fastmcp 4.21.1 → 4.21.2

package/README.md

@@ -633,10 +633,12 @@ server.addTool({
 
 Works for `outputSchema` too. Note that FastMCP advertises input schemas with
 `additionalProperties: false`, whatever your schema said — the same treatment
-Zod and Valibot schemas get. The exception is a dictionary (an object with no
-`properties` and an `additionalProperties` schema, like `z.record()`), which
-keeps its value schema. Output schemas keep whatever additional-properties
-rule your schema declared.
+Zod and Valibot schemas get. The exception is an object made only of
+additional properties: a dictionary (no `properties` and an
+`additionalProperties` schema, like `z.record()`) keeps its value schema, and a
+free-form argument (`{ type: "object" }`, or `additionalProperties: true`)
+stays open. Output schemas keep whatever additional-properties rule your schema
+declared.
 
 Unlike the schema libraries above, a plain JSON Schema carries no TypeScript
 types, so `execute` receives `unknown` arguments. Cast or narrow them yourself.
@@ -750,6 +752,11 @@ server.addTool({
 });
 ```
 
+A server without an `authenticate` function has no auth to check, so every
+session sees every tool. With one, a session that still ends up without auth —
+on stdio, where the server carries on when `authenticate` throws or returns
+nothing — sees none of the tools that have `canAccess`.
+
 #### Returning a string
 
 `execute` can return a string:

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkIKH7YBYPcjs = require('./chunk-IKH7YBYP.cjs');
+var _chunkC5VOVQPCcjs = require('./chunk-C5VOVQPC.cjs');
 
 
 
@@ -25,6 +25,7 @@ var _chunkIKH7YBYPcjs = require('./chunk-IKH7YBYP.cjs');
 
 
 var _chunkGTPK7A57cjs = require('./chunk-GTPK7A57.cjs');
+require('./chunk-O22SYZMC.cjs');
 
 
 
@@ -49,5 +50,5 @@ var _chunkGTPK7A57cjs = require('./chunk-GTPK7A57.cjs');
 
 
 
-exports.AuthProvider = _chunkGTPK7A57cjs.AuthProvider; exports.AzureProvider = _chunkGTPK7A57cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkIKH7YBYPcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkIKH7YBYPcjs.FastMCP; exports.FastMCPError = _chunkIKH7YBYPcjs.FastMCPError; exports.FastMCPSession = _chunkIKH7YBYPcjs.FastMCPSession; exports.GitHubProvider = _chunkGTPK7A57cjs.GitHubProvider; exports.GoogleProvider = _chunkGTPK7A57cjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkIKH7YBYPcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkGTPK7A57cjs.OAuthProvider; exports.ServerState = _chunkIKH7YBYPcjs.ServerState; exports.SessionError = _chunkIKH7YBYPcjs.SessionError; exports.UnexpectedStateError = _chunkIKH7YBYPcjs.UnexpectedStateError; exports.UserError = _chunkIKH7YBYPcjs.UserError; exports.audioContent = _chunkIKH7YBYPcjs.audioContent; exports.getAuthSession = _chunkGTPK7A57cjs.getAuthSession; exports.imageContent = _chunkIKH7YBYPcjs.imageContent; exports.jsonSchemaAdapter = _chunkIKH7YBYPcjs.jsonSchemaAdapter; exports.requireAll = _chunkGTPK7A57cjs.requireAll; exports.requireAny = _chunkGTPK7A57cjs.requireAny; exports.requireAuth = _chunkGTPK7A57cjs.requireAuth; exports.requireRole = _chunkGTPK7A57cjs.requireRole; exports.requireScopes = _chunkGTPK7A57cjs.requireScopes;
