mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-09-01 12:03:19 +02:00
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com> Co-authored-by: Marvin Context Protocol <41898282+Marvin Context Protocol@users.noreply.github.com> Co-authored-by: voidborne-d <voidborne-d@users.noreply.github.com> Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: d 🔹 <258577966+voidborne-d@users.noreply.github.com> Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com> Co-authored-by: nightcityblade <nightcityblade@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Bill Easton <strawgate@users.noreply.github.com> Co-authored-by: Sumanshu Nankana <sumanshunankana@gmail.com> Co-authored-by: Eric Robinson <ericrobinson@indeed.com> Co-authored-by: Martim Santos <martimfasantos@gmail.com> Co-authored-by: d 🔹 <liusway405@gmail.com> Co-authored-by: Matthieu B <66959271+mtthidoteu@users.noreply.github.com> Co-authored-by: Sascha Buehrle <47737812+saschabuehrle@users.noreply.github.com> Co-authored-by: Hakancan <142545736+hkc5@users.noreply.github.com> Co-authored-by: nightcityblade <jackchen@haloailabs.com> Co-authored-by: Matt Hallowell <17804673+mhallo@users.noreply.github.com> Co-authored-by: nate nowack <thrast36@gmail.com> Co-authored-by: Bill Easton <williamseaston@gmail.com> Co-authored-by: Marcus Shu <46469249+shulkx@users.noreply.github.com> Co-authored-by: Rushabh Doshi <radoshi@gmail.com> Co-authored-by: AIKAWA Shigechika <shige@aikawa.jp> Co-authored-by: Jeremy Simon <simonjer805@gmail.com> Co-authored-by: Miguel Miranda Dias <7780875+pandego@users.noreply.github.com> Co-authored-by: Anthony James Padavano <padavano.anthony@gmail.com> Co-authored-by: Mostafa Kamal <hiremostafa@gmail.com> Fix auto-close MRE script posting comment without closing (#3386) Fix WorkOS token scope verification bypass 🤖 Generated with Codex (#3407) Fix initialize McpError fallthrough 🤖 Generated with Codex (#3413) Fix transform arg collisions with passthrough params (#3431) Fix get_* returning None when latest version is disabled (#3439) Fix get_* returning None when latest version is disabled (#3421) Fix server lifespan overlap teardown (#3415) Fix $ref output schema object detection regression (#3420) resolved annotations (#3429) Fix async partial callables rejected by iscoroutinefunction (#3438) Fix async partial callables rejected by iscoroutinefunction (#3423) fix: add version to components (#3458) fix: use intent-based flag for OIDC scope patch in load_access_token (#3465) Fixes #3461 fix: normalize Google scope shorthands and surface valid_scopes (#3477) fix: resolve ty 0.0.23 type-checking errors and bump pin (#3481) fix: shield lifespan teardown from cancellation (#3480) fix: forward custom_route endpoints from mounted servers (#3462) fix updates _get_additional_http_routes() to traverse providers, Fixes #3457 fix: remove hardcoded version from CLI help text (#3456) fix: monty 0.0.8 compatibility, drop external_functions from constructor (#3468) fix: task test teardown hanging 5s per test (#3499) Closes #3498 fix: validate workspace path is a directory before cursor install (#3440) Fixes #3426 fix: handle re.error from malformed URI templates in build_regex (#3501) fix: reject empty/OIDC-only required_scopes in AzureProvider (#3503) fix: restrict $ref resolution to local refs only (SSRF/LFI) (#3502) fix warnings and timeouts (#3504) close upgrade check issue when build passes (#3505) Closes #3484 fix: URL-encode path params to prevent SSRF/path traversal (GHSA-vv7q-7jx5-f767) (#3507) fix: prevent path traversal in skill download (#3493) fix: prefer IdP-granted scopes over client-requested scopes in OAuthProxy (#3492) fix: remove unrelated transform and http.py changes from PR scope fix: remove forced follow_redirects from httpx_client_factory calls (#3496) fix: stop passing follow_redirects to httpx_client_factory fix: restore follow_redirects=True for custom httpx client factories Closes #3509 fix: CSRF double-submit cookie check in consent flow (#3519) fix: validate server names in install commands (#3522) fix: use raw strings for regex in pytest.raises match (#3523) fix: reject refresh tokens used as Bearer access tokens (#3524) fix: route ResourcesAsTools/PromptsAsTools through