FastMCP 4.1.7 backports 42 fixes from the 4.2 line, covering OpenAPI schema and parameter handling, OAuth redirect and consent edge cases, proxy and response caching, and lost-connection errors in the client. It also requires patched joserfc and Authlib releases and closes a redirect URI validation gap for callers that pass raw strings.
Thanks to our 41 contributors, including 28 first-time contributors.
What's Changed
Security 🔒
- Redact passwords from the worker's backend URL by @jaeminbird and @mbishflavien in #6113
- fix(auth): collapse a repeated
issin the client redirect by @shi-felix and @alpaylan in #6352 - Require patched joserfc by @zzstoatzz in #6371
- [4.1] Require patched Authlib in client and server extras by @zzstoatzz and @zhuweid in #6338
- [4.1] Normalize raw-string redirect URIs through AnyUrl before validation by @zzstoatzz, @uhhgxg, and @alpaylan in #6385
Fixes 🐞
- fix(openapi): serialize header and path parameters per the simple style by @Harsh23Kashyap in #5091
- fix(proxy): keep stale list results out of cache by @mikamikasuki in #5521
- fix(auth): Preserve browser consent bindings across concurrent OAuth approvals by @mikamikasuki in #5541
- fix(openapi): preserve explicit null in nullable JSON body properties by @mumu-bird in #5633
- fix: name root self-references after the generated root class by @BlueX888 in #5671
- Convert OpenAPI 3.0 boolean exclusive bounds to numeric bounds by @asasemahmed in #5697
- Rewrite component refs under not, if/then/else and similar keywords by @asasemahmed in #5698
- Fall back to method and path when an OpenAPI name slugs to nothing by @asasemahmed in #5699
- fix(openapi): keep media-type $defs beside component schemas by @BlueX888 in #5709
- Fix namespaced file resource reads while preserving URI normalization by @BlueLi66 in #5716
- fix(middleware): treat an empty methods allowlist as "log nothing" by @gdut4140 in #5727
- fix(server): pass typed list request messages to list middleware hooks by @BlueX888 in #5732
- fix(tasks): send task IDs in routing headers by @eli-yip in #5810
- fix(mcp-config): reuse one OAuth client per configured server by @kbkb628 and @whoskn in #6097
- Fix kept-alive stdio transports ignoring client timeouts by @HootRock in #6156
- fix(cli): preserve explicit null in generated tool commands by @likecake in #6191
- Honor empty tag inclusion filters in multi-server configs by @PennEwan in #6200
- Match Claude Code project keys by path on Windows by @zzstoatzz and @yongpange in #6240
- Stop preloading the server before launching the Inspector by @zzstoatzz and @mikamikasuki in #6241
- Cull expired OAuth state from the default OAuthProxy file store by @zzstoatzz, @nosmile99, and @mheidari98 in #6242
- Match Gemini function responses to tool-use IDs by @zzstoatzz and @mikamikasuki in #6244
- Replace parent type keywords when an ArgTransform changes the type by @zzstoatzz, @syf2211, @HootRock, and @chrikrah in #6246
- Expire idle per-client rate limiters by @zzstoatzz and @mikamikasuki in #6247
- Match resource templates that spell out a literal query by @zzstoatzz and @arieleven in #6248
- fix(telemetry): record mounted and nested server spans as INTERNAL by @zzstoatzz and @sonmaximum in #6252
- fix(openapi): keep both values when a query object property matches another parameter by @zzstoatzz and @alpaylan in #6256
- fix(middleware): map exception subclasses in ErrorHandlingMiddleware by @zzstoatzz and @zurmag in #6257
- fix(client): report a lost connection instead of 'Client is not connected' by @zzstoatzz and @alex-feel in #6259
- Mask prompt handler exceptions when mask_error_details=True by @pratyu2h and @maxmorrish in #6277
- fix(search): rebuild the BM25 index when the tool name set changes by @shi-felix in #6282
- fix(tools): keep hidden parameter factories out of visible defaults by @shi-felix in #6283
- fix(client): keep the response cache inert on legacy connections (#6298) by @xunWhale and @alpaylan in #6321
- fix(auth): accept private-use scheme redirect URIs in CIMD documents by @ColePBryan in #6335
- Send {} for required OpenAPI object bodies with no fields by @rome-xi and @wang1299 in #6340
- Report the stop reason from sampling handlers when no tools are offered by @AarnavNoble in #6342
- fix(auth): preserve empty authority on custom-scheme redirect URIs by @codesphere-u and @alpaylan in #6347
- Declare items.type on multi-select list shorthand elicitations by @zzstoatzz, @shi-felix, @Vivek1898, and @alpaylan in #6361
Docs 📚
- Correct how tools docs describe bytes return values by @DivyaNarahari97 in #6275
Other Changes 🦾
- Keep colon-terminated prose lines in docstring tool descriptions by @zzstoatzz, @jlx1999s, and @ptrailblazer89 in #6372
New Contributors
- @jaeminbird made their first contribution in #6113
- @mbishflavien made their first contribution in #6113
- @shi-felix made their first contribution in #6352
- @zhuweid made their first contribution in #6338
- @mumu-bird made their first contribution in #5633
- @BlueLi66 made their first contribution in #5716
- @gdut4140 made their first contribution in #5727
- @eli-yip made their first contribution in #5810
- @whoskn made their first contribution in #6097
- @likecake made their first contribution in #6191
- @PennEwan made their first contribution in #6200
- @yongpange made their first contribution in #6240
- @nosmile99 made their first contribution in #6242
- @mheidari98 made their first contribution in #6242
- @arieleven made their first contribution in #6248
- @sonmaximum made their first contribution in #6252
- @zurmag made their first contribution in #6257
- @pratyu2h made their first contribution in #6277
- @maxmorrish made their first contribution in #6277
- @xunWhale made their first contribution in #6321
- @ColePBryan made their first contribution in #6335
- @rome-xi made their first contribution in #6340
- @wang1299 made their first contribution in #6340
- @codesphere-u made their first contribution in #6347
- @Vivek1898 made their first contribution in #6361
- @DivyaNarahari97 made their first contribution in #6275
- @jlx1999s made their first contribution in #6372
- @ptrailblazer89 made their first contribution in #6372
Full Changelog: v4.1.6...v4.1.7