+exports.AuthProvider = _chunkGTPK7A57cjs.AuthProvider; exports.AzureProvider = _chunkGTPK7A57cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkC5VOVQPCcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkC5VOVQPCcjs.FastMCP; exports.FastMCPError = _chunkC5VOVQPCcjs.FastMCPError; exports.FastMCPSession = _chunkC5VOVQPCcjs.FastMCPSession; exports.GitHubProvider = _chunkGTPK7A57cjs.GitHubProvider; exports.GoogleProvider = _chunkGTPK7A57cjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkC5VOVQPCcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkGTPK7A57cjs.OAuthProvider; exports.ServerState = _chunkC5VOVQPCcjs.ServerState; exports.SessionError = _chunkC5VOVQPCcjs.SessionError; exports.UnexpectedStateError = _chunkC5VOVQPCcjs.UnexpectedStateError; exports.UserError = _chunkC5VOVQPCcjs.UserError; exports.audioContent = _chunkC5VOVQPCcjs.audioContent; exports.getAuthSession = _chunkGTPK7A57cjs.getAuthSession; exports.imageContent = _chunkC5VOVQPCcjs.imageContent; exports.jsonSchemaAdapter = _chunkC5VOVQPCcjs.jsonSchemaAdapter; exports.requireAll = _chunkGTPK7A57cjs.requireAll; exports.requireAny = _chunkGTPK7A57cjs.requireAny; exports.requireAuth = _chunkGTPK7A57cjs.requireAuth; exports.requireRole = _chunkGTPK7A57cjs.requireRole; exports.requireScopes = _chunkGTPK7A57cjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,0yCAAC","file":"/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"}
+{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B,gCAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,0yCAAC","file":"/home/runner/work/fastmcp/fastmcp/dist/FastMCP.cjs"}

package/dist/FastMCP.d.cts

@@ -916,8 +916,14 @@ declare class FastMCPSession<T extends FastMCPSessionAuth = FastMCPSessionAuth>
      */
     get sessionId(): string | undefined;
     set sessionId(value: string | undefined);
-    constructor({ auth, hasTools, icons, instructions, logger, name, onToolCall, ping, prompts, resources, resourcesTemplates, roots, sessionId, stateless, streamKeepalive, title, tools, transportType, utils, version, websiteUrl, }: {
+    constructor({ auth, authRequired, hasTools, icons, instructions, logger, name, onToolCall, ping, prompts, resources, resourcesTemplates, roots, sessionId, stateless, streamKeepalive, title, tools, transportType, utils, version, websiteUrl, }: {
         auth?: T;
+        /**
+         * Whether the server authenticates its sessions (`authenticate` is
+         * configured). A session that has no auth even so sees none of the tools
+         * gated by `canAccess` (see `toolsVisibleTo`).
+         */
+        authRequired?: boolean;
         /**
          * Whether the server has any tools at all, including ones this session's
          * `canAccess` filtering removed from `tools`. Defaults to `tools.length > 0`.

package/dist/FastMCP.d.ts

@@ -916,8 +916,14 @@ declare class FastMCPSession<T extends FastMCPSessionAuth = FastMCPSessionAuth>
      */
     get sessionId(): string | undefined;
     set sessionId(value: string | undefined);
-    constructor({ auth, hasTools, icons, instructions, logger, name, onToolCall, ping, prompts, resources, resourcesTemplates, roots, sessionId, stateless, streamKeepalive, title, tools, transportType, utils, version, websiteUrl, }: {
+    constructor({ auth, authRequired, hasTools, icons, instructions, logger, name, onToolCall, ping, prompts, resources, resourcesTemplates, roots, sessionId, stateless, streamKeepalive, title, tools, transportType, utils, version, websiteUrl, }: {
         auth?: T;
+        /**
+         * Whether the server authenticates its sessions (`authenticate` is
+         * configured). A session that has no auth even so sees none of the tools
+         * gated by `canAccess` (see `toolsVisibleTo`).
+         */
+        authRequired?: boolean;
         /**
          * Whether the server has any tools at all, including ones this session's
          * `canAccess` filtering removed from `tools`. Defaults to `tools.length > 0`.