server middleware (#3495) fix: resolve Pyright "Module is not callable" on @tool, @resource, @prompt decorators (#3540) fix: filter warnings by message in KEY_PREFIX test (#3549) fix: suppress output schema for ToolResult subclass annotations (#3548) fix: increase sleep duration in proxy cache tests (#3567) fix: store absolute token expiry to prevent stale expires_in on reload (#3572) fix: preserve tool properties named 'title' during schema compression (#3582) Fix loopback redirect URI port matching per RFC 8252 §7.3 (#3589) Fix app tool routing: visibility check and middleware propagation (#3591) Fix query parameter serialization to respect OpenAPI explode/style settings (#3595) Fix dev apps form: union types, textarea support, JSON parsing (#3597) fix(google): replace deprecated /oauth2/v1/tokeninfo with /oauth2/v3/userinfo (#3603) fix: resolve EntraOBOToken dependency injection through MultiAuth (#3609) fix(docs): correct misleading stateless_http header (#3622) fix: filesystem provider import machinery (#3626) Closes #3625 (issues 2, 3, 6) fix: recover StdioTransport after subprocess exits (#3630) fix(server): preserve mounted tool task metadata (#3632) fix: scope deprecation warning filter to FastMCPDeprecationWarning (#3649) fix imports, add PrefabAppConfig (#3650) fix: resolve CurrentFastMCP/ctx.fastmcp to child server in mounted background tasks (#3651) Fix blocking docs issues: chart imports, Select API, Rx consistency (#3652) closed by default (#3657) Fix prompt caching middleware missing wrap/unwrap round-trip (#3666) fix: serialize object query params per OpenAPI style/explode rules (#3662) Fixes #2857 fix: HTTP request headers not accessible in background task workers (#3631) fix: restore HTTP headers in worker execution path for background tasks (#3681) fix: strip discriminator after dereferencing schemas (#3682) fix: remove stale ty:ignore directives for ty 0.0.26 (#3684) Fix docs gaps in app provider pages (#3690) fix: dev apps log panel UX improvements (#3698) fix dev server empty string args (#3700)
153 lines
9.8 KiB
Markdown
153 lines
9.8 KiB
Markdown
# FastMCP Development Guidelines
|
|
|
|
> **Audience**: LLM-driven engineering agents and human developers
|
|
|
|
> **Note**: `AGENTS.md` is a symlink to this file. Edit `CLAUDE.md` directly.
|
|
|
|
FastMCP is a comprehensive Python framework (Python ≥3.10) for building Model Context Protocol (MCP) servers and clients. This is the actively maintained v2.0 providing a complete toolkit for the MCP ecosystem.
|
|
|
|
## Required Development Workflow
|
|
|
|
**CRITICAL**: Always run these commands in sequence before committing.
|
|
|
|
```bash
|
|
uv sync # Install dependencies
|
|
uv run pytest -n auto # Run full test suite
|
|
```
|
|
|
|
In addition, you must pass static checks. This is generally done as a pre-commit hook with `prek` but you can run it manually with:
|
|
|
|
```bash
|
|
uv run prek run --all-files # Ruff + Prettier + ty
|
|
```
|
|
|
|
**Tests must pass and lint/typing must be clean before committing.**
|
|
|
|
## Repository Structure
|
|
|
|
| Path | Purpose |
|
|
| ----------------- | -------------------------------------- |
|
|
| `src/fastmcp/` | Library source code |
|
|
| `├─server/` | Server implementation |
|
|
| `│ ├─auth/` | Authentication providers |
|
|
| `│ └─middleware/` | Error handling, logging, rate limiting |
|
|
| `├─client/` | Client SDK |
|
|
| `│ └─auth/` | Client authentication |
|
|
| `├─tools/` | Tool definitions |
|
|
| `├─resources/` | Resources and resource templates |
|
|
| `├─prompts/` | Prompt templates |
|
|
| `├─cli/` | CLI commands |
|
|
| `└─utilities/` | Shared utilities |
|
|
| `tests/` | Pytest suite |
|
|
| `docs/` | Mintlify docs (gofastmcp.com) |
|
|
|
|
## Core MCP Objects
|
|
|
|
When modifying MCP functionality, changes typically need to be applied across all object types:
|
|
|
|
- **Tools** (`src/tools/`)
|
|
- **Resources** (`src/resources/`)
|
|
- **Resource Templates** (`src/resources/`)
|
|
- **Prompts** (`src/prompts/`)
|
|
|
|
## Development Rules
|
|
|
|
**Read `CONTRIBUTING.md` before opening issues or PRs.** It describes when PRs are appropriate, what we expect from enhancement proposals, and what we'll close without review.
