ha-mcp-dev 8.4.3.dev2652__tar.gz → 8.4.3.dev2654__tar.gz

{ha_mcp_dev-8.4.3.dev2652/src/ha_mcp_dev.egg-info → ha_mcp_dev-8.4.3.dev2654}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.4.3.dev2652
+Version: 8.4.3.dev2654
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT
@@ -19,9 +19,37 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: <3.15,>=3.13
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: fastmcp==3.4.7
+Requires-Dist: anyio>=4.10; python_version >= "3.14"
+Requires-Dist: anyio>=4.9; python_version < "3.14"
+Requires-Dist: authlib>=1.6.11
+Requires-Dist: cyclopts>=4.0.0
+Requires-Dist: exceptiongroup>=1.2.2
+Requires-Dist: griffelib>=2.0.0
+Requires-Dist: httpx2>=2.5.0
+Requires-Dist: joserfc>=1.5.0
+Requires-Dist: jsonref>=1.1.0
+Requires-Dist: jsonschema>=4.20.0
+Requires-Dist: jsonschema-path>=0.3.4
+Requires-Dist: openapi-pydantic>=0.5.1
+Requires-Dist: opentelemetry-api>=1.28.0
+Requires-Dist: platformdirs>=4.0.0
+Requires-Dist: py-key-value-aio[filetree,keyring,memory]<0.5.0,>=0.4.4
+Requires-Dist: pydantic-settings>=2.0.0
+Requires-Dist: pyjwt[crypto]>=2.10.1
+Requires-Dist: pyperclip>=1.9.0
+Requires-Dist: python-multipart>=0.0.26
+Requires-Dist: pywin32>=311; sys_platform == "win32"
+Requires-Dist: pyyaml<7.0,>=6.0
+Requires-Dist: rich>=13.9.4
+Requires-Dist: sse-starlette>=3.0.0
+Requires-Dist: starlette>=1.0.1
+Requires-Dist: typing-extensions>=4.13.0
+Requires-Dist: typing-inspection>=0.4.1
+Requires-Dist: uncalled-for>=0.4.0
+Requires-Dist: uvicorn>=0.35; sys_platform != "emscripten"
+Requires-Dist: watchfiles>=1.0.0
 Requires-Dist: httpx[socks]<0.29,>=0.28.1
-Requires-Dist: pydantic<3,>=2.13.4
+Requires-Dist: pydantic[email]<3,>=2.13.4
 Requires-Dist: python-dotenv==1.2.3
 Requires-Dist: truststore==0.10.4
 Requires-Dist: cryptography<51,>=48.0.0

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.4.3.dev2652"
+version = "8.4.3.dev2654"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's
@@ -28,14 +28,44 @@ classifiers = [
 ]
 