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-JNP6BG5L.js";
+} from "./chunk-QMRS4ZLD.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -25,6 +25,7 @@ import {
   requireRole,
   requireScopes
 } from "./chunk-AR3LVWUF.js";
+import "./chunk-UMDUIBFW.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-IKH7YBYP.cjs → chunk-C5VOVQPC.cjs}

@@ -2,6 +2,9 @@
 
 var _chunkGTPK7A57cjs = require('./chunk-GTPK7A57.cjs');
 
+
+var _chunkO22SYZMCcjs = require('./chunk-O22SYZMC.cjs');
+
 // src/FastMCP.ts
 var _indexjs = require('@modelcontextprotocol/sdk/server/index.js');
 var _stdiojs = require('@modelcontextprotocol/sdk/server/stdio.js');
@@ -376,21 +379,6 @@ function assertToolSchemas(tool) {
     assertStandardSchema(tool.name, "outputSchema", tool.outputSchema);
   }
 }
-function strictInputSchema(schema) {
-  const isDictionary = typeof schema.additionalProperties === "object" && Object.keys(_nullishCoalesce(schema.properties, () => ( {}))).length === 0;
-  return {
-    ...schema,
-    additionalProperties: isDictionary ? schema.additionalProperties : false,
-    ...schema.properties && {
-      properties: Object.fromEntries(
-        Object.entries(schema.properties).map(([key, value]) => [
-          key,
-          typeof value === "object" && value.type === "object" ? strictInputSchema(value) : value
-        ])
-      )
-    }
-  };
-}
 var STREAM_KEEPALIVE_LOGGER = "fastmcp-keepalive";
 var STREAM_KEEPALIVE_DEFAULT_INTERVAL_MS = 2e4;
 var TextContentZodSchema = _zod.z.object({
@@ -537,6 +525,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
    */
   #abortController = new AbortController();
   #auth;
+  #authRequired;
   #capabilities = {};
   #clientCapabilities;
   #connectionState = "connecting";
@@ -575,6 +564,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
   #utils;
   constructor({
     auth,
+    authRequired = false,
     hasTools,
     icons,
     instructions,
@@ -598,6 +588,7 @@ var FastMCPSession = class extends FastMCPSessionEventEmitter {
   }) {
     super();
     this.#auth = auth;
+    this.#authRequired = authRequired;
     this.#logger = logger;
     this.#onToolCall = onToolCall;
     this.#pingConfig = ping;
@@ -804,7 +795,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
     }
   }
   toolsListChanged(tools) {
-    this.setupToolHandlers(toolsVisibleTo(tools, this.#auth));
+    this.setupToolHandlers(
+      toolsVisibleTo(tools, this.#auth, this.#authRequired)
+    );
     this.triggerListChangedNotification("notifications/tools/list_changed");
   }
   async triggerListChangedNotification(method) {
@@ -1067,9 +1060,10 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
         const ref = request.params.ref;
         const prompt = "name" in ref && this.#prompts.get(ref.name);
         if (!prompt) {
-          throw new UnexpectedStateError("Unknown prompt", {
-            request
-          });
+          throw new (0, _typesjs.McpError)(
+            _typesjs.ErrorCode.InvalidParams,
+            `Unknown prompt: ${ref.name}`
+          );
         }
         if (!prompt.complete) {
           throw new UnexpectedStateError("Prompt does not support completion", {
@@ -1095,9 +1089,10 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
           (resource2) => resource2.uriTemplate === ref.uri
         );
         if (!resource) {
-          throw new UnexpectedStateError("Unknown resource", {
-            request
-          });
+          throw new (0, _typesjs.McpError)(
+            _typesjs.ErrorCode.InvalidParams,
+            `Unknown resource template: ${ref.uri}`
+          );
         }
         if (!("uriTemplate" in resource)) {
           throw new UnexpectedStateError("Unexpected resource");
@@ -1387,7 +1382,7 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
           return {
             annotations: tool.annotations,
             description: tool.description,
