fastmcp 4.8.1 → 4.9.1

package/README.md

@@ -1951,14 +1951,9 @@ const server = new FastMCP({
 FastMCP also supports OAuth discovery endpoints for direct integration with OAuth providers, supporting both **MCP Specification 2025-03-26** and **MCP Specification 2025-06-18**. This provides standard discovery endpoints that comply with RFC 8414 (OAuth 2.0 Authorization Server Metadata) and RFC 9470 (OAuth 2.0 Protected Resource Metadata):
 
 ```ts
-import { FastMCP, DiscoveryDocumentCache } from "fastmcp";
-import { buildGetJwks } from "get-jwks";
-import fastJwt from "fast-jwt";
-
-// Create a cache for discovery documents (reuse across requests)
-const discoveryCache = new DiscoveryDocumentCache({
-  ttl: 3600000, // Cache for 1 hour (default)
-});
+import { FastMCP } from "fastmcp";
+import buildGetJwks from "get-jwks";
+import fastJwt, { type DecodedJwt } from "fast-jwt";
 
 const server = new FastMCP({
   name: "My Server",
@@ -1991,39 +1986,20 @@ const server = new FastMCP({
 
     // Validate OAuth JWT access token using OpenID Connect discovery
     try {
-      // Fetch and cache the discovery document
-      const discoveryUrl =
-        "https://auth.example.com/.well-known/openid-configuration";
-      // Alternative: Use OAuth authorization server metadata endpoint
-      // const discoveryUrl = 'https://auth.example.com/.well-known/oauth-authorization-server';
-
-      const config = (await discoveryCache.get(discoveryUrl)) as {
-        jwks_uri: string;
-        issuer: string;
-      };
-      const jwksUri = config.jwks_uri;
-      const issuer = config.issuer;
-
-      // Create JWKS client for token verification using discovered endpoint
-      const getJwks = buildGetJwks({
-        jwksUrl: jwksUri,
-        cache: true,
-        rateLimit: true,
-      });
+      // Create JWKS client for token verification
+      const getJwks = buildGetJwks();
 
-      // Create JWT verifier with JWKS and discovered issuer
+      // Create JWT verifier
       const verify = fastJwt.createVerifier({
-        key: async (token) => {
-          const { header } = fastJwt.decode(token, { complete: true });
-          const jwk = await getJwks.getJwk({
+        async key({ header }: DecodedJwt) {
+          const publicKey = await getJwks.getPublicKey({
             kid: header.kid,
             alg: header.alg,
+            domain: "https://auth.example.com",
           });
-          return jwk;
+          return publicKey;
         },
-        algorithms: ["RS256", "ES256"],
-        issuer: issuer,
-        audience: "mcp://my-server",
+        algorithms: ["RS256"],
       });
 
       // Verify the JWT token
@@ -2081,7 +2057,7 @@ Clients discover protected resource metadata using the following search order:
 
 Both the sub-path and root endpoints return identical metadata, ensuring compatibility with all MCP client implementations.
 
-For JWT token validation, you can use libraries like [`get-jwks`](https://github.com/nearform/get-jwks) and [`@fastify/jwt`](https://github.com/fastify/fastify-jwt) for OAuth JWT tokens.
+For JWT token validation, you can use libraries like [`get-jwks`](https://github.com/nearform/get-jwks) and [`fast-jwt`](https://github.com/nearform/fast-jwt) for OAuth JWT tokens.
 
 #### Passing Headers Through Context
 
@@ -2471,6 +2447,14 @@ npx fastmcp dev server.ts
 
 This will run your server with [`mcp-cli`](https://github.com/wong2/mcp-cli) for testing and debugging your MCP server in the terminal.
 
+To call a tool non-interactively (for example, in scripts or automated tests), pass `--tool` and optional JSON `--args`:
+
+```bash
+npx fastmcp dev server.ts --tool add --args '{"a":1,"b":2}'
+```
+
+This prints the tool result as JSON and exits, instead of opening the interactive inspector. `--watch` has no effect in this mode, since the server is started for a single call.
+
 ### Inspect with `MCP Inspector`
 
 Another way is to use the official [`MCP Inspector`](https://modelcontextprotocol.io/docs/tools/inspector) to inspect your server with a Web UI:

package/dist/FastMCP.cjs

@@ -20,7 +20,7 @@ var _chunkMJCWKCHZcjs = require('./chunk-MJCWKCHZ.cjs');
 
 
 
-var _chunkIX3HKAX4cjs = require('./chunk-IX3HKAX4.cjs');
+var _chunkDZYT6QAHcjs = require('./chunk-DZYT6QAH.cjs');
 
 
 
@@ -41,5 +41,5 @@ var _chunkIX3HKAX4cjs = require('./chunk-IX3HKAX4.cjs');
 
 
 
-exports.AuthProvider = _chunkIX3HKAX4cjs.AuthProvider; exports.AzureProvider = _chunkIX3HKAX4cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkMJCWKCHZcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkMJCWKCHZcjs.FastMCP; exports.FastMCPSession = _chunkMJCWKCHZcjs.FastMCPSession; exports.GitHubProvider = _chunkIX3HKAX4cjs.GitHubProvider; exports.GoogleProvider = _chunkIX3HKAX4cjs.GoogleProvider; exports.OAuthProvider = _chunkIX3HKAX4cjs.OAuthProvider; exports.ServerState = _chunkMJCWKCHZcjs.ServerState; exports.UnexpectedStateError = _chunkMJCWKCHZcjs.UnexpectedStateError; exports.UserError = _chunkMJCWKCHZcjs.UserError; exports.audioContent = _chunkMJCWKCHZcjs.audioContent; exports.getAuthSession = _chunkIX3HKAX4cjs.getAuthSession; exports.imageContent = _chunkMJCWKCHZcjs.imageContent; exports.requireAll = _chunkIX3HKAX4cjs.requireAll; exports.requireAny = _chunkIX3HKAX4cjs.requireAny; exports.requireAuth = _chunkIX3HKAX4cjs.requireAuth; exports.requireRole = _chunkIX3HKAX4cjs.requireRole; exports.requireScopes = _chunkIX3HKAX4cjs.requireScopes;