 dependencies = [
-    "fastmcp==3.4.7",
+    # fastmcp/mcp/mcp-types are vendored (scripts/vendor_fastmcp.py) so HA
+    # Core's own mcp 1.x pin can't conflict. Below: their runtime requirements.
+    "anyio>=4.10; python_version >= '3.14'",
+    "anyio>=4.9; python_version < '3.14'",
+    "authlib>=1.6.11",
+    "cyclopts>=4.0.0",
+    "exceptiongroup>=1.2.2",
+    "griffelib>=2.0.0",
+    "httpx2>=2.5.0",
+    "joserfc>=1.5.0",
+    "jsonref>=1.1.0",
+    "jsonschema>=4.20.0",
+    "jsonschema-path>=0.3.4",
+    "openapi-pydantic>=0.5.1",
+    "opentelemetry-api>=1.28.0",
+    "platformdirs>=4.0.0",
+    "py-key-value-aio[filetree,keyring,memory]>=0.4.4,<0.5.0",
+    "pydantic-settings>=2.0.0",
+    "pyjwt[crypto]>=2.10.1",
+    "pyperclip>=1.9.0",
+    "python-multipart>=0.0.26",
+    "pywin32>=311; sys_platform == 'win32'",
+    "pyyaml>=6.0,<7.0",
+    "rich>=13.9.4",
+    "sse-starlette>=3.0.0",
+    "starlette>=1.0.1",
+    "typing-extensions>=4.13.0",
+    "typing-inspection>=0.4.1",
+    "uncalled-for>=0.4.0",
+    "uvicorn>=0.35; sys_platform != 'emscripten'",
+    "watchfiles>=1.0.0",
     # Shared with the embedded HA process: admit Core's versions, including
     # compatible updates, instead of requiring it to keep our exact pin.
     # uv.lock selects standalone versions; HA's own constraints select
     # the embedded versions. Check both the HACS minimum and current Core
     # before raising these floors; standalone lock updates can move independently.
     "httpx[socks]>=0.28.1,<0.29",
-    "pydantic>=2.13.4,<3",
+    "pydantic[email]>=2.13.4,<3",
     "python-dotenv==1.2.3",
     "truststore==0.10.4",
     # websockets is deliberately ABSENT from this list: ha-mcp ships its own
@@ -46,9 +76,9 @@ dependencies = [
     # conflicting version demands and any of their installs can replace or
     # tear it in place (#2135/#2146); a declared dependency here would make
     # ha-mcp PIN that contested copy, which is what forced the in-place
-    # replacements. A shared copy can still arrive transitively (fastmcp
-    # declares one), so what keeps us off it is the vendored import path,
-    # not the absence of this line — and the embedded no-stomp e2e guard is
+    # replacements. Home Assistant's environment carries a shared copy anyway
+    # (Core and other integrations install it), so what keeps us off it is the
+    # vendored import path, not the absence of this line — and the embedded no-stomp e2e guard is
     # what proves no install of ours ever replaces the shared copy.
     # Range (not a hard pin) so the resolver can satisfy Home Assistant's own
     # cryptography constraint when ha-mcp is installed into the HA venv for
@@ -119,7 +149,6 @@ explicit_package_bases = true
 
 [[tool.mypy.overrides]]
 module = [
-    "fastmcp.*",
     "jq",
     "pydantic_monty",
     "pydantic_monty.*",
@@ -388,7 +417,8 @@ dev = [
     # it is NOT a runtime dependency (see the note in [project.dependencies]).
     "websockets>=15.0.1",
     "docker>=7.1.0",
-    "httpx2>=2.4.0",
+    # Shared SDK for the component's llm_api.py tests; mirrors HA Core's 1.x line.
+    "mcp>=1.26.0,<2",
     "mypy>=1.17.0",
     "openai>=1.0.0",
     "jsonschema>=4.25.1",

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/__main__.py

@@ -42,8 +42,7 @@ from ha_mcp.browser_landing import (  # noqa: E402
 from ha_mcp.log_filters import install_sdk_log_filters  # noqa: E402
 
 if TYPE_CHECKING:
-    from fastmcp import FastMCP
-
+    from ha_mcp._vendor.fastmcp import FastMCP
     from ha_mcp.client.rest_client import HomeAssistantClient
     from ha_mcp.config import Settings
     from ha_mcp.server import HomeAssistantSmartMCPServer
@@ -68,8 +67,7 @@ class OAuthProxyClient:
 
     def _get_oauth_client(self) -> "HomeAssistantClient":
         """Get the OAuth client for the current request context."""
-        from fastmcp.server.dependencies import get_access_token
-
+        from ha_mcp._vendor.fastmcp.server.dependencies import get_access_token
         from ha_mcp.client.rest_client import (
             HomeAssistantAuthError,
             HomeAssistantClient,
@@ -293,7 +291,7 @@ def _validate_standard_credentials(settings: "Settings") -> None:
 
 def _get_show_banner() -> bool:
     """Check if server banner should be shown (respects FASTMCP_SHOW_SERVER_BANNER env var)."""
-    import fastmcp
+    from ha_mcp._vendor import fastmcp
 
     return fastmcp.settings.show_server_banner
 
@@ -321,7 +319,11 @@ def _http_run_kwargs(host: str, port: int, path: str) -> dict[str, Any]:
         "path": path,
         "stateless_http": True,
         "show_banner": _get_show_banner(),
-        "uvicorn_config": {"log_config": _get_timestamped_uvicorn_log_config()},
+        # ws="none": uvicorn's default imports the shared websockets package.
+        "uvicorn_config": {
+            "log_config": _get_timestamped_uvicorn_log_config(),
+            "ws": "none",
+        },
     }
 
