fastmcp 4.12.3 → 4.12.5

package/README.md

@@ -848,6 +848,7 @@ server.addTool({
 The `imageContent` function takes the following options:
 
 - `url`: The URL of the image.
+- `timeoutMs`: Optional timeout for a URL download in milliseconds (defaults to 30 seconds).
 - `path`: The path to the image file.
 - `buffer`: The image data as a buffer.
 
@@ -1025,6 +1026,7 @@ server.addTool({
 The `audioContent` function takes the following options:
 
 - `url`: The URL of the audio.
+- `timeoutMs`: Optional timeout for a URL download in milliseconds (defaults to 30 seconds).
 - `path`: The path to the audio file.
 - `buffer`: The audio data as a buffer.
 
@@ -2013,20 +2015,23 @@ For more control over OAuth behavior, you can use the `oauth` option directly:
 import { FastMCP } from "fastmcp";
 import { GoogleProvider } from "fastmcp/auth";
 
-const authProxy = new GoogleProvider({
-  clientId: process.env.GOOGLE_CLIENT_ID,
-  clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+const authProvider = new GoogleProvider({
   baseUrl: "https://your-server.com",
+  clientId: process.env.GOOGLE_CLIENT_ID!,
+  clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
   scopes: ["openid", "profile", "email"],
 });
 