+exports.AuthProvider = _chunkDZYT6QAHcjs.AuthProvider; exports.AzureProvider = _chunkDZYT6QAHcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkMJCWKCHZcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkMJCWKCHZcjs.FastMCP; exports.FastMCPSession = _chunkMJCWKCHZcjs.FastMCPSession; exports.GitHubProvider = _chunkDZYT6QAHcjs.GitHubProvider; exports.GoogleProvider = _chunkDZYT6QAHcjs.GoogleProvider; exports.OAuthProvider = _chunkDZYT6QAHcjs.OAuthProvider; exports.ServerState = _chunkMJCWKCHZcjs.ServerState; exports.UnexpectedStateError = _chunkMJCWKCHZcjs.UnexpectedStateError; exports.UserError = _chunkMJCWKCHZcjs.UserError; exports.audioContent = _chunkMJCWKCHZcjs.audioContent; exports.getAuthSession = _chunkDZYT6QAHcjs.getAuthSession; exports.imageContent = _chunkMJCWKCHZcjs.imageContent; exports.requireAll = _chunkDZYT6QAHcjs.requireAll; exports.requireAny = _chunkDZYT6QAHcjs.requireAny; exports.requireAuth = _chunkDZYT6QAHcjs.requireAuth; exports.requireRole = _chunkDZYT6QAHcjs.requireRole; exports.requireScopes = _chunkDZYT6QAHcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-vyjR-9Z7.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-vyjR-9Z7.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BNqoBTYA.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BNqoBTYA.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-vyjR-9Z7.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-vyjR-9Z7.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BNqoBTYA.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BNqoBTYA.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -20,7 +20,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-OJG4XYXA.js";
+} from "./chunk-GM44BOI7.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-vyjR-9Z7.d.cts → OAuthProvider-BNqoBTYA.d.cts}

@@ -382,6 +382,21 @@ interface TokenStorage {
     get(key: string): Promise<null | unknown>;
     /** Save a value with optional TTL */
     save(key: string, value: unknown, ttl?: number): Promise<void>;
+    /**
+     * Atomically retrieve a value and delete it, returning `null` if the key was
+     * absent. At most one caller may observe a given value.
+     *
+     * Optional, but **required for correctness when more than one process shares
+     * this storage**: the OAuth proxy consumes authorization codes and
+     * transactions through it, and single-use enforcement depends on the
+     * atomicity. Without it the proxy falls back to a non-atomic get + delete,
+     * where two concurrent requests can both redeem the same authorization code.
+     *
+     * Most backends expose a suitable primitive: Redis `GETDEL`, DynamoDB
+     * `DeleteItem` with `ReturnValues: "ALL_OLD"`, or SQL
+     * `DELETE ... RETURNING *`.
+     */
+    take?(key: string): Promise<null | unknown>;
 }
 /**
  * Token verification result
@@ -431,16 +446,18 @@ interface UpstreamTokenSet {
 declare class OAuthProxy {
     private claimsExtractor;
     private cleanupInterval;
-    private clientCodes;
     private config;
     private consentManager;
     private jwtIssuer?;
-    /** Keyed by redirect_uri for defence-in-depth checks in handleCallback/handleConsent */
-    private registeredClients;
-    /** Keyed by proxy-issued client_id for authorize/token-exchange lookups */
+    /**
+     * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
+     * for the defence-in-depth callback checks. A registration never changes
+     * after it is written, so caching it locally cannot go stale; it is also
+     * persisted, so another instance can hydrate it.
+     */
     private registeredClientsByClientId;
+    private stateStore;
     private tokenStorage;
-    private transactions;
     constructor(config: OAuthProxyConfig);
     /**
      * OAuth authorization endpoint
@@ -503,7 +520,7 @@ declare class OAuthProxy {
      */
     private calculateAccessTokenTtl;
     /**
-     * Clean up expired transactions and codes
+     * Periodic maintenance hook. Expiry is enforced by the token storage.
      */
     private cleanup;
     /**

package/dist/{OAuthProvider-vyjR-9Z7.d.ts → OAuthProvider-BNqoBTYA.d.ts}

@@ -382,6 +382,21 @@ interface TokenStorage {
     get(key: string): Promise<null | unknown>;
     /** Save a value with optional TTL */
     save(key: string, value: unknown, ttl?: number): Promise<void>;
+    /**
+     * Atomically retrieve a value and delete it, returning `null` if the key was
+     * absent. At most one caller may observe a given value.
+     *
+     * Optional, but **required for correctness when more than one process shares
+     * this storage**: the OAuth proxy consumes authorization codes and
+     * transactions through it, and single-use enforcement depends on the
+     * atomicity. Without it the proxy falls back to a non-atomic get + delete,
+     * where two concurrent requests can both redeem the same authorization code.
+     *
+     * Most backends expose a suitable primitive: Redis `GETDEL`, DynamoDB
+     * `DeleteItem` with `ReturnValues: "ALL_OLD"`, or SQL
+     * `DELETE ... RETURNING *`.
+     */
+    take?(key: string): Promise<null | unknown>;
 }
 /**
  * Token verification result
@@ -431,16 +446,18 @@ interface UpstreamTokenSet {
 declare class OAuthProxy {
     private claimsExtractor;
     private cleanupInterval;
-    private clientCodes;
     private config;
     private consentManager;
     private jwtIssuer?;
-    /** Keyed by redirect_uri for defence-in-depth checks in handleCallback/handleConsent */
-    private registeredClients;
-    /** Keyed by proxy-issued client_id for authorize/token-exchange lookups */
+    /**
+     * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
+     * for the defence-in-depth callback checks. A registration never changes
+     * after it is written, so caching it locally cannot go stale; it is also
+     * persisted, so another instance can hydrate it.
+     */
     private registeredClientsByClientId;
+    private stateStore;
     private tokenStorage;
-    private transactions;
     constructor(config: OAuthProxyConfig);
     /**
      * OAuth authorization endpoint
@@ -503,7 +520,7 @@ declare class OAuthProxy {
      */
     private calculateAccessTokenTtl;
     /**
-     * Clean up expired transactions and codes
+     * Periodic maintenance hook. Expiry is enforced by the token storage.