 
@@ -441,8 +443,7 @@ def _setup_logging(log_level_str: str, force: bool = True) -> None:
     """
     log_level = getattr(logging, log_level_str)
 
-    import fastmcp
-
+    from ha_mcp._vendor import fastmcp
     from ha_mcp.utils.usage_logger import preserve_startup_collector
 
     with preserve_startup_collector():

ha_mcp_dev-8.4.3.dev2654/src/ha_mcp/_vendor/requirements.txt

@@ -0,0 +1,11 @@
+# Vendored-library pins, bumped by the renovate custom manager that matches
+# this exact path (see renovate.json — no stock manager sees this file).
+#
+# Renovate runs scripts/vendor_websockets.py (websockets) or
+# scripts/vendor_fastmcp.py (fastmcp-slim, mcp, mcp-types) before committing
+# a bump; tests/src/unit/test_vendored_*.py reject stale or altered trees.
+# For a manual pin change, run the same generator and commit its outputs.
+websockets==17.1
+fastmcp-slim==4.0.3
+mcp==2.2.0
+mcp-types==2.2.0

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/auth/oidc_compat.py

@@ -5,10 +5,10 @@ from __future__ import annotations
 import logging
 from typing import override
 
-from fastmcp.server.auth.oauth_proxy.models import ProxyDCRClient
-from fastmcp.server.auth.oidc_proxy import OIDCProxy
-from mcp.server.auth.provider import AuthorizationParams, RefreshToken
-from mcp.shared.auth import OAuthClientInformationFull
+from ha_mcp._vendor.fastmcp.server.auth.oauth_proxy.models import ProxyDCRClient
+from ha_mcp._vendor.fastmcp.server.auth.oidc_proxy import OIDCProxy
+from ha_mcp._vendor.mcp.server.auth.provider import AuthorizationParams, RefreshToken
+from ha_mcp._vendor.mcp.shared.auth import OAuthClientInformationFull
 
 logger = logging.getLogger(__name__)
 

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/auth/provider.py

@@ -16,18 +16,25 @@ import os
 import secrets
 import time
 from base64 import urlsafe_b64decode, urlsafe_b64encode
-from collections.abc import Awaitable, Callable
+from collections.abc import Callable
 from pathlib import Path
 from typing import Any
 from urllib.parse import parse_qs, urlencode, urlparse, urlunparse
 
-from fastmcp.server.auth.auth import (
+from pydantic import AnyHttpUrl, ValidationError
+from starlette.datastructures import MutableHeaders
+from starlette.requests import Request
+from starlette.responses import HTMLResponse, RedirectResponse, Response
+from starlette.routing import Route
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from ha_mcp._vendor.fastmcp.server.auth.auth import (
     AccessToken,  # FastMCP version has claims field
     ClientRegistrationOptions,
     OAuthProvider,
     RevocationOptions,
 )
-from mcp.server.auth.provider import (
+from ha_mcp._vendor.mcp.server.auth.provider import (
     AuthorizationCode,
     AuthorizationParams,
     AuthorizeError,
@@ -35,11 +42,7 @@ from mcp.server.auth.provider import (
     TokenError,
     construct_redirect_uri,
 )
-from mcp.shared.auth import OAuthClientInformationFull, OAuthToken
-from pydantic import AnyHttpUrl, ValidationError
-from starlette.requests import Request
-from starlette.responses import HTMLResponse, RedirectResponse, Response
-from starlette.routing import Route
+from ha_mcp._vendor.mcp.shared.auth import OAuthClientInformationFull, OAuthToken
 
 from ..utils.data_paths import get_data_dir
 from .consent_form import create_consent_html, create_error_html
@@ -52,6 +55,34 @@ ACCESS_TOKEN_EXPIRY_SECONDS = 60 * 60  # 1 hour
 REFRESH_TOKEN_EXPIRY_SECONDS = 7 * 24 * 60 * 60  # 7 days
 
