mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-09 15:19:10 +02:00
d779414f8a* Add ResourceSecurity screening for templated resources (defaults on)
* Add tests for resource path-security screening
* Document resource path-security; fix ty in tests
* Carry child template security policy through provider mount
Preserve a mounted template's explicit ResourceSecurity (per-param
exemptions or a deliberate opt-out) through FastMCPProviderResourceTemplate.wrap
so the parent read chokepoint honours it instead of the parent default.
* Defer mcp SDK import so fastmcp.resources loads without the [mcp] extra
* Make resource path-security docs examples self-contained and runnable
* Match exempt_params under both hyphen and underscore spellings
Template placeholders like {git-ref} extract as git_ref, so an exemption
written with the natural URI-template spelling never matched.
* Docs: describe net-depth traversal rule accurately; make example runnable
The screening only rejects .. segments that escape the starting depth
(foo/../bar passes) — saying any standalone .. is rejected overstated
the guarantee. Also define DOCS_ROOT so the example runs.
|
||
|---|---|---|
| .. | ||
| .cursor/rules | ||
| apps | ||
| assets | ||
| cli | ||
| clients | ||
| community | ||
| css | ||
| deployment | ||
| development | ||
| getting-started | ||
| integrations | ||
| more | ||
| patterns | ||
| public/schemas/fastmcp.json | ||
| python-sdk | ||
| servers | ||
| snippets | ||
| tutorials | ||
| v2 | ||
| .ccignore | ||
| changelog.mdx | ||
| docs.json | ||
| fastmcp-analytics.js | ||
| prefab-demo-payloads.js | ||
| python-sdk-pages.json | ||
| unify-intent.js | ||
| updates.mdx | ||
| v2-banner.js | ||
| v2-navigation.json | ||