      */
     private cleanup;
     /**

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkIX3HKAX4cjs = require('../chunk-IX3HKAX4.cjs');
+var _chunkDZYT6QAHcjs = require('../chunk-DZYT6QAH.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkIX3HKAX4cjs = require('../chunk-IX3HKAX4.cjs');
 
 
 
-exports.AuthProvider = _chunkIX3HKAX4cjs.AuthProvider; exports.AzureProvider = _chunkIX3HKAX4cjs.AzureProvider; exports.ConsentManager = _chunkIX3HKAX4cjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkIX3HKAX4cjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkIX3HKAX4cjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkIX3HKAX4cjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkIX3HKAX4cjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkIX3HKAX4cjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkIX3HKAX4cjs.DiskStore; exports.EncryptedTokenStorage = _chunkIX3HKAX4cjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkIX3HKAX4cjs.GitHubProvider; exports.GoogleProvider = _chunkIX3HKAX4cjs.GoogleProvider; exports.JWKSVerifier = _chunkIX3HKAX4cjs.JWKSVerifier; exports.JWTIssuer = _chunkIX3HKAX4cjs.JWTIssuer; exports.MemoryTokenStorage = _chunkIX3HKAX4cjs.MemoryTokenStorage; exports.OAuthProvider = _chunkIX3HKAX4cjs.OAuthProvider; exports.OAuthProxy = _chunkIX3HKAX4cjs.OAuthProxy; exports.OAuthProxyError = _chunkIX3HKAX4cjs.OAuthProxyError; exports.PKCEUtils = _chunkIX3HKAX4cjs.PKCEUtils; exports.getAuthSession = _chunkIX3HKAX4cjs.getAuthSession; exports.requireAll = _chunkIX3HKAX4cjs.requireAll; exports.requireAny = _chunkIX3HKAX4cjs.requireAny; exports.requireAuth = _chunkIX3HKAX4cjs.requireAuth; exports.requireRole = _chunkIX3HKAX4cjs.requireRole; exports.requireScopes = _chunkIX3HKAX4cjs.requireScopes;
+exports.AuthProvider = _chunkDZYT6QAHcjs.AuthProvider; exports.AzureProvider = _chunkDZYT6QAHcjs.AzureProvider; exports.ConsentManager = _chunkDZYT6QAHcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkDZYT6QAHcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkDZYT6QAHcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkDZYT6QAHcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkDZYT6QAHcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkDZYT6QAHcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkDZYT6QAHcjs.DiskStore; exports.EncryptedTokenStorage = _chunkDZYT6QAHcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkDZYT6QAHcjs.GitHubProvider; exports.GoogleProvider = _chunkDZYT6QAHcjs.GoogleProvider; exports.JWKSVerifier = _chunkDZYT6QAHcjs.JWKSVerifier; exports.JWTIssuer = _chunkDZYT6QAHcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkDZYT6QAHcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkDZYT6QAHcjs.OAuthProvider; exports.OAuthProxy = _chunkDZYT6QAHcjs.OAuthProxy; exports.OAuthProxyError = _chunkDZYT6QAHcjs.OAuthProxyError; exports.PKCEUtils = _chunkDZYT6QAHcjs.PKCEUtils; exports.getAuthSession = _chunkDZYT6QAHcjs.getAuthSession; exports.requireAll = _chunkDZYT6QAHcjs.requireAll; exports.requireAny = _chunkDZYT6QAHcjs.requireAny; exports.requireAuth = _chunkDZYT6QAHcjs.requireAuth; exports.requireRole = _chunkDZYT6QAHcjs.requireRole; exports.requireScopes = _chunkDZYT6QAHcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-vyjR-9Z7.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-vyjR-9Z7.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BNqoBTYA.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BNqoBTYA.cjs';
 import 'node:http';
 
 /**
@@ -101,6 +101,15 @@ declare class DiskStore implements TokenStorage {
      * Get the number of stored items
      */
     size(): Promise<number>;
+    /**
+     * Atomically retrieve a value and delete it.
+     *
+     * rename() is atomic on POSIX filesystems, so when several processes race
+     * for the same key exactly one rename succeeds and the losers see ENOENT.
+     * That is what makes single-use authorization codes safe when more than one
+     * process shares the directory.
+     */
+    take(key: string): Promise<null | unknown>;
     /**
      * Ensure storage directory exists
      */
@@ -376,7 +385,13 @@ declare class EncryptedTokenStorage implements TokenStorage {
     delete(key: string): Promise<void>;
     get(key: string): Promise<null | unknown>;
     save(key: string, value: unknown, ttl?: number): Promise<void>;
+    /**
+     * Delegates to the backend so that the atomicity of the underlying store is
+     * preserved; falls back to get + delete when the backend cannot do better.
+     */
+    take(key: string): Promise<null | unknown>;
     private decrypt;
+    private decryptStored;
     private encrypt;
 }
 /**
@@ -398,6 +413,11 @@ declare class MemoryTokenStorage implements TokenStorage {
      * Get the number of stored items
      */
     size(): number;
+    /**
+     * Atomic by construction: the read and the delete happen in a single
+     * synchronous block, so no other task can observe the value in between.
+     */
+    take(key: string): Promise<null | unknown>;
 }
 
 export { ConsentData, ConsentManager, DiskStore, EncryptedTokenStorage, type JWKSVerificationResult, JWKSVerifier, type JWKSVerifierConfig, type JWTClaims, JWTIssuer, MemoryTokenStorage, OAuthTransaction, PKCEPair, PKCEUtils, TokenStorage, TokenVerificationResult, TokenVerifier };

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-vyjR-9Z7.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-vyjR-9Z7.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BNqoBTYA.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BNqoBTYA.js';
 import 'node:http';
 
 /**
@@ -101,6 +101,15 @@ declare class DiskStore implements TokenStorage {
      * Get the number of stored items
      */
     size(): Promise<number>;
+    /**
+     * Atomically retrieve a value and delete it.
+     *
+     * rename() is atomic on POSIX filesystems, so when several processes race
+     * for the same key exactly one rename succeeds and the losers see ENOENT.
+     * That is what makes single-use authorization codes safe when more than one
+     * process shares the directory.
+     */
+    take(key: string): Promise<null | unknown>;
     /**
      * Ensure storage directory exists
      */
@@ -376,7 +385,13 @@ declare class EncryptedTokenStorage implements TokenStorage {
     delete(key: string): Promise<void>;
     get(key: string): Promise<null | unknown>;
     save(key: string, value: unknown, ttl?: number): Promise<void>;
+    /**
+     * Delegates to the backend so that the atomicity of the underlying store is
+     * preserved; falls back to get + delete when the backend cannot do better.