 
+class _StampIssOnErrorRedirects:
+    """ASGI wrapper that stamps ``iss`` on the error redirects of the app it wraps.
+
+    The SDK serves ``/authorize`` as an ASGI app, so the stamp is applied to the
+    headers as they are sent. A class, not a function, so Starlette's ``Route``
+    mounts it as raw ASGI instead of wrapping it in ``request_response``.
+    """
+
+    def __init__(self, app: ASGIApp, stamp: Callable[[str], str]) -> None:
+        self.app = app
+        self.stamp = stamp
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        async def send_stamped(message: Message) -> None:
+            if message["type"] == "http.response.start" and message["status"] in (
+                302,
+                303,
+                307,
+            ):
+                headers = MutableHeaders(scope=message)
+                location = headers.get("location", "")
+                if location and "error" in parse_qs(urlparse(location).query):
+                    headers["location"] = self.stamp(location)
+            await send(message)
+
+        await self.app(scope, receive, send_stamped)
+
+
 class HomeAssistantCredentials:
     """Temporary HA credentials held between consent form and token exchange."""
 
@@ -396,11 +427,8 @@ class HomeAssistantOAuthProvider(OAuthProvider):
         params.append(("iss", self._issuer()))
         return urlunparse(parsed._replace(query=urlencode(params)))
 
-    def _wrap_authorize_with_iss(
-        self, endpoint: "Callable[[Request], Awaitable[Response]]"
-    ) -> "Callable[[Request], Awaitable[Response]]":
-        """Wrap the SDK's ``/authorize`` endpoint to stamp ``iss`` on its
-        error redirects.
+    def _wrap_authorize_with_iss(self, endpoint: ASGIApp) -> ASGIApp:
+        """Wrap the SDK's ``/authorize`` app to stamp ``iss`` on its error redirects.
 
         The SDK's ``AuthorizationHandler`` builds OAuth error authorization
         responses (invalid scope, ``authorize()`` raising after redirect-URI
@@ -409,27 +437,16 @@ class HomeAssistantOAuthProvider(OAuthProvider):
         is a same-origin redirect to the consent form (no ``error``), which is
         not an authorization response and stays untouched.
         """
-
-        async def authorize_with_iss(request: Request) -> Response:
-            response: Response = await endpoint(request)
-            location = response.headers.get("location", "")
-            if (
-                response.status_code in (302, 303, 307)
-                and location
-                and "error" in parse_qs(urlparse(location).query)
-            ):
-                response.headers["location"] = self._ensure_single_iss(location)
-            return response
-
-        return authorize_with_iss
+        return _StampIssOnErrorRedirects(endpoint, self._ensure_single_iss)
 
     def get_routes(self, mcp_path: str | None = None) -> list[Route]:
         """
         Get OAuth routes including custom consent form routes.
 
         This extends the base OAuth routes with:
-        - GET /authorize - Shows the consent form
-        - POST /authorize - Handles consent form submission
+        - /authorize - the SDK handler, its error redirects stamped with ``iss``;
+          success redirects to /consent
+        - GET/POST /consent - the consent form and its submission
         - Custom /.well-known/oauth-authorization-server with enhanced metadata
         """
         # Get base OAuth routes
@@ -442,7 +459,7 @@ class HomeAssistantOAuthProvider(OAuthProvider):
 
         async def enhanced_metadata_handler(request: Request) -> Response:
             """Enhanced OAuth metadata handler with Claude.ai compatibility."""
-            from mcp.server.auth.routes import build_metadata
+            from ha_mcp._vendor.mcp.server.auth.routes import build_metadata
 