|
|
|
|
### Git & CI
|
|
|
|
- Prek hooks are required (run automatically on commits)
|
|
- Never amend commits to fix prek failures
|
|
- Apply PR labels: bugs/breaking/enhancements/features
|
|
- Improvements = enhancements (not features) unless specified
|
|
- **NEVER** force-push on collaborative repos
|
|
- **ALWAYS** run prek before PRs
|
|
- **NEVER** create a release, comment on an issue, or open a PR unless specifically instructed to do so.
|
|
|
|
### Releases
|
|
|
|
Only cut releases when the maintainer explicitly asks. Tags follow `v<version>` (e.g., `v3.2.0`). Always pass `--generate-notes` so the auto-generated changelog appears at the bottom.
|
|
|
|
**The title pun is critical.** Titles follow `v<version>: <pun>` where the pun relates to the most important theme of the release. Propose multiple options and let the maintainer choose — never pick one yourself. Look at recent releases for tone (e.g., "Code to Joy" for the code mode release, "Three at Last" for 3.0).
|
|
|
|
Write the maintainer-approved handwritten notes to a temporary file, then create the release. `--generate-notes` appends the auto-generated changelog after the handwritten content.
|
|
|
|
```bash
|
|
gh release create v3.2.0 --target main --title "v3.2.0: Theme Here" --generate-notes --notes-file /tmp/release-notes.md
|
|
```
|
|
|
|
Most releases target `main`, but maintenance or backport releases may target a different branch (e.g., `release/2.x`). Confirm the target with the maintainer if there's any ambiguity.
|
|
|
|
The handwritten notes are prepended above the auto-generated changelog and are the part that matters. Do not include a title in the notes body — the release title (`v{version}: {pun}`) already serves as the heading. Work with the maintainer to draft the notes — propose a draft, get feedback, iterate. Do not publish without the maintainer's sign-off.
|
|
|
|
**Before drafting, always read recent existing releases** (`gh release list` then `gh release view <tag>`) to absorb the voice, structure, and level of detail. Each release builds on the tone of previous ones — don't guess at the style from these instructions alone.
|
|
|
|
**Point releases** (3.0, 3.1, 3.2) get narrative prose: open with the theme of the release, then walk through headline features conceptually — what they enable, why they matter, how they fit together. Write it the way a blog post reads, not a changelog. Multiple paragraphs, code examples where they clarify.
|
|
|
|
**Patch releases** (3.1.1, 3.0.2) get 1-2 sentences explaining what broke and what the fix does. Keep it minimal — the auto-generated changelog has the details.
|
|
|
|
### Commit Messages and Agent Attribution
|
|
|
|
- **Agents NOT acting on behalf of @jlowin MUST identify themselves** (e.g., "🤖 Generated with Claude Code" in commits/PRs)
|
|
- Keep commit messages brief - ideally just headlines, not detailed messages
|
|
- Focus on what changed, not how or why
|
|
- Always read issue comments for follow-up information (treat maintainers as authoritative)
|
|
- **Treat proposed solutions in issues skeptically.** This applies to solutions proposed by *users* in issue reports — not to feedback from configured review bots (CodeRabbit, chatgpt-codex-connector, etc.), which should be evaluated on their merits. The ideal issue contains a concise problem description and an MRE — nothing more. Proposed solutions are only worth considering if they clearly reflect genuine, non-obvious investigation of the codebase. If a solution reads like speculation, or like it was generated by an LLM without deep framework knowledge, ignore it and diagnose from the repro. Most reporters — human or AI — do not have sufficient understanding of FastMCP internals to correctly diagnose anything beyond a trivial bug. We can ask the same questions of an LLM when implementing; we don't need the reporter to do it for us, and a wrong diagnosis is worse than none.