+     */
+    take(key: string): Promise<null | unknown>;
     private decrypt;
+    private decryptStored;
     private encrypt;
 }
 /**
@@ -398,6 +413,11 @@ declare class MemoryTokenStorage implements TokenStorage {
      * Get the number of stored items
      */
     size(): number;
+    /**
+     * Atomic by construction: the read and the delete happen in a single
+     * synchronous block, so no other task can observe the value in between.
+     */
+    take(key: string): Promise<null | unknown>;
 }
 
 export { ConsentData, ConsentManager, DiskStore, EncryptedTokenStorage, type JWKSVerificationResult, JWKSVerifier, type JWKSVerifierConfig, type JWTClaims, JWTIssuer, MemoryTokenStorage, OAuthTransaction, PKCEPair, PKCEUtils, TokenStorage, TokenVerificationResult, TokenVerifier };

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-OJG4XYXA.js";
+} from "../chunk-GM44BOI7.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/bin/fastmcp.cjs

@@ -2,8 +2,55 @@
 "use strict"; function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 // src/bin/fastmcp.ts
 var _execa = require('execa');
+var _promises = require('fs/promises');
+var _os = require('os');
+var _path = require('path');
 var _yargs = require('yargs'); var _yargs2 = _interopRequireDefault(_yargs);
 var _helpers = require('yargs/helpers');
+
+// src/bin/devCommand.ts
+var DEV_SERVER_NAME = "dev";
+var buildDevConfig = (file) => JSON.stringify(
+  {
+    mcpServers: {
+      [DEV_SERVER_NAME]: {
+        args: ["tsx", file],
+        command: "npx"
+      }
+    }
+  },
+  null,
+  2
+);
+var buildDevCommand = (options) => {
+  const { configPath, file, tool, toolArgs, watch = false } = options;
+  if (tool) {
+    if (!configPath) {
+      throw new Error(
+        "configPath is required when calling a tool non-interactively"
+      );
+    }
+    return [
+      "npx",
+      "@wong2/mcp-cli",
+      "-c",
+      configPath,
+      "call-tool",
+      `${DEV_SERVER_NAME}:${tool}`,
+      ...toolArgs === void 0 ? [] : ["--args", toolArgs]
+    ];
+  }
+  return [
+    "npx",
+    "@wong2/mcp-cli",
+    "npx",
+    "tsx",
+    ...watch ? ["--watch"] : [],
+    file
+  ];
+};
+
+// src/bin/fastmcp.ts
 await _yargs2.default.call(void 0, _helpers.hideBin.call(void 0, process.argv)).scriptName("fastmcp").command(
   "dev <file>",
   "Start a development server",
@@ -12,6 +59,13 @@ await _yargs2.default.call(void 0, _helpers.hideBin.call(void 0, process.argv)).
       demandOption: true,
       describe: "The path to the server file",
       type: "string"
+    }).option("args", {
+      describe: `JSON arguments passed to the tool (requires --tool), e.g. '{"a":1}'`,
+      type: "string"
+    }).option("tool", {
+      alias: "t",
+      describe: "Call a tool non-interactively instead of launching the inspector",
+      type: "string"
     }).option("watch", {
       alias: "w",
       default: false,
@@ -25,21 +79,48 @@ await _yargs2.default.call(void 0, _helpers.hideBin.call(void 0, process.argv)).
     });
   },
   async (argv) => {
+    let configDir;
     try {
-      const command = argv.watch ? `npx @wong2/mcp-cli npx tsx --watch ${argv.file}` : `npx @wong2/mcp-cli npx tsx ${argv.file}`;
+      if (argv.args !== void 0 && !argv.tool) {
+        console.error("[FastMCP Error] --args requires --tool");
+        process.exitCode = 1;
+        return;
+      }
+      if (argv.tool && argv.watch) {
+        console.warn(
+          "[FastMCP] --watch is ignored when calling a tool with --tool: the server runs for a single call."
+        );
+      }
+      let configPath;
+      if (argv.tool) {
+        configDir = await _promises.mkdtemp.call(void 0, _path.join.call(void 0, _os.tmpdir.call(void 0, ), "fastmcp-dev-"));
+        configPath = _path.join.call(void 0, configDir, "mcp-cli.json");
+        await _promises.writeFile.call(void 0, configPath, buildDevConfig(argv.file), "utf8");
+      }
+      const [command, ...commandArgs] = buildDevCommand({
+        configPath,
+        file: argv.file,
+        tool: argv.tool,
+        toolArgs: argv.args,
+        watch: argv.watch
+      });
       if (argv.verbose) {
-        console.log(`[FastMCP] Starting server: ${command}`);
+        console.log(
+          `[FastMCP] Starting server: ${[command, ...commandArgs].join(" ")}`
+        );
         console.log(`[FastMCP] File: ${argv.file}`);
         console.log(
           `[FastMCP] Watch mode: ${argv.watch ? "enabled" : "disabled"}`
         );
+        if (argv.tool) {
+          console.log(`[FastMCP] Tool: ${argv.tool}`);
+        }
       }
-      await _execa.execa.call(void 0, {
-        shell: true,
+      await _execa.execa.call(void 0, command, commandArgs, {
         stderr: "inherit",
         stdin: "inherit",
         stdout: "inherit"
-      })`${command}`;
+      });
     } catch (error) {
       console.error(
         "[FastMCP Error] Failed to start development server:",
@@ -48,7 +129,11 @@ await _yargs2.default.call(void 0, _helpers.hideBin.call(void 0, process.argv)).
