d95f3a6922
fix: remove scope registration check from authorize handler
...
The check in validate_scope rejected any requested scope not in the
client's registered metadata. This broke the MCP spec's step-up
authorization flow: when a server returns 403 insufficient_scope with
a WWW-Authenticate challenge containing expanded scopes, the client
(see client/auth/oauth2.py) re-authorizes with those scopes and the
server would reject them.
RFC 7591 Section 2 defines the scope field as scopes the client "can
use", with no language restricting requests to that set. Scope policy
enforcement belongs in OAuthAuthorizationServerProvider.authorize(),
which can already raise AuthorizeError(error="invalid_scope", ...).
The TypeScript SDK removed this check in #983 for the same reason.
InvalidScopeError is removed as it was only raised from this path.
Reported-by: nik1097
Github-Issue: #2216
2026-03-17 11:51:31 +00:00
abfb482246
refactor(examples): migrate all HTTP examples to streamable_http_app() ( #2291 )
2026-03-16 11:37:01 +00:00
cc22bf5464
refactor: remove request_ctx ContextVar, thread Context explicitly ( #2203 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-03-04 13:23:02 +00:00
e82203bfc4
refactor: remove unused mcp.shared.progress module ( #2080 )
2026-02-18 13:10:02 +00:00
0a22a9dc33
refactor: replace lowlevel Server decorators with on_* constructor kwargs ( #1985 )
2026-02-12 15:55:54 +00:00
4fc49c62bd
feat: add ClientRequestContext type alias for client-side handlers ( #1989 )
2026-02-03 17:37:38 +01:00
b1f7eec3cd
refactor: split RequestContext between server and client ( #1987 )
2026-02-03 14:35:07 +01:00
21822053df
Support different transports in Client ( #1972 )
2026-01-30 12:11:27 +00:00
acba5478a9
refactor: McpError renamed to MCPError and flatten parameters ( #1956 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-01-26 14:37:44 +01:00
65c614e48e
Rename FastMCP to MCPServer ( #1951 )
2026-01-25 14:45:52 +01:00
ce75b2d7d2
refactor: improve type docstrings and remove internal type exports ( #1950 )
2026-01-24 17:17:09 +01:00
a1d330de9f
Proper handle extra data in MCP objects ( #1937 )
2026-01-23 15:35:23 +01:00
f0ab53e194
Add meta to Client methods ( #1923 )
2026-01-22 14:50:39 +01:00
34e66a3812
refactor: move streamable HTTP app creation from FastMCP to lowlevel Server ( #1899 )
2026-01-19 18:48:04 +01:00
5fdd48a0d3
Completely drop RootModel from types module ( #1910 )
2026-01-19 14:29:15 +01:00
df039bf97c
Add ergonomic Client class for testing MCP servers ( #1870 )
2026-01-16 15:49:26 +00:00
8adb5bdce8
refactor: move transport-specific parameters from FastMCP constructor to run() ( #1898 )
...
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-16 15:16:20 +00:00
edf0950a6a
Revert mount_path parameter from FastMCP ( #1881 )
2026-01-16 13:23:08 +00:00
cfb2909631
fix: change Resource URI fields from AnyUrl to str ( #1863 )
2026-01-16 09:58:57 +01:00
812a46ab97
Remove deprecated cursor parameter and ResourceReference ( #1871 )
2026-01-15 21:33:21 +01:00
024d7597fd
Drop Content and args parameter in ClientSessionGroup.call_tool ( #1866 )
2026-01-15 16:24:53 +00:00
f2b89ec83e
docs: add migrations page ( #1859 )
2026-01-15 10:13:18 +00:00
c92bb2f7ff
SEP-1686: Tasks ( #1645 )
2025-11-28 18:51:58 +00:00
fcffa14b5b
docs: Update examples to use stateless HTTP with JSON responses ( #1499 )
Main branch checks / checks (push) Failing after 0s
2025-11-20 15:06:37 +00:00
814c9c024a
Add documentation about testing ( #1426 )
2025-10-03 14:17:31 +00:00
89619a8604
Add documentation structure ( #1425 )
2025-10-03 13:17:08 +00:00
4e11f2890b
Add mkdocs ( #367 )
2025-03-25 13:06:15 +01:00
Max Isbey