c85501ac65
feat(auth): add BearerAuth for minimal bearer-token authentication
...
Adds BearerAuth, a lightweight httpx.Auth implementation with a two-method
contract (token() + optional on_unauthorized()). This covers the many deployments
that don't fit the OAuth authorization-code flow: gateway/proxy patterns, service
accounts with pre-provisioned tokens, enterprise SSO where tokens come from a
separate pipeline.
For simple cases, it's a one-liner:
auth = BearerAuth("my-api-key")
async with Client(url, auth=auth) as client: ...
For token rotation, pass a callable (sync or async):
auth = BearerAuth(lambda: os.environ.get("MCP_TOKEN"))
For custom 401 handling, pass or override on_unauthorized(). The handler receives
the 401 response (body pre-read, WWW-Authenticate available), refreshes
credentials, and the request retries once. Retry state is naturally per-operation
via httpx's generator-per-request pattern — no shared counter to reset or leak.
OAuthClientProvider is unchanged. Both are httpx.Auth subclasses and plug into
the same auth parameter — no adapter or type guard needed.
Also adds:
- auth= convenience parameter on streamable_http_client() and Client (mutually
exclusive with http_client=, raises ValueError if both given)
- UnauthorizedError exception for unrecoverable 401s
- sync_auth_flow override that raises a clear error instead of silently no-oping
- docs/authorization.md with bearer-token and OAuth sections
- examples/snippets/clients/bearer_auth_client.py
- 21 tests covering generator-driven unit tests and httpx wire-level integration
2026-03-24 13:46:08 +00:00
abfb482246
refactor(examples): migrate all HTTP examples to streamable_http_app() ( #2291 )
2026-03-16 11:37:01 +00:00
31a38b5078
fix: correct Context type parameters across examples and tests ( #2256 )
2026-03-09 16:52:56 +00:00
b9431d483f
fix: prevent command injection in example URL opening ( #2082 )
2026-02-18 15:16:44 +00:00
0a22a9dc33
refactor: replace lowlevel Server decorators with on_* constructor kwargs ( #1985 )
2026-02-12 15:55:54 +00:00
d3133ae6ce
chore: update author metadata to LF Projects ( #1992 )
2026-02-04 11:01:33 +00:00
1a8c14a5b8
refactor: replace mcp.types as types to from mcp import types ( #1986 )
2026-02-03 16:42:29 +00:00
4fc49c62bd
feat: add ClientRequestContext type alias for client-side handlers ( #1989 )
2026-02-03 17:37:38 +01:00
b1f7eec3cd
refactor: split RequestContext between server and client ( #1987 )
2026-02-03 14:35:07 +01:00
21822053df
Support different transports in Client ( #1972 )
2026-01-30 12:11:27 +00:00
1b5287c727
fix: remove unused requests dependency from simple-chatbot example ( #1958 )
2026-01-26 14:02:11 +00:00
acba5478a9
refactor: McpError renamed to MCPError and flatten parameters ( #1956 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-01-26 14:37:44 +01:00
65c614e48e
Rename FastMCP to MCPServer ( #1951 )
2026-01-25 14:45:52 +01:00
f0ab53e194
Add meta to Client methods ( #1923 )
2026-01-22 14:50:39 +01:00
7b728a243e
refactor: drop unused logger/logging ( #1926 )
2026-01-22 11:56:41 +01:00
213cf993ca
Add conformance testing CI pipeline ( #1915 )
2026-01-21 16:04:35 +00:00
d41d0c0128
chore: add D212 lint rule to enforce Google-style docstrings ( #1892 )
2026-01-16 16:10:52 +00:00
df039bf97c
Add ergonomic Client class for testing MCP servers ( #1870 )
2026-01-16 15:49:26 +00:00
8adb5bdce8
refactor: move transport-specific parameters from FastMCP constructor to run() ( #1898 )
...