             # Get base metadata from MCP SDK
             metadata = build_metadata(
@@ -492,7 +509,7 @@ class HomeAssistantOAuthProvider(OAuthProvider):
                 isinstance(route, Route)
                 and route.path == "/.well-known/oauth-authorization-server"
             ):
-                from mcp.server.auth.routes import cors_middleware
+                from ha_mcp._vendor.mcp.server.auth.routes import cors_middleware
 
                 enhanced_routes.append(
                     Route(
@@ -520,7 +537,7 @@ class HomeAssistantOAuthProvider(OAuthProvider):
         # ChatGPT expects /.well-known/openid-configuration (OpenID Connect Discovery)
         # in addition to /.well-known/oauth-authorization-server (OAuth 2.1)
         # Per RFC 8414, many servers support both endpoints with identical metadata
-        from mcp.server.auth.routes import cors_middleware
+        from ha_mcp._vendor.mcp.server.auth.routes import cors_middleware
 
         enhanced_routes.append(
             Route(

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/backup_manager.py

@@ -62,7 +62,8 @@ from pathlib import Path
 from typing import Any, Literal, NotRequired, TypedDict
 
 import yaml  # type: ignore[import-untyped]
-from fastmcp.exceptions import ToolError
+
+from ha_mcp._vendor.fastmcp.exceptions import ToolError
 
 from .client.rest_client import HomeAssistantConnectionError, HomeAssistantError
 from .utils.data_paths import get_data_dir
@@ -2215,7 +2216,7 @@ async def _fetch_dashboard(client: Any, entity_id: str) -> Any:
     The component refuses YAML bodies, so those capture through legacy unchanged.
     Imported lazily to avoid an import cycle.
     """
-    from fastmcp.exceptions import ToolError
+    from ha_mcp._vendor.fastmcp.exceptions import ToolError
 
     from .tools.tools_config_dashboards import (
         _component_dashboard_config,

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/dashboard_screenshot/capture.py

@@ -19,7 +19,8 @@ from typing import Any, Literal, NoReturn, cast
 from urllib.parse import quote
 
 import httpx
-from fastmcp.exceptions import ToolError
+
+from ha_mcp._vendor.fastmcp.exceptions import ToolError
 
 from ..errors import ErrorCode, create_error_response
 from ..tools.helpers import raise_tool_error

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/dashboard_screenshot/content.py

@@ -5,8 +5,8 @@ from __future__ import annotations
 import hashlib
 from typing import Any
 
-from fastmcp.utilities.types import Image
-from mcp.types import ImageContent
+from ha_mcp._vendor.fastmcp.utilities.types import Image
+from ha_mcp._vendor.mcp.types import ImageContent
 
 from ..errors import ErrorCode, create_error_response
 from ..tools.helpers import raise_tool_error

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/dashboard_screenshot/paths.py

@@ -9,7 +9,7 @@ from collections import Counter
 from dataclasses import dataclass
 from typing import Any, cast
 
-from fastmcp.exceptions import ToolError
+from ha_mcp._vendor.fastmcp.exceptions import ToolError
 
 from ..errors import ErrorCode, create_error_response
 from ..tools.helpers import raise_tool_error

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/dashboard_screenshot/provision.py

@@ -27,7 +27,8 @@ from dataclasses import dataclass
 from typing import Any
 
 import httpx
-from fastmcp.exceptions import ToolError
+
+from ha_mcp._vendor.fastmcp.exceptions import ToolError
 
 from ..errors import ErrorCode, create_error_response
 from ..tools.helpers import raise_tool_error

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/errors.py

@@ -10,9 +10,14 @@ The structured error format enables AI agents to:
 - Understand the context and details of failures
 """
 
+import logging
 from enum import StrEnum
 from typing import Any
 
+# Level FastMCP logs ha-mcp's ToolErrors at: user-facing failures, not server
+# bugs. A ToolError built without it logs at FastMCP's default, ERROR.
+TOOL_ERROR_LOG_LEVEL = logging.WARNING
+
 
 class ErrorCode(StrEnum):
     """

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/ha_request_queue.py

@@ -7,7 +7,11 @@ import logging
 from contextvars import ContextVar
 from typing import Any
 
-from fastmcp.server.middleware.middleware import CallNext, Middleware, MiddlewareContext
+from ha_mcp._vendor.fastmcp.server.middleware.middleware import (
+    CallNext,
+    Middleware,
+    MiddlewareContext,
+)
 
 from .errors import create_timeout_error
 from .tool_dispatch import (

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/http_transport.py

@@ -11,12 +11,13 @@ from time import monotonic
 from typing import Any
 from uuid import uuid4
 
