- Python 100%
2899ffb6f3* Add FASTMCP_SSRF_TRUST_PROXY to allow SSRF fetches through a corporate proxy 🤖 Generated with Claude Code * Make SSRF fetch client trust_env explicit for proxy routing 🤖 Generated with Claude Code * Warn when SSRF proxy trust is enabled without a configured proxy 🤖 Generated with Claude Code * Warn when NO_PROXY would send an SSRF-trust-proxy fetch direct 🤖 Generated with Claude Code * Refuse SSRF-trust-proxy fetches when no proxy would route the target 🤖 Generated with Claude Code * Fix TestProxyMode mocks to patch httpx2.AsyncClient main's httpx -> httpx2 migration (#4503) landed after these tests were written; ssrf.py's fetch path already uses httpx2.AsyncClient, but TestProxyMode still patched the old httpx module, so the mock silently stopped intercepting and requests escaped to the real network. * Fix port-qualified NO_PROXY bypass in SSRF proxy-trust guard proxy_bypass(hostname) discarded the port, so a NO_PROXY entry like 127.0.0.1:8443 went undetected while httpx2 honored it and sent the request direct with the blocklist already disabled. Pass host:port instead, except for IPv6 literals, where httpx2 ignores port when matching NO_PROXY and neither bracketed nor unbracketed host:port reliably matches through proxy_bypass()'s own parser. * Replace NO_PROXY prediction with explicit proxy control in SSRF trust-proxy mode Predicting httpx2's proxy routing (via proxy_bypass(), then via httpx2's own get_environment_proxies()/URLPattern internals) kept diverging from its real NO_PROXY handling — three rounds, three different divergences, always in the unsafe direction. Read HTTPS_PROXY/ALL_PROXY directly and pass it to httpx2 explicitly with trust_env=False, so the request provably goes through that proxy instead of being predicted to. NO_PROXY is no longer evaluated in this mode: a NO_PROXY'd host is now routed through the proxy rather than refused, since that's strictly safer than the alternative (direct with the blocklist already off). --------- Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com> |
||
|---|---|---|
| .claude | ||
| .cursor/rules | ||
| .github | ||
| docs | ||
| examples | ||
| fastmcp_remote | ||
| fastmcp_slim | ||
| scripts | ||
| skills/fastmcp-client-cli | ||
| tests | ||
| v3-notes | ||
| .ccignore | ||
| .coderabbit.yaml | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| .python-version | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| justfile | ||
| LICENSE | ||
| logo.py | ||
| loq.toml | ||
| pyproject.toml | ||
| README.md | ||
| SECURITY.md | ||
| uv.lock | ||
The Model Context Protocol (MCP) connects LLMs to tools and data. FastMCP gives you everything you need to go from prototype to production:
from fastmcp import FastMCP
mcp = FastMCP("Demo 🚀")
@mcp.tool
def add(a: int, b: int) -> int:
"""Add two numbers"""
return a + b
if __name__ == "__main__":
mcp.run()
Why FastMCP
Building an effective MCP application is harder than it looks. FastMCP handles all of it. Declare a tool with a Python function, and the schema, validation, and documentation are generated automatically. Connect to a server with a URL, and transport negotiation, authentication, and protocol lifecycle are managed for you. You focus on your logic, and the MCP part just works: with FastMCP, best practices are built in.
That's why FastMCP is the standard framework for working with MCP. FastMCP 1.0 was incorporated into the official MCP Python SDK in 2024. Today, the actively maintained standalone project is downloaded a million times a day, and some version of FastMCP powers 70% of MCP servers across all languages.
FastMCP has three pillars:
Servers Expose tools, resources, and prompts to LLMs. |
Apps Give your tools interactive UIs rendered directly in the conversation. |
Clients Connect to any MCP server — local or remote, programmatic or CLI. |
Servers wrap your Python functions into MCP-compliant tools, resources, and prompts. Clients connect to any server with full protocol support. And Apps give your tools interactive UIs rendered directly in the conversation.
Ready to build? Start with the installation guide or jump straight to the quickstart.
Run FastMCP in production with Horizon
FastMCP is the standard way to build MCP servers. Prefect Horizon is the enterprise MCP gateway for running them safely.
Built by the FastMCP team, Horizon packages the best practices we've learned shipping the world's most popular MCP framework.
Deploy FastMCP servers from GitHub with branch previews and instant rollback. Create a private registry of every MCP your company uses. Secure access with SSO and tool-level RBAC. Get audit logs, observability, and governance across your MCP stack. Remix approved tools into purpose-built endpoints for teams and agents.
Start with FastMCP. Scale with Horizon →
Installation
We recommend installing FastMCP with uv:
uv pip install fastmcp
For full installation instructions, including verification and upgrading, see the Installation Guide.
Upgrading? We have guides for:
Note
If
import fastmcpfails right after apipupgrade from FastMCP 3.2 or earlier, runpip install --force-reinstall fastmcp. See Troubleshooting for why this happens (uvis unaffected).
📚 Documentation
FastMCP's complete documentation is available at gofastmcp.com, including detailed guides, API references, and advanced patterns.
Documentation is also available in llms.txt format, which is a simple markdown standard that LLMs can consume easily:
llms.txtis essentially a sitemap, listing all the pages in the documentation.llms-full.txtcontains the entire documentation. Note this may exceed the context window of your LLM.
Community: Join our Discord server to connect with other FastMCP developers and share what you're building.
Contributing
We welcome contributions! See the Contributing Guide for setup instructions, testing requirements, and PR guidelines.