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-16 15:16:20 +00:00
e94b386a13
refactor: use snake case instead of camel case in types ( #1894 )
2026-01-16 15:51:27 +01:00
2ce41a8347
Drop dependencies parameter from FastMCP ( #1877 )
2026-01-16 08:59:44 +00:00
cfb2909631
fix: change Resource URI fields from AnyUrl to str ( #1863 )
2026-01-16 09:58:57 +01:00
6b69f6354a
docs: fix simple-auth README references to non-existent scripts ( #1829 )
2026-01-08 14:45:31 +00:00
1fd557afdc
Add type checker to examples/client ( #1837 )
2026-01-07 17:08:18 +01:00
adcc17b968
types: add missing py.typed from examples package ( #1833 )
2026-01-06 18:54:58 +00:00
2aa1ad2a69
feat: standardize timeout values to floats in seconds ( #1766 )
2025-12-19 12:22:56 +00:00
a3a4b8d11a
Add streamable_http_client which accepts httpx.AsyncClient instead of httpx_client_factory ( #1177 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-12-10 16:39:00 +00:00
72a34002aa
fix: add lifespan context manager to StreamableHTTP mounting examples ( #1669 )
...
Co-authored-by: TheMailmans <tyler@example.com >
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2025-12-03 22:08:21 +00:00
fa851d93a2
feat: backwards-compatible create_message overloads for SEP-1577 ( #1713 )
2025-12-02 13:17:45 +00:00
f82b0c9371
Support client_credentials flow with JWT and Basic auth ( #1663 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-12-02 12:53:55 +00:00
281fd4765e
Add SSE polling support (SEP-1699) ( #1654 )
2025-12-02 11:44:49 +00:00
c92bb2f7ff
SEP-1686: Tasks ( #1645 )
2025-11-28 18:51:58 +00:00
02b7889929
Implement SEP-1036: URL mode elicitation for secure out-of-band interactions ( #1580 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-11-25 11:00:21 +00:00
f22501315e
feat: implement SEP-991 URL-based client ID (CIMD) support ( #1652 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-24 17:21:03 +00:00
998f0ee4db
[auth][conformance] add conformance auth client ( #1640 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-24 13:52:04 +00:00
b19fa6f279
SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance ( #1246 )
...
Co-authored-by: Tapan Chugh <tapanc@cs.washington.edu >
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-23 23:32:08 +00:00
71c475588f
Implement SEP-1577 - Sampling With Tools ( #1594 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Claude <noreply@anthropic.com >
2025-11-22 23:58:14 -05:00
c51936f61f
Add client_secret_basic authentication support ( #1334 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-11-20 20:53:37 +00:00
fcffa14b5b
docs: Update examples to use stateless HTTP with JSON responses ( #1499 )
Main branch checks / checks (push) Failing after 0s
2025-11-20 15:06:37 +00:00
be730674ad
Add SEP-1034 conformance test support to everything-server ( #1604 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-11-11 17:44:23 +00:00
a864840825
Add end-of-file-fixer pre-commit hook ( #1610 )
2025-11-11 13:23:08 +00:00
da4fce2195
Add everything-server for comprehensive MCP conformance testing ( #1587 )
2025-11-09 13:45:37 +00:00
6f2cd0cef0
Fix auth client example URL handling for oauth provider ( #1549 )
Main branch checks / checks (push) Failing after 0s
2025-10-30 15:35:44 +00:00
f161149680
Implement RFC 7523 JWT flows ( #1247 )
...
Co-authored-by: Yann Jouanin <yann.jouanin@valueandco.com >
2025-10-29 16:48:08 +00:00
673423da0d
fix: replace deprecated dev-dependencies in examples/clients ( #1518 )
2025-10-28 14:09:14 +00:00
340af403bd
Replace deprecated dev-dependencies with dependency-groups ( #1488 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-10-23 17:22:16 -07:00
1200ba0082
Allow CallToolResult to be returned directly to support _meta field for OpenAI Apps ( #1459 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-10-21 18:52:08 +00:00
c733eec5d9
Make client examples workspaces to reflect package code ( #1466 )
2025-10-17 17:13:39 +01:00
de89457683
fix: send params as empty object for list methods without cursor ( #1453 )
2025-10-14 11:11:38 +01:00
eb34ab7c72
fix: Remove unnecessary constructor from ResourceServerSettings ( #1424 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-10-14 09:21:15 +02:00
Max Isbey