- Python 100%
08d4059f19* Scope tasks to authorization context, not session Tasks were keyed by the transport-layer Mcp-Session-Id, which is server-assigned and changes on reconnect — so clients lost access to their running tasks after any connection interruption. The MCP spec says tasks should be bound to authorization context, not session. This replaces session_id with task_scope (derived from AccessToken.client_id, URL-encoded) in all task data Redis keys and Docket task keys. When no auth is configured, a "_" sentinel is used and security comes from UUID task ID entropy per the spec. Session ID is still used for transport-level concerns (notification queues, subscriber registration) and is now stored in the TaskContextSnapshot payload so background workers can still deliver notifications. Also extracts all the task context infrastructure (TaskContextInfo, TaskContextSnapshot, snapshot loading, session/server registries) from server/dependencies.py into a new server/tasks/context.py to keep the DI module from sprawling further. Closes #3758 🤖 Generated with Claude Code Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Rename _redis_key to _snapshot_redis_key Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Document in-process session registry as an optimization Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Tidy imports and docstrings Hoist imports where safe, keep subscriptions/notifications deferred in handlers.py since they pull in docket at module level. Sharpen docstrings on keys.py and context.py so each module owns its lane. Clean up the re-export block in dependencies.py. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix misleading comment on re-export block Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Tighten task scope: include sub claim, partition keyspaces Addresses review feedback on #3800: - Compose task scope from client_id and the JWT sub claim (when present) so fixed-OAuth deployments isolate per user, not just per client. - Replace the "_" anonymous sentinel with a tagged keyspace partition. Docket keys are now auth:{enc_scope}:... or anon:..., and Redis keys use fastmcp:task:auth:{enc_scope}:... or fastmcp:task:anon:..., routed through a single task_redis_prefix() helper. - get_task_scope() returns the raw scope (or None); encoding happens once at the keys.py boundary, collapsing the previous double-quote invariant. - Drop the dormant fallback in notifications.py that routed input_required relays into the anon keyspace when task_scope was missing -- log and skip instead. - Add comprehensive parser/encoder tests in test_task_keys.py covering round-trips, malformed keys, and adversarial scopes ("anon", "_", and scopes containing : / | %). - Add cross-scope rejection tests: distinct client_ids, distinct sub claims under a shared client_id, and authenticated vs anonymous. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .claude | ||
| .cursor/rules | ||
| .github | ||
| docs | ||
| examples | ||
| scripts | ||
| skills/fastmcp-client-cli | ||
| src/fastmcp | ||
| tests | ||
| v3-notes | ||
| .ccignore | ||
| .coderabbit.yaml | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| .python-version | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| justfile | ||
| LICENSE | ||
| logo.py | ||
| loq.toml | ||
| pyproject.toml | ||
| README.md | ||
| SECURITY.md | ||
| uv.lock | ||
The Model Context Protocol (MCP) connects LLMs to tools and data. FastMCP gives you everything you need to go from prototype to production:
from fastmcp import FastMCP
mcp = FastMCP("Demo 🚀")
@mcp.tool
def add(a: int, b: int) -> int:
"""Add two numbers"""
return a + b
if __name__ == "__main__":
mcp.run()
Why FastMCP
Building an effective MCP application is harder than it looks. FastMCP handles all of it. Declare a tool with a Python function, and the schema, validation, and documentation are generated automatically. Connect to a server with a URL, and transport negotiation, authentication, and protocol lifecycle are managed for you. You focus on your logic, and the MCP part just works: with FastMCP, best practices are built in.
That's why FastMCP is the standard framework for working with MCP. FastMCP 1.0 was incorporated into the official MCP Python SDK in 2024. Today, the actively maintained standalone project is downloaded a million times a day, and some version of FastMCP powers 70% of MCP servers across all languages.
FastMCP has three pillars:
Servers Expose tools, resources, and prompts to LLMs. |
Apps Give your tools interactive UIs rendered directly in the conversation. |
Clients Connect to any MCP server — local or remote, programmatic or CLI. |
Servers wrap your Python functions into MCP-compliant tools, resources, and prompts. Clients connect to any server with full protocol support. And Apps give your tools interactive UIs rendered directly in the conversation.
Ready to build? Start with the installation guide or jump straight to the quickstart. When you're ready to deploy, Prefect Horizon offers free hosting for FastMCP users.
Installation
We recommend installing FastMCP with uv:
uv pip install fastmcp
For full installation instructions, including verification and upgrading, see the Installation Guide.
Upgrading? We have guides for:
📚 Documentation
FastMCP's complete documentation is available at gofastmcp.com, including detailed guides, API references, and advanced patterns.
Documentation is also available in llms.txt format, which is a simple markdown standard that LLMs can consume easily:
llms.txtis essentially a sitemap, listing all the pages in the documentation.llms-full.txtcontains the entire documentation. Note this may exceed the context window of your LLM.
Community: Join our Discord server to connect with other FastMCP developers and share what you're building.
Contributing
We welcome contributions! See the Contributing Guide for setup instructions, testing requirements, and PR guidelines.