description="April 16, 2025" tags={["Releases", "Blog Posts"]}>
<Card
title="Introducing FastMCP 2.0 🚀"
href="https://www.jlowin.dev/blog/fastmcp-2"
img="https://www.jlowin.dev/_image?href=%2F_astro%2Fhero.DpbmGNrr.png&w=1000&h=500&f=webp"
cta="Read more"
>

This major release reimagines FastMCP as a full ecosystem platform, with powerful new features for composition, integration, and client interaction. You can now compose local and remote servers, proxy arbitrary MCP servers (with transport translation), and generate MCP servers from OpenAPI or FastAPI apps. A new client infrastructure supports advanced workflows like LLM sampling. 

FastMCP 2.0 builds on the success of v1 with a cleaner, more flexible foundation—try it out today!
</Card>
</Update>



<Update label="Official SDK" description="December 3, 2024" tags={["Announcements"]}>
<Card
title="FastMCP is joining the official MCP Python SDK!"
href="https://bsky.app/profile/jlowin.dev/post/3lch4xk5cf22c"
icon="sparkles"
cta="Read the announcement"
>
FastMCP 1.0 will become part of the official MCP Python SDK!
</Card>
</Update>



<Update label="FastMCP 1.0" description="December 1, 2024" tags={["Releases", "Blog Posts"]}>
<Card
title="Introducing FastMCP 🚀"
href="https://www.jlowin.dev/blog/introducing-fastmcp"
img="https://www.jlowin.dev/_image?href=%2F_astro%2Ffastmcp.Bep7YlTw.png&w=1000&h=500&f=webp"
cta="Read more"
>
Because life's too short for boilerplate.

This is where it all started. FastMCP’s launch post introduced a clean, Pythonic way to build MCP servers without the protocol overhead. Just write functions; FastMCP handles the rest. What began as a weekend project quickly became the foundation of a growing ecosystem.
</Card>
</Update>
