00a1336ee6
refactor: accept plain set for ResourceSecurity.exempt_params
...
Changes the type from frozenset[str] to collections.abc.Set[str] so
users can write exempt_params={"range"} instead of
exempt_params=frozenset({"range"}). The default factory stays
frozenset for immutability.
2026-03-26 17:42:18 +00:00
5cbbc70b18
feat: wire ResourceSecurity into MCPServer configuration
...
Adds `resource_security` to `MCPServer.__init__` and a per-resource
`security` override to the `@resource()` decorator. Templates inherit
the server-wide policy unless overridden.
Exports `ResourceSecurity` and `DEFAULT_RESOURCE_SECURITY` from
`mcp.server.mcpserver` for user configuration.
Usage:
# Server-wide relaxation
mcp = MCPServer(resource_security=ResourceSecurity(reject_path_traversal=False))
# Per-resource exemption for non-path parameters
@mcp.resource(
"git://diff/{+range}",
security=ResourceSecurity(exempt_params=frozenset({"range"})),
)
def git_diff(range: str) -> str: ...
2026-03-26 17:42:18 +00:00
0018eea38f
feat: integrate UriTemplate into MCPServer resource templates
...
Refactors the internal `ResourceTemplate` to use the RFC 6570
`UriTemplate` engine for matching, and adds a configurable
`ResourceSecurity` policy for path-safety checks on extracted
parameters.
`ResourceTemplate.matches()` now:
- Delegates to `UriTemplate.match()` for full RFC 6570 Level 1-3
support (plus path-style explode). `{+path}` can match
multi-segment paths.
- Enforces structural integrity: `%2F` smuggled into a simple
`{var}` is rejected.
- Applies `ResourceSecurity` policy: path traversal (`..` components)
and absolute paths rejected by default, with per-parameter
exemption available.
The `@mcp.resource()` decorator now parses the template once at
decoration time via `UriTemplate.parse()`, replacing the regex-based
param extraction that couldn't handle operators like `{+path}`.
Malformed templates surface immediately with a clear
`InvalidUriTemplate` including position info.
Also fixes the pre-existing bug where template literals were not
regex-escaped (a `.` in the template acted as a wildcard).
2026-03-26 17:42:18 +00:00
92c693bb73
fix: cancel in-flight handlers when transport closes in server.run() ( #2306 )
2026-03-20 13:37:32 +00:00
20dd94632e
feat(client): store InitializeResult as initialize_result ( #2300 )
2026-03-18 17:31:26 +00:00
7826ade12b
test: convert test_integration.py to in-memory transport (fix flaky) ( #2277 )
2026-03-18 15:25:11 +00:00
1a2244f402
fix: handle non-UTF-8 bytes in stdio server stdin ( #2302 )
2026-03-17 18:40:39 +00:00
62eb08e5b2
fix: don't send log notification on transport error ( #2257 )
2026-03-09 17:47:27 +00:00
31a38b5078
fix: correct Context type parameters across examples and tests ( #2256 )
2026-03-09 16:52:56 +00:00
eaf971cf25
Add warning log when rejecting request with unknown/expired session ID ( #2212 )
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-06 16:55:37 +00:00
92f1b1500d
fix: remove MIME type validation from MCPServer Resource ( #2235 )
2026-03-06 14:50:58 +00:00
cc22bf5464
refactor: remove request_ctx ContextVar, thread Context explicitly ( #2203 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-03-04 13:23:02 +00:00
0e96aecd1d
fix: use exact match for loopback hosts in issuer URL validation ( #2089 )
2026-02-18 19:40:52 +00:00
fc57c2c4c5
test: fix progress notification assertions for related_request_id ( #2038 )
...