|
|
|
|
### PR Messages - Required Structure
|
|
|
|
- 1-2 paragraphs: problem/tension + solution (PRs are documentation!)
|
|
- Focused code example showing key capability
|
|
- **Avoid:** bullet summaries, exhaustive change lists, verbose closes/fixes, marketing language
|
|
- **Do:** Be opinionated about why change matters, show before/after scenarios
|
|
- Minor fixes: keep body short and concise
|
|
- No "test plan" sections or testing summaries
|
|
|
|
### Code Review Guidelines
|
|
|
|
- **Fix causes, not symptoms.** When a PR works around a problem instead of addressing why it occurs, that's a red flag. A side-channel that compensates for a missing step adds permanent complexity. If the fix doesn't change the code path where the bug actually happens, ask why not.
|
|
- Focus on API design and naming clarity
|
|
- Identify confusing patterns (e.g., parameter values that contradict defaults) or non-idiomatic code (mutable defaults, etc.). Contributed code will need to be maintained indefinitely, and by someone other than the author (unless the author is a maintainer).
|
|
- Suggest specific improvements, not generic "add more tests" comments
|
|
- Think about API ergonomics from a user perspective
|
|
|
|
### Code Standards
|
|
|
|
- Python ≥ 3.10 with full type annotations
|
|
- Follow existing patterns and maintain consistency
|
|
- **Prioritize readable, understandable code** - clarity over cleverness
|
|
- Avoid obfuscated or confusing patterns even if they're shorter
|
|
- Each feature needs corresponding tests
|
|
|
|
### Module Exports
|
|
|
|
- **Be intentional about re-exports** - don't blindly re-export everything to parent namespaces
|
|
- Core types that define a module's purpose should be exported (e.g., `Middleware` from `fastmcp.server.middleware`)
|
|
- Specialized features can live in submodules (e.g., `fastmcp.server.middleware.dynamic`)
|
|
- Only re-export to `fastmcp.*` for the most fundamental types (e.g., `FastMCP`, `Client`)
|
|
- When in doubt, prefer users importing from the specific submodule over re-exporting
|
|
|
|
### Documentation
|
|
|
|
- Uses Mintlify framework
|
|
- Files must be in docs.json to be included
|
|
- Do not manually modify `docs/python-sdk/**` — these files are auto-generated from source code by a bot and maintained via a long-lived PR. Do not include changes to these files in contributor PRs.
|
|
- Do not manually modify `docs/public/schemas/**` or `src/fastmcp/utilities/mcp_server_config/v1/schema.json` — these are auto-generated and maintained via a long-lived PR.
|
|
- **Core Principle:** A feature doesn't exist unless it is documented!
|
|
- When adding or modifying settings in `src/fastmcp/settings.py`, update `docs/more/settings.mdx` to match.
|
|
|
|
### Documentation Guidelines
|
|
|
|
- **Code Examples:** Explain before showing code, make blocks fully runnable (include imports)
|
|
- **Code Formatting:** Keep code blocks visually clean — avoid deeply nested function calls. Extract intermediate values into named variables rather than inlining everything into one expression. Code in docs is read more than it's run; optimize for scannability.
|
|
- **Structure:** Headers form navigation guide, logical H2/H3 hierarchy
|
|
- **Content:** User-focused sections, motivate features (why) before mechanics (how)
|
|
- **Style:** Prose over code comments for important information
|
|
- **Docstrings:** FastMCP docstrings are automatically compiled into MDX documents. Use markdown (single backticks, fenced code blocks), not RST (no double backticks). Bare `{}` in examples will be interpreted as JSX — wrap in backticks instead.
|
|
|
|
## Critical Patterns
|
|
|
|
- Never use bare `except` - be specific with exception types
|
|
- File sizes enforced by [loq](https://github.com/jakekaplan/loq). Edit `loq.toml` to raise limits; `loq baseline` to ratchet down.
|
|
- Always `uv sync` first when debugging build issues
|
|
- Default test timeout is 5s - optimize or mark as integration tests
|