d95f3a6922
fix: remove scope registration check from authorize handler
...
The check in validate_scope rejected any requested scope not in the
client's registered metadata. This broke the MCP spec's step-up
authorization flow: when a server returns 403 insufficient_scope with
a WWW-Authenticate challenge containing expanded scopes, the client
(see client/auth/oauth2.py) re-authorizes with those scopes and the
server would reject them.
RFC 7591 Section 2 defines the scope field as scopes the client "can
use", with no language restricting requests to that set. Scope policy
enforcement belongs in OAuthAuthorizationServerProvider.authorize(),
which can already raise AuthorizeError(error="invalid_scope", ...).
The TypeScript SDK removed this check in #983 for the same reason.
InvalidScopeError is removed as it was only raised from this path.
Reported-by: nik1097
Github-Issue: #2216
2026-03-17 11:51:31 +00:00
62eb08e5b2
fix: don't send log notification on transport error ( #2257 )
2026-03-09 17:47:27 +00:00
31a38b5078
fix: correct Context type parameters across examples and tests ( #2256 )
2026-03-09 16:52:56 +00:00
eaf971cf25
Add warning log when rejecting request with unknown/expired session ID ( #2212 )
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-06 16:55:37 +00:00
92f1b1500d
fix: remove MIME type validation from MCPServer Resource ( #2235 )
2026-03-06 14:50:58 +00:00
cc22bf5464
refactor: remove request_ctx ContextVar, thread Context explicitly ( #2203 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-03-04 13:23:02 +00:00
0e96aecd1d
fix: use exact match for loopback hosts in issuer URL validation ( #2089 )
2026-02-18 19:40:52 +00:00
fc57c2c4c5
test: fix progress notification assertions for related_request_id ( #2038 )
...
Co-authored-by: Lee Hubbard <hubbard.zlee@unknowncyber.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-02-18 11:53:03 +00:00
92140e5086
Add idle session timeout to StreamableHTTPSessionManager ( #2022 )
2026-02-18 10:47:02 +00:00
705497a593
fix: allow null id in JSONRPCError per JSON-RPC 2.0 spec ( #2056 )
2026-02-17 10:30:34 +00:00
0a22a9dc33
refactor: replace lowlevel Server decorators with on_* constructor kwargs ( #1985 )
2026-02-12 15:55:54 +00:00
f049c8e5c6
Fix leaked anyio streams in streamable_http ( #1991 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-02-11 14:52:07 +00:00
1a8c14a5b8
refactor: replace mcp.types as types to from mcp import types ( #1986 )
2026-02-03 16:42:29 +00:00
4fc49c62bd
feat: add ClientRequestContext type alias for client-side handlers ( #1989 )
2026-02-03 17:37:38 +01:00
b1f7eec3cd
refactor: split RequestContext between server and client ( #1987 )
2026-02-03 14:35:07 +01:00
21822053df
Support different transports in Client ( #1972 )
2026-01-30 12:11:27 +00:00
14744c66c5
Add tests for MCPServer.read_resource exception handling ( #1957 )
2026-01-27 13:49:06 +01:00
acba5478a9
refactor: McpError renamed to MCPError and flatten parameters ( #1956 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-01-26 14:37:44 +01:00
65c614e48e
Rename FastMCP to MCPServer ( #1951 )
2026-01-25 14:45:52 +01:00
a7ddfdae07
ci: add strict-no-cover to detect unnecessary coverage pragmas ( #1897 )
2026-01-23 21:00:20 +01:00
f0ab53e194
Add meta to Client methods ( #1923 )
2026-01-22 14:50:39 +01:00
d77292fb06
refactor: drop test classes ( #1924 )
2026-01-22 12:37:52 +01:00
7b728a243e
refactor: drop unused logger/logging ( #1926 )
2026-01-22 11:56:41 +01:00
5fdd48a0d3
Completely drop RootModel from types module ( #1910 )
2026-01-19 14:29:15 +01:00
f4672c5084
Drop RootModel from JSONRPCMessage ( #1908 )
2026-01-19 14:04:15 +01:00
dcc9b4f8e0
refactor: use Client class in tests ( #1900 )
2026-01-17 09:46:58 +01:00
d41d0c0128
chore: add D212 lint rule to enforce Google-style docstrings ( #1892 )
2026-01-16 16:10:52 +00:00
df039bf97c
Add ergonomic Client class for testing MCP servers ( #1870 )
2026-01-16 15:49:26 +00:00
8adb5bdce8
refactor: move transport-specific parameters from FastMCP constructor to run() ( #1898 )
...
