gofastmcp.com
FastMCP Updates
Excerpt
Two community-contributed fixes: auth headers from MCP transport no longer leak through to downstream OpenAPI APIs, and background task workers now correctly receive the originating request ID. Plus a new docs example for context-aware tool factories. ... First patch after 3.0 — mostly smoothing out rough edges discovered in the wild. The big ones: middleware state that wasn’t surviving the trip to tool handlers now does, `Tool.from_tool()` accepts callables again, OpenAPI schemas with circular references no longer crash discovery, and decorator overloads now return the correct types in function mode. … ... FastMCP 3 RC1 means we believe the API is stable. Beta 2 drew a wave of real-world adoption — production deployments, migration reports, integration testing — and the feedback overwhelmingly confirmed that the architecture works. This release closes gaps that surfaced under load: auth flows that needed to be async, background tasks that needed reliable notification delivery, and APIs still carrying beta-era naming. If nothing unexpected surfaces, this is what 3.0.0 looks like.🚨 **Breaking Changes** — The `ui=` parameter is now `app=` with a unified `AppConfig` class, and 16 `FastMCP()` constructor kwargs have been removed after months of deprecation warnings.🔐 **Auth Improvements** — Async `auth=` checks, Static Client Registration for servers without DCR, and declarative Azure OBO flows via dependency injection. ... v2.14.4 backported `dereference_refs()` but never wired it into the tool schema pipeline — `$ref` and `$defs` were still sent to MCP clients. Now fixed: schemas are fully inlined before reaching clients. FastMCP 2.14.5 ... Sometimes five seconds just isn’t enough. This release fixes an HTTP transport bug that was cutting connections short, along with OAuth and Redis fixes, better ASGI support, and CLI update notifications so you never miss a beat.⏱️ **HTTP transport timeout fix** restores MCP’s 30-second default connect timeout, which was incorrectly defaulting to 5 seconds.🔧 **Infrastructure fixes** including OAuth token storage TTL, Redis key prefixing for ACL isolation, and ContextVar propagation for ASGI-mounted servers with background tasks. … ... FastMCP 2.14 begins adopting the MCP 2025-11-25 specification, introducing protocol-native background tasks that enable long-running operations to report progress without blocking clients.⏳ **Background Tasks (SEP-1686)** let you add `task=True` to any async tool decorator. Powered by Docket for enterprise task scheduling—in-memory backends work out-of-the-box, Redis enables persistence and horizontal scaling. … ## FastMCP 2.12.5: Safety Pin Pins MCP SDK version below 1.17 to ensure the `.well-known` payload appears in the expected location when using FastMCP auth providers with composite applications. FastMCP 2.12.4 Releases September 26, 2025 ... Hotfix for streamable-http transport validation in fastmcp.json configuration files, resolving a parsing error when CLI arguments were merged against the configuration spec. FastMCP 2.12.1 Releases September 3, 2025 … 🛠️ **Enhanced HTTP Routing** with OpenAPI extensions support and configurable algorithms for more flexible API integration.This release includes a breaking change to `client.call_tool()` return signatures but significantly expands the interaction capabilities of MCP servers. FastMCP 2.9 ... June 23, 2025
Source URL
https://gofastmcp.com/updatesRelated Pain Points
Middleware state not persisting to tool handlers
8Middleware state set during request processing was not correctly being propagated to tool handler functions, breaking authentication and request context flows in production.
OpenAPI schemas with circular references crash tool discovery
8Tool discovery fails when OpenAPI schemas contain circular references, blocking the ability to properly register and expose tools.
Auth headers leak from MCP transport to downstream OpenAPI APIs
8Authentication headers from the MCP transport layer were being improperly forwarded to downstream OpenAPI APIs, creating security and information disclosure risks.
HTTP transport connection timeout too short (5 seconds)
6The HTTP transport was configured with a 5-second timeout that was cutting connections short for operations that needed more time to complete.