-import fastmcp
-from fastmcp import FastMCP
-from fastmcp.server.http import StarletteWithLifespan
 from starlette.middleware import Middleware
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
 
+from ha_mcp._vendor import fastmcp
+from ha_mcp._vendor.fastmcp import FastMCP
+from ha_mcp._vendor.fastmcp.server.http import StarletteWithLifespan
+
 from .config import get_global_settings
 
 logger = logging.getLogger(__name__)

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/llm_exposure.py

@@ -35,12 +35,12 @@ import time
 from collections.abc import Callable, Mapping, Sequence
 from typing import TYPE_CHECKING, Any
 
-from fastmcp.server.middleware import Middleware
+from ha_mcp._vendor.fastmcp.server.middleware import Middleware
 
 if TYPE_CHECKING:
-    from fastmcp.server.middleware import CallNext, MiddlewareContext
-    from fastmcp.tools import Tool
-    from mcp import types as mt
+    from ha_mcp._vendor.fastmcp.server.middleware import CallNext, MiddlewareContext
+    from ha_mcp._vendor.fastmcp.tools import Tool
+    from ha_mcp._vendor.mcp import types as mt
 
 logger = logging.getLogger(__name__)
 

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/log_filters.py

@@ -1,4 +1,4 @@
-"""MCP SDK / fastmcp log-noise filters shared across every HTTP launcher.
+"""MCP SDK log-noise filters shared across every HTTP launcher.
 
 Extracted from :mod:`ha_mcp.__main__` for the same reason as
 :mod:`ha_mcp.browser_landing`: the in-process server (the ``ha_mcp_tools``
@@ -17,8 +17,6 @@ from __future__ import annotations
 import logging
 
 import anyio
-from fastmcp.exceptions import ToolError
-from pydantic import ValidationError as PydanticValidationError
 
 
 class StatelessSessionLogFilter(logging.Filter):
@@ -54,37 +52,6 @@ class StatelessSessionLogFilter(logging.Filter):
         return "Terminating session: None" not in message
 
 
-class ToolValidationLogFilter(logging.Filter):
-    """Demote fastmcp tool-failure tracebacks to single-line warnings.
-
-    Pydantic ValidationError and tool-raised ToolError aren't server bugs,
-    so the traceback through fastmcp/pydantic internals is just noise. The
-    structured error detail is preserved in the WARNING message; stack is
-    intentionally dropped because these are user-input errors, not bugs.
-    """
-
-    def filter(self, record: logging.LogRecord) -> bool:
-        """Demote a known-benign validation/tool-error record to WARNING."""
-        if record.name != "fastmcp.server.server" or not record.exc_info:
-            return True
-
-        msg = record.getMessage()
-        err = record.exc_info[1]
-        if "Error validating tool" in msg and isinstance(err, PydanticValidationError):
-            record.msg = f"{msg}: {err.errors(include_url=False)}"
-        elif "Error calling tool" in msg and isinstance(err, ToolError):
-            record.msg = f"{msg}: {err}"
-        else:
-            return True
-
-        record.args = ()
-        record.levelno = logging.WARNING
-        record.levelname = "WARNING"
-        record.exc_info = None
-        record.exc_text = None
-        return True
-
-
 _DISCONNECT_TEARDOWN_ERRORS = (anyio.ClosedResourceError, anyio.BrokenResourceError)
 
 
@@ -140,8 +107,7 @@ class SessionDisconnectLogFilter(logging.Filter):
     stateful session runners of mcp/server/streamable_http_manager.py) -- it
     just logs it as an alarming ERROR-level traceback. That's an expected
     race in a stateless HTTP protocol (the client already gave up), not a
-    server bug, so demote it the same way ToolValidationLogFilter demotes
-    other known-benign failures. Any other exception on this logger -- an
+    server bug, so demote it. Any other exception on this logger -- an
     actual crash -- is left untouched.
     """
 
@@ -194,7 +160,7 @@ def _add_filter_once(logger_name: str, filter_cls: type[logging.Filter]) -> None
 
 
 def install_sdk_log_filters() -> None:
-    """Attach the demotion filters above to their target SDK/fastmcp loggers.
+    """Attach the suppression/demotion filters above to their MCP SDK loggers.
 