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-16 15:16:20 +00:00
5d80f4efc8
refactor: move inline imports to module level ( #1893 )
2026-01-16 14:54:08 +00:00
e94b386a13
refactor: use snake case instead of camel case in types ( #1894 )
2026-01-16 15:51:27 +01:00
edf0950a6a
Revert mount_path parameter from FastMCP ( #1881 )
2026-01-16 13:23:08 +00:00
cfb2909631
fix: change Resource URI fields from AnyUrl to str ( #1863 )
2026-01-16 09:58:57 +01:00
0da9a074d0
Support for Resource and ResourceTemplate metadata ( #1840 )
...
Co-authored-by: Jacem Elwaar <jacem@mcpappsbuilders.com >
2026-01-12 14:45:31 +00:00
3ffe142e9a
Support Python 3.14 ( #1834 )
2026-01-07 16:28:23 +00:00
3863f203e9
Server initialize response update to last spec (add title, description) ( #1634 )
2026-01-06 21:34:08 +00:00
6149b63a44
tests: add missing init files ( #1831 )
2026-01-06 19:52:09 +01:00
37de50144f
fix: add StatelessModeNotSupported exception and improve tests ( #1828 )
2026-01-06 11:26:26 +00:00
bb6cb029f0
fix: raise clear error for server-to-client requests in stateless mode ( #1827 )
2026-01-05 17:17:54 +00:00
d52937b39c
Make refresh_token grant type optional in DCR handler ( #1651 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-01-05 13:41:45 +00:00
78a9504ec1
fix: return HTTP 404 for unknown session IDs instead of 400 ( #1808 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-12-31 14:06:12 +00:00
a4bf947540
fix: Token endpoint response for invalid_client ( #1481 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-12-19 18:19:00 +00:00
8ac0cab98c
Fix for Url Elicitation issue 1768 ( #1780 )
2025-12-15 18:58:17 +01:00
a3a4b8d11a
Add streamable_http_client which accepts httpx.AsyncClient instead of httpx_client_factory ( #1177 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-12-10 16:39:00 +00:00
d3a184119e
Merge commit from fork
...
Main branch checks / checks (push) Failing after 0s
* Auto-enable DNS rebinding protection for localhost servers
When a FastMCP server is created with host="127.0.0.1" or "localhost"
and no explicit transport_security is provided, automatically enable
DNS rebinding protection. Both 127.0.0.1 and localhost are allowed
as valid hosts/origins since clients may use either to connect.
* Add tests for auto DNS rebinding protection on localhost
Tests verify that:
- Protection auto-enables for host=127.0.0.1
- Protection auto-enables for host=localhost
- Both 127.0.0.1 and localhost are in allowed hosts/origins
- Protection does NOT auto-enable for other hosts (e.g., 0.0.0.0)
- Explicit transport_security settings are not overridden
* Add IPv6 localhost (::1) support for DNS rebinding protection
Extend auto-enable DNS rebinding protection to also cover IPv6
localhost. When host="::1", protection is now auto-enabled with
appropriate allowed hosts ([::1]:*) and origins (http://[::1] :*).
* Fix import ordering in test file
2025-12-02 13:23:55 +00:00
c92bb2f7ff
SEP-1686: Tasks ( #1645 )
2025-11-28 18:51:58 +00:00
02b7889929
Implement SEP-1036: URL mode elicitation for secure out-of-band interactions ( #1580 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-11-25 11:00:21 +00:00
b19fa6f279
SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance ( #1246 )
...
Co-authored-by: Tapan Chugh <tapanc@cs.washington.edu >
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-23 23:32:08 +00:00
71c475588f
Implement SEP-1577 - Sampling With Tools ( #1594 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Claude <noreply@anthropic.com >
2025-11-22 23:58:14 -05:00
c51936f61f
Add client_secret_basic authentication support ( #1334 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-11-20 20:53:37 +00:00
Max Isbey