 const server = new FastMCP({
   name: "My Server",
   oauth: {
+    authorizationServer: authProvider
+      .getProxy()
+      .getAuthorizationServerMetadata(),
     enabled: true,
-    authorizationServer: authProxy.getAuthorizationServerMetadata(),
-    proxy: authProxy,
+    proxy: authProvider.getProxy(),
   },
+  version: "1.0.0",
 });
 ```
 

package/dist/FastMCP.cjs

@@ -10,7 +10,8 @@
 
 
 
-var _chunk3O5ZKWCCcjs = require('./chunk-3O5ZKWCC.cjs');
+
+var _chunkU36NARZGcjs = require('./chunk-U36NARZG.cjs');
 
 
 
@@ -47,5 +48,6 @@ var _chunkENMHHQJFcjs = require('./chunk-ENMHHQJF.cjs');
 
 
 
-exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunk3O5ZKWCCcjs.DiscoveryDocumentCache; exports.FastMCP = _chunk3O5ZKWCCcjs.FastMCP; exports.FastMCPError = _chunk3O5ZKWCCcjs.FastMCPError; exports.FastMCPSession = _chunk3O5ZKWCCcjs.FastMCPSession; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.ServerState = _chunk3O5ZKWCCcjs.ServerState; exports.SessionError = _chunk3O5ZKWCCcjs.SessionError; exports.UnexpectedStateError = _chunk3O5ZKWCCcjs.UnexpectedStateError; exports.UserError = _chunk3O5ZKWCCcjs.UserError; exports.audioContent = _chunk3O5ZKWCCcjs.audioContent; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.imageContent = _chunk3O5ZKWCCcjs.imageContent; exports.jsonSchemaAdapter = _chunk3O5ZKWCCcjs.jsonSchemaAdapter; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
+
+exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,+tCAAC","file":"/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"}
+{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,0yCAAC","file":"/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"}

package/dist/FastMCP.d.cts

@@ -141,20 +141,23 @@ type FastMCPSessionEvents = {
         roots: Root[];
     }) => void;
 };
-declare const imageContent: (input: {
-    buffer: Buffer;
-} | {
-    path: string;
-} | {
-    url: string;
-}) => Promise<ImageContent>;
-declare const audioContent: (input: {
+/**
+ * Timeout for image/audio URL fetches (in milliseconds). The OAuth upstream
+ * fetches (#304) use 10s because they are short interactive exchanges; media
+ * downloads can be larger and slower, so 30s is the balance between hanging
+ * forever on an unresponsive server and false positives on slow connections.
+ */
+declare const MEDIA_FETCH_TIMEOUT_MS = 30000;
+type MediaContentInput = {
     buffer: Buffer;
 } | {
     path: string;
 } | {
+    timeoutMs?: number;
     url: string;
-}) => Promise<AudioContent>;
+};
+declare const imageContent: (input: MediaContentInput) => Promise<ImageContent>;
+declare const audioContent: (input: MediaContentInput) => Promise<AudioContent>;
 type Context<T extends FastMCPSessionAuth> = {
     client: {
         version: ReturnType<Server["getClientVersion"]>;
@@ -1054,4 +1057,4 @@ declare class FastMCP<T extends FastMCPSessionAuth = FastMCPSessionAuth> extends
     stop(): Promise<void>;
 }
 
-export { type AudioContent, AuthProvider, type Content, type ContentResult, type Context, DiscoveryDocumentCache, FastMCP, FastMCPError, type FastMCPEvents, type FastMCPRequest, type FastMCPResponse, FastMCPSession, type FastMCPSessionAuth, type FastMCPSessionEvents, type HTTPMethod, type ImageContent, type InputPrompt, type InputPromptArgument, type JsonSchemaObject, type JsonSchemaStandardSchema, type LoadContext, type Logger, type LoggingLevel, OAuthSession, type Progress, type Prompt, type PromptArgument, type Resource, type ResourceContent, type ResourceResult, type ResourceTemplate, type ResourceTemplateArgument, type RouteHandler, type RouteOptions, type SSEServer, type SerializableValue, type ServerOptions, ServerState, SessionError, type TextContent, type Tool, type ToolParameters, UnexpectedStateError, UserError, audioContent, imageContent, jsonSchemaAdapter };
+export { type AudioContent, AuthProvider, type Content, type ContentResult, type Context, DiscoveryDocumentCache, FastMCP, FastMCPError, type FastMCPEvents, type FastMCPRequest, type FastMCPResponse, FastMCPSession, type FastMCPSessionAuth, type FastMCPSessionEvents, type HTTPMethod, type ImageContent, type InputPrompt, type InputPromptArgument, type JsonSchemaObject, type JsonSchemaStandardSchema, type LoadContext, type Logger, type LoggingLevel, MEDIA_FETCH_TIMEOUT_MS, OAuthSession, type Progress, type Prompt, type PromptArgument, type Resource, type ResourceContent, type ResourceResult, type ResourceTemplate, type ResourceTemplateArgument, type RouteHandler, type RouteOptions, type SSEServer, type SerializableValue, type ServerOptions, ServerState, SessionError, type TextContent, type Tool, type ToolParameters, UnexpectedStateError, UserError, audioContent, imageContent, jsonSchemaAdapter };

package/dist/FastMCP.d.ts

@@ -141,20 +141,23 @@ type FastMCPSessionEvents = {
         roots: Root[];
     }) => void;
 };
-declare const imageContent: (input: {
-    buffer: Buffer;
-} | {
-    path: string;
-} | {
-    url: string;
-}) => Promise<ImageContent>;
-declare const audioContent: (input: {
+/**
+ * Timeout for image/audio URL fetches (in milliseconds). The OAuth upstream
+ * fetches (#304) use 10s because they are short interactive exchanges; media
+ * downloads can be larger and slower, so 30s is the balance between hanging
+ * forever on an unresponsive server and false positives on slow connections.
+ */
+declare const MEDIA_FETCH_TIMEOUT_MS = 30000;
+type MediaContentInput = {
     buffer: Buffer;
 } | {
     path: string;
 } | {
+    timeoutMs?: number;
     url: string;
-}) => Promise<AudioContent>;
+};
+declare const imageContent: (input: MediaContentInput) => Promise<ImageContent>;
+declare const audioContent: (input: MediaContentInput) => Promise<AudioContent>;
 type Context<T extends FastMCPSessionAuth> = {
     client: {
         version: ReturnType<Server["getClientVersion"]>;
@@ -1054,4 +1057,4 @@ declare class FastMCP<T extends FastMCPSessionAuth = FastMCPSessionAuth> extends
     stop(): Promise<void>;
 }
 