-            inputSchema: tool.parameters ? strictInputSchema(await _xsschema.toJsonSchema.call(void 0, tool.parameters)) : {
+            inputSchema: tool.parameters ? _chunkO22SYZMCcjs.strictInputSchema.call(void 0, await _xsschema.toJsonSchema.call(void 0, tool.parameters)) : {
               additionalProperties: false,
               properties: {},
               type: "object"
@@ -1645,8 +1640,13 @@ function stripBasePath(path, basePath) {
   }
   return null;
 }
-function toolsVisibleTo(tools, auth) {
-  return auth ? tools.filter((tool) => tool.canAccess ? tool.canAccess(auth) : true) : tools;
+function toolsVisibleTo(tools, auth, authRequired) {
+  if (auth) {
+    return tools.filter(
+      (tool) => tool.canAccess ? tool.canAccess(auth) : true
+    );
+  }
+  return authRequired ? tools.filter((tool) => !tool.canAccess) : tools;
 }
 var FastMCPEventEmitterBase = _events.EventEmitter;
 var FastMCPEventEmitter = class extends FastMCPEventEmitterBase {
@@ -2027,6 +2027,7 @@ var FastMCP = class extends FastMCPEventEmitter {
     if (config.transportType === "stdio") {
       const transport = new (0, _stdiojs.StdioServerTransport)();
       let auth;
+      const authRequired = this.#authenticate !== void 0;
       if (this.#authenticate) {
         try {
           auth = await _asyncNullishCoalesce(await this.#authenticate(
@@ -2038,9 +2039,15 @@ var FastMCP = class extends FastMCPEventEmitter {
             error instanceof Error ? error.message : String(error)
           );
         }
+        if (!auth && this.#tools.some((tool) => tool.canAccess)) {
+          this.#logger.warn(
+            "[FastMCP warning] The stdio session has no auth, so tools gated by canAccess are hidden from it."
+          );
+        }
       }
       const session = new FastMCPSession({
         auth,
+        authRequired,
         hasTools: this.#tools.length > 0,
         icons: this.#options.icons,
         instructions: this.#options.instructions,
@@ -2054,7 +2061,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         roots: this.#options.roots,
         streamKeepalive: this.#options.streamKeepalive,
         title: this.#options.title,
-        tools: toolsVisibleTo(this.#tools, auth),
+        tools: toolsVisibleTo(this.#tools, auth, authRequired),
         transportType: "stdio",
         utils: this.#options.utils,
         version: this.#options.version,
@@ -2224,8 +2231,10 @@ var FastMCP = class extends FastMCPEventEmitter {
       const errorMessage = "error" in auth && typeof auth.error === "string" ? auth.error : "Authentication failed";
       throw this.#createUnauthorizedResponse(errorMessage);
     }
+    const authRequired = this.#authenticate !== void 0;
     return new FastMCPSession({
       auth,
+      authRequired,
       hasTools: this.#tools.length > 0,
       icons: this.#options.icons,
       instructions: this.#options.instructions,
@@ -2241,7 +2250,7 @@ var FastMCP = class extends FastMCPEventEmitter {
       stateless,
       streamKeepalive: this.#options.streamKeepalive,
       title: this.#options.title,
-      tools: toolsVisibleTo(this.#tools, auth),
+      tools: toolsVisibleTo(this.#tools, auth, authRequired),
       transportType: "httpStream",
       utils: this.#options.utils,
       version: this.#options.version,
@@ -2937,4 +2946,4 @@ var FastMCP = class extends FastMCPEventEmitter {
 
 
 exports.DiscoveryDocumentCache = DiscoveryDocumentCache; exports.jsonSchemaAdapter = jsonSchemaAdapter; exports.MEDIA_FETCH_TIMEOUT_MS = MEDIA_FETCH_TIMEOUT_MS; exports.imageContent = imageContent; exports.audioContent = audioContent; exports.FastMCPError = FastMCPError; exports.SessionError = SessionError; exports.UnexpectedStateError = UnexpectedStateError; exports.UserError = UserError; exports.ServerState = ServerState; exports.FastMCPSession = FastMCPSession; exports.FastMCP = FastMCP;
-//# sourceMappingURL=chunk-IKH7YBYP.cjs.map
+//# sourceMappingURL=chunk-C5VOVQPC.cjs.map