       if (argv.verbose && error instanceof Error && error.stack) {
         console.error("[FastMCP Debug] Stack trace:", error.stack);
       }
-      process.exit(1);
+      process.exitCode = 1;
+    } finally {
+      if (configDir) {
+        await _promises.rm.call(void 0, configDir, { force: true, recursive: true });
+      }
     }
   }
 ).command(

package/dist/bin/fastmcp.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/bin/fastmcp.cjs","../../src/bin/fastmcp.ts"],"names":["yargs"],"mappings":"AAAA;AACA;AACA;ACAA,8BAAsB;AACtB,4EAAkB;AAClB,wCAAwB;AAExB,MAAM,6BAAA,8BAAM,OAAQ,CAAQ,IAAI,CAAC,CAAA,CAC9B,UAAA,CAAW,SAAS,CAAA,CACpB,OAAA;AAAA,EACC,YAAA;AAAA,EACA,4BAAA;AAAA,EACA,CAACA,MAAAA,EAAAA,GAAU;AACT,IAAA,OAAOA,MAAAA,CACJ,UAAA,CAAW,MAAA,EAAQ;AAAA,MAClB,YAAA,EAAc,IAAA;AAAA,MACd,QAAA,EAAU,6BAAA;AAAA,MACV,IAAA,EAAM;AAAA,IACR,CAAC,CAAA,CAEA,MAAA,CAAO,OAAA,EAAS;AAAA,MACf,KAAA,EAAO,GAAA;AAAA,MACP,OAAA,EAAS,KAAA;AAAA,MACT,QAAA,EAAU,2CAAA;AAAA,MACV,IAAA,EAAM;AAAA,IACR,CAAC,CAAA,CAEA,MAAA,CAAO,SAAA,EAAW;AAAA,MACjB,KAAA,EAAO,GAAA;AAAA,MACP,OAAA,EAAS,KAAA;AAAA,MACT,QAAA,EAAU,wBAAA;AAAA,MACV,IAAA,EAAM;AAAA,IACR,CAAC,CAAA;AAAA,EACL,CAAA;AAAA,EAEA,MAAA,CAAO,IAAA,EAAA,GAAS;AACd,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,EAAU,IAAA,CAAK,MAAA,EACjB,CAAA,mCAAA,EAAsC,IAAA,CAAK,IAAI,CAAA,EAAA;AAGjC,MAAA;AACmC,QAAA;AACT,QAAA;AAClC,QAAA;AACsD,UAAA;AAC9D,QAAA;AACF,MAAA;AAEY,MAAA;AACH,QAAA;AACC,QAAA;AACD,QAAA;AACC,QAAA;AACE,MAAA;AACE,IAAA;AACN,MAAA;AACN,QAAA;AACqD,QAAA;AACvD,MAAA;AAE2D,MAAA;AACA,QAAA;AAC3D,MAAA;AAEc,MAAA;AAChB,IAAA;AACF,EAAA;AAGD;AACC,EAAA;AACA,EAAA;AACW,EAAA;AACuB,IAAA;AAChB,MAAA;AACJ,MAAA;AACJ,MAAA;AACP,IAAA;AACH,EAAA;AAEgB,EAAA;AACV,IAAA;AACU,MAAA;AACF,QAAA;AACA,QAAA;AACgD,MAAA;AAC5C,IAAA;AACN,MAAA;AACN,QAAA;AACqD,QAAA;AACvD,MAAA;AAEc,MAAA;AAChB,IAAA;AACF,EAAA;AAGD;AACC,EAAA;AACA,EAAA;AACW,EAAA;AAEa,IAAA;AACJ,MAAA;AACJ,MAAA;AACJ,MAAA;AAGU,IAAA;AACT,MAAA;AACE,MAAA;AACC,MAAA;AACJ,MAAA;AACP,IAAA;AACL,EAAA;AAEgB,EAAA;AACV,IAAA;AACsC,MAAA;AACD,MAAA;AACL,MAAA;AAEP,MAAA;AACkC,QAAA;AAC7C,QAAA;AAChB,MAAA;AAE2D,MAAA;AAIvD,MAAA;AAEA,MAAA;AACU,QAAA;AACH,UAAA;AACC,UAAA;AACA,UAAA;AACE,QAAA;AAE+C,QAAA;AAC3C,MAAA;AACyC,QAAA;AAEJ,QAAA;AACvB,UAAA;AAC9B,QAAA;AAEc,QAAA;AAChB,MAAA;AAEI,MAAA;AACU,QAAA;AACH,UAAA;AACC,UAAA;AACA,UAAA;AACT,QAAA;AAAA;AAAA;AAAA;AAIoC,qCAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAAA;AAQ/B,MAAA;AACwD,QAAA;AACM,QAAA;AAEtD,QAAA;AAChB,MAAA;AAEQ,MAAA;AACN,QAAA;AACF,MAAA;AACc,IAAA;AACN,MAAA;AACN,QAAA;AACqD,QAAA;AACvD,MAAA;AAEc,MAAA;AAChB,IAAA;AACF,EAAA;AAIU","file":"/home/runner/work/fastmcp/fastmcp/dist/bin/fastmcp.cjs","sourcesContent":[null,"#!/usr/bin/env node\n\nimport { execa } from \"execa\";\nimport yargs from \"yargs\";\nimport { hideBin } from \"yargs/helpers\";\n\nawait yargs(hideBin(process.argv))\n  .scriptName(\"fastmcp\")\n  .command(\n    \"dev <file>\",\n    \"Start a development server\",\n    (yargs) => {\n      return yargs\n        .positional(\"file\", {\n          demandOption: true,\n          describe: \"The path to the server file\",\n          type: \"string\",\n        })\n\n        .option(\"watch\", {\n          alias: \"w\",\n          default: false,\n          describe: \"Watch for file changes and restart server\",\n          type: \"boolean\",\n        })\n\n        .option(\"verbose\", {\n          alias: \"v\",\n          default: false,\n          describe: \"Enable verbose logging\",\n          type: \"boolean\",\n        });\n    },\n\n    async (argv) => {\n      try {\n        const command = argv.watch\n          ? `npx @wong2/mcp-cli npx tsx --watch ${argv.file}`\n          : `npx @wong2/mcp-cli npx tsx ${argv.file}`;\n\n        if (argv.verbose) {\n          console.log(`[FastMCP] Starting server: ${command}`);\n          console.log(`[FastMCP] File: ${argv.file}`);\n          console.log(\n            `[FastMCP] Watch mode: ${argv.watch ? \"enabled\" : \"disabled\"}`,\n          );\n        }\n\n        await execa({\n          shell: true,\n          stderr: \"inherit\",\n          stdin: \"inherit\",\n          stdout: \"inherit\",\n        })`${command}`;\n      } catch (error) {\n        console.error(\n          \"[FastMCP Error] Failed to start development server:\",\n          error instanceof Error ? error.message : String(error),\n        );\n\n        if (argv.verbose && error instanceof Error && error.stack) {\n          console.error(\"[FastMCP Debug] Stack trace:\", error.stack);\n        }\n\n        process.exit(1);\n      }\n    },\n  )\n\n  .command(\n    \"inspect <file>\",\n    \"Inspect a server file\",\n    (yargs) => {\n      return yargs.positional(\"file\", {\n        demandOption: true,\n        describe: \"The path to the server file\",\n        type: \"string\",\n      });\n    },\n\n    async (argv) => {\n      try {\n        await execa({\n          stderr: \"inherit\",\n          stdout: \"inherit\",\n        })`npx @modelcontextprotocol/inspector npx tsx ${argv.file}`;\n      } catch (error) {\n        console.error(\n          \"[FastMCP Error] Failed to inspect server:\",\n          error instanceof Error ? error.message : String(error),\n        );\n\n        process.exit(1);\n      }\n    },\n  )\n\n  .command(\n    \"validate <file>\",\n    \"Validate a FastMCP server file for syntax and basic structure\",\n    (yargs) => {\n      return yargs\n        .positional(\"file\", {\n          demandOption: true,\n          describe: \"The path to the server file\",\n          type: \"string\",\n        })\n\n        .option(\"strict\", {\n          alias: \"s\",\n          default: false,\n          describe: \"Enable strict validation (type checking)\",\n          type: \"boolean\",\n        });\n    },\n\n    async (argv) => {\n      try {\n        const { existsSync } = await import(\"fs\");\n        const { resolve } = await import(\"path\");\n        const filePath = resolve(argv.file);\n\n        if (!existsSync(filePath)) {\n          console.error(`[FastMCP Error] File not found: ${filePath}`);\n          process.exit(1);\n        }\n\n        console.log(`[FastMCP] Validating server file: ${filePath}`);\n\n        const command = argv.strict\n          ? `npx tsc --noEmit --strict ${filePath}`\n          : `npx tsc --noEmit ${filePath}`;\n\n        try {\n          await execa({\n            shell: true,\n            stderr: \"pipe\",\n            stdout: \"pipe\",\n          })`${command}`;\n\n          console.log(\"[FastMCP] ✓ TypeScript compilation successful\");\n        } catch (tsError) {\n          console.error(\"[FastMCP] ✗ TypeScript compilation failed\");\n\n          if (tsError instanceof Error && \"stderr\" in tsError) {\n            console.error(tsError.stderr);\n          }\n\n          process.exit(1);\n        }\n\n        try {\n          await execa({\n            shell: true,\n            stderr: \"pipe\",\n            stdout: \"pipe\",\n          })`node -e \"\n            (async () => {\n              try {\n                const { FastMCP } = await import('fastmcp');\n                await import('file://${filePath}');\n                console.log('[FastMCP] ✓ Server structure validation passed');\n              } catch (error) {\n                console.error('[FastMCP] ✗ Server structure validation failed:', error.message);\n                process.exit(1);\n              }\n            })();\n          \"`;\n        } catch {\n          console.error(\"[FastMCP] ✗ Server structure validation failed\");\n          console.error(\"Make sure the file properly imports and uses FastMCP\");\n\n          process.exit(1);\n        }\n\n        console.log(\n          \"[FastMCP] ✓ All validations passed! Server file looks good.\",\n        );\n      } catch (error) {\n        console.error(\n          \"[FastMCP Error] Validation failed:\",\n          error instanceof Error ? error.message : String(error),\n        );\n\n        process.exit(1);\n      }\n    },\n  )\n\n  .help()\n  .parseAsync();\n"]}
+{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/bin/fastmcp.cjs","../../src/bin/fastmcp.ts","../../src/bin/devCommand.ts"],"names":["yargs"],"mappings":"AAAA;AACA;AACA;ACAA,8BAAsB;AACtB,uCAAuC;AACvC,wBAAuB;AACvB,4BAAqB;AACrB,4EAAkB;AAClB,wCAAwB;ADExB;AACA;AEqBO,IAAM,gBAAA,EAAkB,KAAA;AAWxB,IAAM,eAAA,EAAiB,CAAC,IAAA,EAAA,GAC7B,IAAA,CAAK,SAAA;AAAA,EACH;AAAA,IACE,UAAA,EAAY;AAAA,MACV,CAAC,eAAe,CAAA,EAAG;AAAA,QACjB,IAAA,EAAM,CAAC,KAAA,EAAO,IAAI,CAAA;AAAA,QAClB,OAAA,EAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF,CAAA;AAAA,EACA,IAAA;AAAA,EACA;AACF,CAAA;AAeK,IAAM,gBAAA,EAAkB,CAC7B,OAAA,EAAA,GAC0B;AAC1B,EAAA,MAAM,EAAE,UAAA,EAAY,IAAA,EAAM,IAAA,EAAM,QAAA,EAAU,MAAA,EAAQ,MAAM,EAAA,EAAI,OAAA;AAE5D,EAAA,GAAA,CAAI,IAAA,EAAM;AACR,IAAA,GAAA,CAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,MACF,CAAA;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA;AAAA,MACA,gBAAA;AAAA,MACA,IAAA;AAAA,MACA,UAAA;AAAA,MACA,WAAA;AAAA,MACA,CAAA,EAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA;AACE,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACI,IAAA;AACJ,IAAA;AACF,EAAA;AACF;AFjDO;AACA;ACzCD;AAGF,EAAA;AACA,EAAA;AACCA,EAAAA;AACC,IAAA;AAEI,MAAA;AACA,MAAA;AACA,MAAA;AAGD,IAAA;AACC,MAAA;AAEA,MAAA;AAGD,IAAA;AACC,MAAA;AACA,MAAA;AAEA,MAAA;AAGD,IAAA;AACC,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AAGD,IAAA;AACC,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AACL,EAAA;AAEA,EAAA;AACE,IAAA;AAEA,IAAA;AACE,MAAA;AACE,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AAEA,MAAA;AACE,QAAA;AAAQ,UAAA;AACN,QAAA;AAEJ,MAAA;AAEA,MAAA;AAEA,MAAA;AACE,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AAEA,MAAA;AAAkD,QAAA;AAChD,QAAA;AACW,QAAA;AACA,QAAA;AACI,QAAA;AAEhB,MAAA;AAED,MAAA;AACE,QAAA;AAAQ,UAAA;AAC2D,QAAA;AAEnE,QAAA;AACA,QAAA;AAAQ,UAAA;AACsD,QAAA;AAG9D,QAAA;AACE,UAAA;AAA0C,QAAA;AAE9C,MAAA;AAEA,MAAA;AAAkC,QAAA;AACxB,QAAA;AACD,QAAA;AAER,MAAA;AACH,IAAA;AACE,MAAA;AAAQ,QAAA;AACN,QAAA;AAEF,MAAA;AAEA,MAAA;AACE,QAAA;AACF,MAAA;AAIA,MAAA;AACF,IAAA;AACE,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AAGD;AACC,EAAA;AACA,EAAA;AACCA,EAAAA;AACC,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AAAY,QAAA;AACF,QAAA;AAET,MAAA;AACH,IAAA;AACE,MAAA;AAAQ,QAAA;AACN,QAAA;AAEF,MAAA;AAEA,MAAA;AACF,IAAA;AACF,EAAA;AAGD;AACC,EAAA;AACA,EAAA;AACCA,EAAAA;AACC,IAAA;AAEI,MAAA;AACA,MAAA;AACA,MAAA;AAGD,IAAA;AACC,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AACL,EAAA;AAEA,EAAA;AACE,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AAEA,MAAA;AACE,QAAA;AACA,QAAA;AACF,MAAA;AAEA,MAAA;AAEA,MAAA;AAIA,MAAA;AACE,QAAA;AAAY,UAAA;AACH,UAAA;AACC,UAAA;AACA,QAAA;AAGV,QAAA;AACF,MAAA;AACE,QAAA;AAEA,QAAA;AACE,UAAA;AAA4B,QAAA;AAG9B,QAAA;AACF,MAAA;AAEA,MAAA;AACE,QAAA;AAAY,UAAA;AACH,UAAA;AACC,UAAA;AACA,QAAA;AACT;AAAA;AAAA;AAAA,qCAAA;AAIoC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAAA;AAQvC,MAAA;AACE,QAAA;AACA,QAAA;AAEA,QAAA;AACF,MAAA;AAEA,MAAA;AAAQ,QAAA;AAER,MAAA;AACF,IAAA;AACE,MAAA;AAAQ,QAAA;AACN,QAAA;AAEF,MAAA;AAEA,MAAA;AACF,IAAA;AACF,EAAA;AAGI","file":"/home/runner/work/fastmcp/fastmcp/dist/bin/fastmcp.cjs","sourcesContent":[null,"#!