-export { type AudioContent, AuthProvider, type Content, type ContentResult, type Context, DiscoveryDocumentCache, FastMCP, FastMCPError, type FastMCPEvents, type FastMCPRequest, type FastMCPResponse, FastMCPSession, type FastMCPSessionAuth, type FastMCPSessionEvents, type HTTPMethod, type ImageContent, type InputPrompt, type InputPromptArgument, type JsonSchemaObject, type JsonSchemaStandardSchema, type LoadContext, type Logger, type LoggingLevel, OAuthSession, type Progress, type Prompt, type PromptArgument, type Resource, type ResourceContent, type ResourceResult, type ResourceTemplate, type ResourceTemplateArgument, type RouteHandler, type RouteOptions, type SSEServer, type SerializableValue, type ServerOptions, ServerState, SessionError, type TextContent, type Tool, type ToolParameters, UnexpectedStateError, UserError, audioContent, imageContent, jsonSchemaAdapter };
+export { type AudioContent, AuthProvider, type Content, type ContentResult, type Context, DiscoveryDocumentCache, FastMCP, FastMCPError, type FastMCPEvents, type FastMCPRequest, type FastMCPResponse, FastMCPSession, type FastMCPSessionAuth, type FastMCPSessionEvents, type HTTPMethod, type ImageContent, type InputPrompt, type InputPromptArgument, type JsonSchemaObject, type JsonSchemaStandardSchema, type LoadContext, type Logger, type LoggingLevel, MEDIA_FETCH_TIMEOUT_MS, OAuthSession, type Progress, type Prompt, type PromptArgument, type Resource, type ResourceContent, type ResourceResult, type ResourceTemplate, type ResourceTemplateArgument, type RouteHandler, type RouteOptions, type SSEServer, type SerializableValue, type ServerOptions, ServerState, SessionError, type TextContent, type Tool, type ToolParameters, UnexpectedStateError, UserError, audioContent, imageContent, jsonSchemaAdapter };

package/dist/FastMCP.js

@@ -3,6 +3,7 @@ import {
   FastMCP,
   FastMCPError,
   FastMCPSession,
+  MEDIA_FETCH_TIMEOUT_MS,
   ServerState,
   SessionError,
   UnexpectedStateError,
@@ -10,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-5K4GLQMV.js";
+} from "./chunk-HIIPZVNY.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -33,6 +34,7 @@ export {
   FastMCPSession,
   GitHubProvider,
   GoogleProvider,
+  MEDIA_FETCH_TIMEOUT_MS,
   OAuthProvider,
   ServerState,
   SessionError,

package/dist/{chunk-5K4GLQMV.js → chunk-HIIPZVNY.js}

@@ -197,12 +197,16 @@ function unwrapDefault(value) {
 }
 
 // src/FastMCP.ts
+var MEDIA_FETCH_TIMEOUT_MS = 3e4;
 var imageContent = async (input) => {
   let rawData;
   try {
     if ("url" in input) {
+      const timeoutMs = input.timeoutMs ?? MEDIA_FETCH_TIMEOUT_MS;
       try {
-        const response = await fetch2(input.url);
+        const response = await fetch2(input.url, {
+          signal: AbortSignal.timeout(timeoutMs)
+        });
         if (!response.ok) {
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
@@ -210,6 +214,11 @@ var imageContent = async (input) => {
         }
         rawData = Buffer.from(await response.arrayBuffer());
       } catch (error) {
+        if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
+          throw new Error(
+            `Failed to fetch image from URL (${input.url}): timed out after ${timeoutMs}ms`
+          );
+        }
         throw new Error(
           `Failed to fetch image from URL (${input.url}): ${error instanceof Error ? error.message : String(error)}`
         );
@@ -254,8 +263,11 @@ var audioContent = async (input) => {
   let rawData;
   try {
     if ("url" in input) {
+      const timeoutMs = input.timeoutMs ?? MEDIA_FETCH_TIMEOUT_MS;
       try {
-        const response = await fetch2(input.url);
+        const response = await fetch2(input.url, {
+          signal: AbortSignal.timeout(timeoutMs)
+        });
         if (!response.ok) {
           throw new Error(
             `Server responded with status: ${response.status} - ${response.statusText}`
@@ -263,6 +275,11 @@ var audioContent = async (input) => {
         }
         rawData = Buffer.from(await response.arrayBuffer());
       } catch (error) {
+        if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
+          throw new Error(
+            `Failed to fetch audio from URL (${input.url}): timed out after ${timeoutMs}ms`
+          );
+        }
         throw new Error(
           `Failed to fetch audio from URL (${input.url}): ${error instanceof Error ? error.message : String(error)}`
         );
@@ -1445,6 +1462,7 @@ function parseBasicAuthHeader(authHeader) {
     return null;
   }
 }
+var OAUTH_PROXY_MAX_BODY_SIZE = 1024 * 1024;
 function stripBasePath(path, basePath) {
   if (!basePath) {
     return path;
@@ -2219,11 +2237,47 @@ var FastMCP = class extends FastMCPEventEmitter {
       try {
         if (req.method === "POST" && oauthPath === "/oauth/register") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
-                const request = JSON.parse(body);
+                const request = JSON.parse(
+                  Buffer.concat(bodyChunks).toString("utf8")
+                );
                 const response = await oauthProxy.registerClient(request);
                 res.writeHead(201, { "Content-Type": "application/json" }).end(JSON.stringify(response));
               } catch (error) {
@@ -2289,14 +2343,48 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
         if (req.method === "POST" && oauthPath === "/oauth/consent") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
                 const mockRequest = new Request(
                   `http://${host}${url2.pathname}${url2.search}`,
                   {
-                    body,
+                    body: Buffer.concat(bodyChunks).toString("utf8"),
                     headers: {
                       "Content-Type": "application/x-www-form-urlencoded"
                     },
@@ -2327,11 +2415,47 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
         if (req.method === "POST" && oauthPath === "/oauth/token") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
-                const params = new URLSearchParams(body);
+                const params = new URLSearchParams(
+                  Buffer.concat(bodyChunks).toString("utf8")
+                );
                 const grantType = params.get("grant_type");
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
@@ -2520,6 +2644,7 @@ var FastMCP = class extends FastMCPEventEmitter {
 export {
   DiscoveryDocumentCache,
   jsonSchemaAdapter,
+  MEDIA_FETCH_TIMEOUT_MS,
   imageContent,
   audioContent,
   FastMCPError,
@@ -2530,4 +2655,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-5K4GLQMV.js.map
+//# sourceMappingURL=chunk-HIIPZVNY.js.map