Align with ecosystem norms per review feedback:
- Add mypy-init-return = true to skip -> None on __init__ when args are typed
- Exempt tests/** from ANN rules (near-universal practice)
- Revert test file annotations and __init__-only changes
Shrinks diff from 149 to ~47 files, keeping the valuable src/ return
type annotations that close the pyright gap.
Enable the `ANN` (flake8-annotations) rule set to require return type
and argument annotations on all function definitions. Pyright strict
already enforces argument types but infers return types silently; this
closes the gap so every function has an explicit return annotation.
Configuration choices:
- `ANN401` (any-type) is ignored: `Any` is sometimes the right answer
and pyright strict already catches genuine misuse.
- `allow-star-arg-any = true`: `*args: Any, **kwargs: Any` is a common
valid pattern for pass-through wrappers.
- Per-file ignores for `test_func_metadata.py` and `test_server.py` where
untyped parameters are intentional (testing schema inference on
unannotated signatures).
- README code snippets (via pytest-examples) exempt — short doc
examples shouldn't need full annotations.
Auto-fix added `-> None` or inferred return types to ~910 functions.
The remaining ~100 were annotated manually — mostly
`@asynccontextmanager` generators, pytest fixtures, and ASGI handlers
that Ruff couldn't infer.
* Auto-enable DNS rebinding protection for localhost servers
When a FastMCP server is created with host="127.0.0.1" or "localhost"
and no explicit transport_security is provided, automatically enable
DNS rebinding protection. Both 127.0.0.1 and localhost are allowed
as valid hosts/origins since clients may use either to connect.
* Add tests for auto DNS rebinding protection on localhost
Tests verify that:
- Protection auto-enables for host=127.0.0.1
- Protection auto-enables for host=localhost
- Both 127.0.0.1 and localhost are in allowed hosts/origins
- Protection does NOT auto-enable for other hosts (e.g., 0.0.0.0)
- Explicit transport_security settings are not overridden
* Add IPv6 localhost (::1) support for DNS rebinding protection
Extend auto-enable DNS rebinding protection to also cover IPv6
localhost. When host="::1", protection is now auto-enabled with
appropriate allowed hosts ([::1]:*) and origins (http://[::1]:*).
* Fix import ordering in test file
Max Isbey