e8283746d0
[v1.x] fix: reject trailing newline in tool-name validation ( #3086 )
...
Main branch checks / checks (push) Failing after 0s
Conformance Tests / server-conformance (push) Has been cancelled
Conformance Tests / client-conformance (push) Has been cancelled
Deploy Docs / deploy-docs (push) Has been cancelled
Co-authored-by: otiscuilei <otiscui@icloud.com >
2026-07-17 14:19:59 +01:00
5f0b6af9f2
[v1.x] Add Streamable HTTP request body limits ( #3101 )
2026-07-16 09:54:29 +01:00
9678a3b347
[v1.x] Route Context.report_progress() to the originating request stream ( #2994 )
2026-06-26 15:43:15 +02:00
777b8d0671
[v1.x] Support TransportSecuritySettings in the WebSocket server transport ( #2992 )
Main branch checks / checks (push) Failing after 1s
2026-06-26 13:31:33 +02:00
6df3d73426
[v1.x] Buffer per-request StreamableHTTP streams; store priming event before dispatch ( #2948 )
2026-06-23 14:57:45 +01:00
32d32908fe
[v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat) ( #2889 )
Main branch checks / checks (push) Failing after 1s
2026-06-16 21:29:51 +00:00
0dca751056
[v1.x] Deflake the child process cleanup tests ( #2839 )
2026-06-11 16:48:13 +00:00
b8f491724c
[v1.x] Deprecate the WebSocket transport and the experimental tasks entry points ( #2828 )
2026-06-11 09:20:19 +01:00
2309e5ef97
fix: omit null optional fields from task result payloads ( #2809 )
...
Co-authored-by: Sheldon <neooosky@gmail.com >
2026-06-10 10:37:52 +01:00
494eb11d36
[v1.x] Support Python 3.14 ( #2769 )
2026-06-03 11:27:55 +01:00
62137874ff
[v1.x] Scope experimental tasks to the session that created them ( #2720 )
Main branch checks / checks (push) Failing after 0s
2026-05-29 18:05:58 +01:00
ce267b6fc5
[v1.x] Bind transport sessions to the authenticated principal ( #2719 )
2026-05-29 16:46:37 +00:00
1abcca2408
[v1.x] Add subject and claims to AccessToken ( #2690 )
2026-05-26 15:49:44 +01:00
73d458baac
[v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata ( #2405 )
2026-04-13 18:53:58 +01:00
6524782667
[v1.x] fix: handle ClosedResourceError when transport closes mid-request ( #2334 )
...
Main branch checks / checks (push) Failing after 0s
Co-authored-by: Owen Devereaux <owendevereaux@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-03-24 22:24:47 +00:00
2e9897e2b9
[v1.x] fix: handle non-UTF-8 bytes in stdio server stdin ( #2303 )
2026-03-17 18:40:43 +00:00
f8d98b63a7
Backport: Add missing TasksCallCapability to v1.x ( #2137 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
Co-authored-by: Claude <noreply@anthropic.com >
2026-03-02 12:56:24 +00:00
23a615783e
feat: add idle timeout for StreamableHTTP sessions ( #1994 )
2026-02-18 10:34:18 +00:00
67458948ae
fix: add RFC 8707 resource validation to OAuth client ( #2069 )
2026-02-17 14:35:42 +00:00
3d9d34552a
[v1.x] fix: return HTTP 404 for unknown session IDs instead of 400 ( #1945 )
...
Main branch checks / checks (push) Failing after 1s
Co-authored-by: Maxime <67350340+max-rousseau@users.noreply.github.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-01-24 19:09:14 +00:00
d891525958
Backport: Support for Resource and ResourceTemplate metadata ( #1928 )
...
Co-authored-by: Jacem Elwaar <jacem@mcpappsbuilders.com >
2026-01-22 14:02:25 +00:00
8ac0cab98c
Fix for Url Elicitation issue 1768 ( #1780 )
2025-12-15 18:58:17 +01:00
65b36de4eb
fix: use correct python command name in test_stdio.py ( #1782 )
...
Main branch checks / checks (push) Failing after 0s
Signed-off-by: Ondrej Mosnáček <omosnacek@gmail.com >
2025-12-12 14:02:38 +00:00
a3a4b8d11a
Add streamable_http_client which accepts httpx.AsyncClient instead of httpx_client_factory ( #1177 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-12-10 16:39:00 +00:00
cc8382ce3e
Fix JSON-RPC error response ID matching ( #1720 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-12-10 16:15:21 +00:00
0dedbd9831
feat: client-side support for SEP-1577 sampling with tools ( #1722 )
2025-12-09 23:36:28 +00:00
2bf9b10f63
Skip empty SSE data to avoid parsing errors ( #1753 )
...