/usr/bin/env node\n\nimport { execa } from \"execa\";\nimport { mkdtemp, rm, writeFile } from \"fs/promises\";\nimport { tmpdir } from \"os\";\nimport { join } from \"path\";\nimport yargs from \"yargs\";\nimport { hideBin } from \"yargs/helpers\";\n\nimport { buildDevCommand, buildDevConfig } from \"./devCommand.js\";\n\nawait yargs(hideBin(process.argv))\n  .scriptName(\"fastmcp\")\n  .command(\n    \"dev <file>\",\n    \"Start a development server\",\n    (yargs) => {\n      return yargs\n        .positional(\"file\", {\n          demandOption: true,\n          describe: \"The path to the server file\",\n          type: \"string\",\n        })\n\n        .option(\"args\", {\n          describe:\n            \"JSON arguments passed to the tool (requires --tool), e.g. '{\\\"a\\\":1}'\",\n          type: \"string\",\n        })\n\n        .option(\"tool\", {\n          alias: \"t\",\n          describe:\n            \"Call a tool non-interactively instead of launching the inspector\",\n          type: \"string\",\n        })\n\n        .option(\"watch\", {\n          alias: \"w\",\n          default: false,\n          describe: \"Watch for file changes and restart server\",\n          type: \"boolean\",\n        })\n\n        .option(\"verbose\", {\n          alias: \"v\",\n          default: false,\n          describe: \"Enable verbose logging\",\n          type: \"boolean\",\n        });\n    },\n\n    async (argv) => {\n      let configDir: string | undefined;\n\n      try {\n        if (argv.args !== undefined && !argv.tool) {\n          console.error(\"[FastMCP Error] --args requires --tool\");\n          process.exitCode = 1;\n          return;\n        }\n\n        if (argv.tool && argv.watch) {\n          console.warn(\n            \"[FastMCP] --watch is ignored when calling a tool with --tool: the server runs for a single call.\",\n          );\n        }\n\n        let configPath: string | undefined;\n\n        if (argv.tool) {\n          configDir = await mkdtemp(join(tmpdir(), \"fastmcp-dev-\"));\n          configPath = join(configDir, \"mcp-cli.json\");\n          await writeFile(configPath, buildDevConfig(argv.file), \"utf8\");\n        }\n\n        const [command, ...commandArgs] = buildDevCommand({\n          configPath,\n          file: argv.file,\n          tool: argv.tool,\n          toolArgs: argv.args,\n          watch: argv.watch,\n        });\n\n        if (argv.verbose) {\n          console.log(\n            `[FastMCP] Starting server: ${[command, ...commandArgs].join(\" \")}`,\n          );\n          console.log(`[FastMCP] File: ${argv.file}`);\n          console.log(\n            `[FastMCP] Watch mode: ${argv.watch ? \"enabled\" : \"disabled\"}`,\n          );\n\n          if (argv.tool) {\n            console.log(`[FastMCP] Tool: ${argv.tool}`);\n          }\n        }\n\n        await execa(command, commandArgs, {\n          stderr: \"inherit\",\n          stdin: \"inherit\",\n          stdout: \"inherit\",\n        });\n      } catch (error) {\n        console.error(\n          \"[FastMCP Error] Failed to start development server:\",\n          error instanceof Error ? error.message : String(error),\n        );\n\n        if (argv.verbose && error instanceof Error && error.stack) {\n          console.error(\"[FastMCP Debug] Stack trace:\", error.stack);\n        }\n\n        // Not process.exit(): that would skip the `finally` block below and\n        // leak the temporary config directory on every failed tool call.\n        process.exitCode = 1;\n      } finally {\n        if (configDir) {\n          await rm(configDir, { force: true, recursive: true });\n        }\n      }\n    },\n  )\n\n  .command(\n    \"inspect <file>\",\n    \"Inspect a server file\",\n    (yargs) => {\n      return yargs.positional(\"file\", {\n        demandOption: true,\n        describe: \"The path to the server file\",\n        type: \"string\",\n      });\n    },\n\n    async (argv) => {\n      try {\n        await execa({\n          stderr: \"inherit\",\n          stdout: \"inherit\",\n        })`npx @modelcontextprotocol/inspector npx tsx ${argv.file}`;\n      } catch (error) {\n        console.error(\n          \"[FastMCP Error] Failed to inspect server:\",\n          error instanceof Error ? error.message : String(error),\n        );\n\n        process.exit(1);\n      }\n    },\n  )\n\n  .command(\n    \"validate <file>\",\n    \"Validate a FastMCP server file for syntax and basic structure\",\n    (yargs) => {\n      return yargs\n        .positional(\"file\", {\n          demandOption: true,\n          describe: \"The path to the server file\",\n          type: \"string\",\n        })\n\n        .option(\"strict\", {\n          alias: \"s\",\n          default: false,\n          describe: \"Enable strict validation (type checking)\",\n          type: \"boolean\",\n        });\n    },\n\n    