     Every HTTP launcher must call this: the CLI (``ha_mcp.__main__``), the
     Home Assistant app's ``start.py``, and the in-process embedded server
@@ -204,4 +170,3 @@ def install_sdk_log_filters() -> None:
     """
     _add_filter_once("mcp.server.streamable_http", StatelessSessionLogFilter)
     _add_filter_once("mcp.server.streamable_http_manager", SessionDisconnectLogFilter)
-    _add_filter_once("fastmcp.server.server", ToolValidationLogFilter)

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/policy/handlers.py

@@ -31,7 +31,7 @@ def _is_write_or_destructive(tool: Any) -> bool:
     ann = getattr(tool, "annotations", None)
     # No annotations = treat as potentially write (safe default for the
     # UI, matches the runtime gate which doesn't skip read-only).
-    return ann is None or getattr(ann, "readOnlyHint", None) is not True
+    return ann is None or ann.read_only_hint is not True
 
 
 def _extract_arg_paths(parameters: dict[str, Any]) -> list[dict[str, Any]]:

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/policy/middleware.py

@@ -9,7 +9,12 @@ from typing import Any, NoReturn
 
 import anyio
 from anyio.to_thread import run_sync as run_in_thread
-from fastmcp.server.middleware.middleware import CallNext, Middleware, MiddlewareContext
+
+from ha_mcp._vendor.fastmcp.server.middleware.middleware import (
+    CallNext,
+    Middleware,
+    MiddlewareContext,
+)
 
 from ..errors import ErrorCode, create_error_response
 from ..renamed_tools import current_tool_name

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/read_only.py

@@ -38,9 +38,13 @@ from contextlib import contextmanager
 from contextvars import ContextVar
 from typing import TYPE_CHECKING, Any, NamedTuple, NoReturn
 
-from fastmcp.server.middleware.middleware import CallNext, Middleware, MiddlewareContext
-from fastmcp.server.transforms import Transform
-from fastmcp.tools import Tool
+from ha_mcp._vendor.fastmcp.server.middleware.middleware import (
+    CallNext,
+    Middleware,
+    MiddlewareContext,
+)
+from ha_mcp._vendor.fastmcp.server.transforms import Transform
+from ha_mcp._vendor.fastmcp.tools import Tool
 
 from .config import get_global_settings
 from .errors import ErrorCode, create_error_response
@@ -49,8 +53,8 @@ from .tool_dispatch import CALL_PROXY_META_TOOLS
 from .tools.helpers import raise_tool_error
 
 if TYPE_CHECKING:
-    from fastmcp.server.transforms import GetToolNext
-    from fastmcp.utilities.versions import VersionSpec
+    from ha_mcp._vendor.fastmcp.server.transforms import GetToolNext
+    from ha_mcp._vendor.fastmcp.utilities.versions import VersionSpec
 
 logger = logging.getLogger(__name__)
 
@@ -328,7 +332,7 @@ READ_ONLY_EXEMPT_TOOLS: dict[str, ReadOnlyExemption] = {
 def is_read_safe(tool: Tool) -> bool:
     """Return True when the tool's annotations declare it read-only."""
     annotations = getattr(tool, "annotations", None)
-    return bool(annotations and getattr(annotations, "readOnlyHint", None) is True)
+    return bool(annotations and annotations.read_only_hint is True)
 
 
 def read_only_visible(tool: Tool) -> bool:

{ha_mcp_dev-8.4.3.dev2652 → ha_mcp_dev-8.4.3.dev2654}/src/ha_mcp/redaction.py

@@ -41,7 +41,11 @@ import threading
 from collections.abc import Iterable, Sequence
 from typing import Any
 
-from fastmcp.server.middleware.middleware import CallNext, Middleware, MiddlewareContext
+from ha_mcp._vendor.fastmcp.server.middleware.middleware import (
+    CallNext,
+    Middleware,
+    MiddlewareContext,
+)
 
 from .config import get_global_settings