Co-authored-by: ARJUN-TS1 <arjun.ts1@ibm.com >
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-12-09 15:14:23 +00:00
8ac11ec604
fix: allow MIME type parameters in resource validation (RFC 2045) ( #1755 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2025-12-09 14:56:40 +00:00
8b984d93a3
refactor(auth): remove unused _register_client method ( #1748 )
2025-12-08 21:50:20 +00:00
89ff338174
fix: skip priming events and close_sse_stream for old protocol versions ( #1719 )
Main branch checks / checks (push) Failing after 0s
2025-12-04 14:44:08 +00:00
9ed0b93ceb
fix: handle ClosedResourceError in StreamableHTTP message router ( #1384 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2025-12-04 11:36:23 +01:00
8e02fc17e1
chore: update LATEST_PROTOCOL_VERSION to 2025-11-25 ( #1715 )
Main branch checks / checks (push) Failing after 1s
2025-12-02 18:27:27 +00:00
d3a184119e
Merge commit from fork
...
Main branch checks / checks (push) Failing after 0s
* Auto-enable DNS rebinding protection for localhost servers
When a FastMCP server is created with host="127.0.0.1" or "localhost"
and no explicit transport_security is provided, automatically enable
DNS rebinding protection. Both 127.0.0.1 and localhost are allowed
as valid hosts/origins since clients may use either to connect.
* Add tests for auto DNS rebinding protection on localhost
Tests verify that:
- Protection auto-enables for host=127.0.0.1
- Protection auto-enables for host=localhost
- Both 127.0.0.1 and localhost are in allowed hosts/origins
- Protection does NOT auto-enable for other hosts (e.g., 0.0.0.0)
- Explicit transport_security settings are not overridden
* Add IPv6 localhost (::1) support for DNS rebinding protection
Extend auto-enable DNS rebinding protection to also cover IPv6
localhost. When host="::1", protection is now auto-enabled with
appropriate allowed hosts ([::1]:*) and origins (http://[::1] :*).
* Fix import ordering in test file
2025-12-02 13:23:55 +00:00
fa851d93a2
feat: backwards-compatible create_message overloads for SEP-1577 ( #1713 )
2025-12-02 13:17:45 +00:00
f82b0c9371
Support client_credentials flow with JWT and Basic auth ( #1663 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-12-02 12:53:55 +00:00
281fd4765e
Add SSE polling support (SEP-1699) ( #1654 )
2025-12-02 11:44:49 +00:00
2cd178a962
Add on_session_created callback option ( #1710 )
2025-12-01 17:48:33 +00:00
c92bb2f7ff
SEP-1686: Tasks ( #1645 )
2025-11-28 18:51:58 +00:00
5983a650cc
Skip empty SSE data to avoid parsing errors ( #1670 )
2025-11-26 18:09:39 +00:00
02b7889929
Implement SEP-1036: URL mode elicitation for secure out-of-band interactions ( #1580 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-11-25 11:00:21 +00:00
f22501315e
feat: implement SEP-991 URL-based client ID (CIMD) support ( #1652 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-24 17:21:03 +00:00
091afb82dc
Implement SEP-986: Tool name validation ( #1655 )
2025-11-24 16:46:57 +00:00
b19fa6f279
SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance ( #1246 )
...
Co-authored-by: Tapan Chugh <tapanc@cs.washington.edu >
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-23 23:32:08 +00:00
71c475588f
Implement SEP-1577 - Sampling With Tools ( #1594 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
Co-authored-by: Claude <noreply@anthropic.com >
2025-11-22 23:58:14 -05:00
c51936f61f
Add client_secret_basic authentication support ( #1334 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-11-20 20:53:37 +00:00
397089a78e
Add tests for JSON Schema 2020-12 field preservation (SEP-1613) ( #1649 )
2025-11-20 20:51:13 +00:00
9c8f763aa8
chore: Lazy import jsonschema library ( #1596 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-11-19 15:30:52 +00:00
5489e8b6fb
fix get_client_metadata_scopes on 401 ( #1631 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2025-11-16 17:18:50 +00:00
a357380cfa
feat: Pass through and expose additional parameters in ClientSessionGroup.call_tool and .connect_to_server ( #1576 )
2025-11-16 15:57:43 +00:00
116c13e2c6
Refactor func_metadata() implementation ( #1496 )
2025-11-13 20:21:15 +00:00
Max