Co-authored-by: Lee Hubbard <hubbard.zlee@unknowncyber.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-02-18 11:53:03 +00:00
92140e5086
Add idle session timeout to StreamableHTTPSessionManager ( #2022 )
2026-02-18 10:47:02 +00:00
705497a593
fix: allow null id in JSONRPCError per JSON-RPC 2.0 spec ( #2056 )
2026-02-17 10:30:34 +00:00
0a22a9dc33
refactor: replace lowlevel Server decorators with on_* constructor kwargs ( #1985 )
2026-02-12 15:55:54 +00:00
f049c8e5c6
Fix leaked anyio streams in streamable_http ( #1991 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2026-02-11 14:52:07 +00:00
1a8c14a5b8
refactor: replace mcp.types as types to from mcp import types ( #1986 )
2026-02-03 16:42:29 +00:00
4fc49c62bd
feat: add ClientRequestContext type alias for client-side handlers ( #1989 )
2026-02-03 17:37:38 +01:00
b1f7eec3cd
refactor: split RequestContext between server and client ( #1987 )
2026-02-03 14:35:07 +01:00
21822053df
Support different transports in Client ( #1972 )
2026-01-30 12:11:27 +00:00
14744c66c5
Add tests for MCPServer.read_resource exception handling ( #1957 )
2026-01-27 13:49:06 +01:00
acba5478a9
refactor: McpError renamed to MCPError and flatten parameters ( #1956 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-01-26 14:37:44 +01:00
65c614e48e
Rename FastMCP to MCPServer ( #1951 )
2026-01-25 14:45:52 +01:00
a7ddfdae07
ci: add strict-no-cover to detect unnecessary coverage pragmas ( #1897 )
2026-01-23 21:00:20 +01:00
f0ab53e194
Add meta to Client methods ( #1923 )
2026-01-22 14:50:39 +01:00
d77292fb06
refactor: drop test classes ( #1924 )
2026-01-22 12:37:52 +01:00
7b728a243e
refactor: drop unused logger/logging ( #1926 )
2026-01-22 11:56:41 +01:00
5fdd48a0d3
Completely drop RootModel from types module ( #1910 )
2026-01-19 14:29:15 +01:00
f4672c5084
Drop RootModel from JSONRPCMessage ( #1908 )
2026-01-19 14:04:15 +01:00
dcc9b4f8e0
refactor: use Client class in tests ( #1900 )
2026-01-17 09:46:58 +01:00
d41d0c0128
chore: add D212 lint rule to enforce Google-style docstrings ( #1892 )
2026-01-16 16:10:52 +00:00
df039bf97c
Add ergonomic Client class for testing MCP servers ( #1870 )
2026-01-16 15:49:26 +00:00
8adb5bdce8
refactor: move transport-specific parameters from FastMCP constructor to run() ( #1898 )
...
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-16 15:16:20 +00:00
5d80f4efc8
refactor: move inline imports to module level ( #1893 )
2026-01-16 14:54:08 +00:00
e94b386a13
refactor: use snake case instead of camel case in types ( #1894 )
2026-01-16 15:51:27 +01:00
edf0950a6a
Revert mount_path parameter from FastMCP ( #1881 )
2026-01-16 13:23:08 +00:00
cfb2909631
fix: change Resource URI fields from AnyUrl to str ( #1863 )
2026-01-16 09:58:57 +01:00
0da9a074d0
Support for Resource and ResourceTemplate metadata ( #1840 )
...
Co-authored-by: Jacem Elwaar <jacem@mcpappsbuilders.com >
2026-01-12 14:45:31 +00:00
3ffe142e9a
Support Python 3.14 ( #1834 )
2026-01-07 16:28:23 +00:00
3863f203e9
Server initialize response update to last spec (add title, description) ( #1634 )
2026-01-06 21:34:08 +00:00
6149b63a44
tests: add missing init files ( #1831 )
2026-01-06 19:52:09 +01:00
37de50144f
fix: add StatelessModeNotSupported exception and improve tests ( #1828 )
2026-01-06 11:26:26 +00:00
bb6cb029f0
fix: raise clear error for server-to-client requests in stateless mode ( #1827 )
2026-01-05 17:17:54 +00:00
d52937b39c
Make refresh_token grant type optional in DCR handler ( #1651 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-01-05 13:41:45 +00:00
78a9504ec1
fix: return HTTP 404 for unknown session IDs instead of 400 ( #1808 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-12-31 14:06:12 +00:00
a4bf947540
fix: Token endpoint response for invalid_client ( #1481 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-12-19 18:19:00 +00:00
8ac0cab98c
Fix for Url Elicitation issue 1768 ( #1780 )
2025-12-15 18:58:17 +01:00
a3a4b8d11a
Add streamable_http_client which accepts httpx.AsyncClient instead of httpx_client_factory ( #1177 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-12-10 16:39:00 +00:00
Max Isbey