async (argv) => {\n      try {\n        const { existsSync } = await import(\"fs\");\n        const { resolve } = await import(\"path\");\n        const filePath = resolve(argv.file);\n\n        if (!existsSync(filePath)) {\n          console.error(`[FastMCP Error] File not found: ${filePath}`);\n          process.exit(1);\n        }\n\n        console.log(`[FastMCP] Validating server file: ${filePath}`);\n\n        const command = argv.strict\n          ? `npx tsc --noEmit --strict ${filePath}`\n          : `npx tsc --noEmit ${filePath}`;\n\n        try {\n          await execa({\n            shell: true,\n            stderr: \"pipe\",\n            stdout: \"pipe\",\n          })`${command}`;\n\n          console.log(\"[FastMCP] ✓ TypeScript compilation successful\");\n        } catch (tsError) {\n          console.error(\"[FastMCP] ✗ TypeScript compilation failed\");\n\n          if (tsError instanceof Error && \"stderr\" in tsError) {\n            console.error(tsError.stderr);\n          }\n\n          process.exit(1);\n        }\n\n        try {\n          await execa({\n            shell: true,\n            stderr: \"pipe\",\n            stdout: \"pipe\",\n          })`node -e \"\n            (async () => {\n              try {\n                const { FastMCP } = await import('fastmcp');\n                await import('file://${filePath}');\n                console.log('[FastMCP] ✓ Server structure validation passed');\n              } catch (error) {\n                console.error('[FastMCP] ✗ Server structure validation failed:', error.message);\n                process.exit(1);\n              }\n            })();\n          \"`;\n        } catch {\n          console.error(\"[FastMCP] ✗ Server structure validation failed\");\n          console.error(\"Make sure the file properly imports and uses FastMCP\");\n\n          process.exit(1);\n        }\n\n        console.log(\n          \"[FastMCP] ✓ All validations passed! Server file looks good.\",\n        );\n      } catch (error) {\n        console.error(\n          \"[FastMCP Error] Validation failed:\",\n          error instanceof Error ? error.message : String(error),\n        );\n\n        process.exit(1);\n      }\n    },\n  )\n\n  .help()\n  .parseAsync();\n","export type DevCommandOptions = {\n  /**\n   * Path to a temporary mcp-cli config file that registers the dev server.\n   * Only used in non-interactive mode (when `tool` is set).\n   */\n  configPath?: string;\n  /**\n   * Path to the server file to run.\n   */\n  file: string;\n  /**\n   * Name of the tool to call non-interactively. When omitted, the dev\n   * command launches the interactive mcp-cli inspector instead.\n   */\n  tool?: string;\n  /**\n   * JSON string of arguments forwarded to the tool via mcp-cli `--args`.\n   * Only used in non-interactive mode.\n   */\n  toolArgs?: string;\n  /**\n   * Watch the file for changes and restart the server. Only used in\n   * interactive mode; a non-interactive call runs the server once.\n   */\n  watch?: boolean;\n};\n\n/**\n * The server name registered in the generated mcp-cli config. mcp-cli\n * addresses non-interactive targets as `<server-name>:<tool>`.\n */\nexport const DEV_SERVER_NAME = \"dev\";\n\n/**\n * Build the JSON config that registers the dev server with mcp-cli so it can\n * be invoked non-interactively. mcp-cli's non-interactive mode resolves the\n * server by name from a config file's `mcpServers` map, so an inline command\n * cannot be passed directly alongside `call-tool`.\n *\n * The server is never started in watch mode here: a non-interactive call\n * connects, calls one tool, and exits, so there is nothing to restart into.\n */\nexport const buildDevConfig = (file: string): string =>\n  JSON.stringify(\n    {\n      mcpServers: {\n        [DEV_SERVER_NAME]: {\n          args: [\"tsx\", file],\n          command: \"npx\",\n        },\n      },\n    },\n    null,\n    2,\n  );\n\n/**\n * Build the argv that the dev command runs.\n *\n * This is an argv array rather than a shell string so that nothing has to be\n * quoted: file paths, tool names and JSON `--args` are passed to the child\n * process verbatim. Quoting through a shell would be wrong on Windows, where\n * cmd.exe treats single quotes as literal characters rather than as quoting.\n *\n * - Without `tool`: launches the interactive @wong2/mcp-cli inspector\n *   against an inline `npx tsx <file>` server (existing behaviour).\n * - With `tool`: runs @wong2/mcp-cli in non-interactive mode against a\n *   generated config file, calling the named tool and forwarding `--args`.\n */\nexport const buildDevCommand = (\n  options: DevCommandOptions,\n): [string, ...string[]] => {\n  const { configPath, file, tool, toolArgs, watch = false } = options;\n\n  if (tool) {\n    if (!configPath) {\n      throw new Error(\n        \"configPath is required when calling a tool non-interactively\",\n      );\n    }\n\n    return [\n      \"npx\",\n      \"@wong2/mcp-cli\",\n      \"-c\",\n      configPath,\n      \"call-tool\",\n      `${DEV_SERVER_NAME}:${tool}`,\n      ...(toolArgs === undefined ? [] : [\"--args\", toolArgs]),\n    ];\n  }\n\n  return [\n    \"npx\",\n    \"@wong2/mcp-cli\",\n    \"npx\",\n    \"tsx\",\n    ...(watch ? [\"--watch\"] : []),\n    file,\n  ];\n};\n"]}