FastMCP 3.1 is the Code Mode release. The 3.0 architecture introduced providers and transforms as the extensibility layer — 3.1 puts that architecture to work, shipping the most requested capability since launch: servers that can find and execute code on behalf of agents, without requiring clients to know what tools exist.

Code Mode

Standard MCP has two scaling problems. The entire tool catalog loads into context upfront — with a large server, that's tens of thousands of tokens before the LLM reads a single word of the user's request. And every tool call is a round-trip: the LLM calls a tool, the result flows back through the context window, the LLM reasons about it, calls another tool, and so on. Intermediate results that only exist to feed the next step still burn tokens every time.

CodeMode is an experimental transform that solves both. Instead of seeing your tool catalog directly, the LLM gets meta-tools: it searches for relevant tools on demand (using BM25), inspects their schemas, then writes Python that chains call_tool() calls in a sandbox and returns a final answer. Discovery is staged and targeted; intermediate results never touch the model's context window.

from fastmcp import FastMCP
from fastmcp.experimental.transforms.code_mode import CodeMode

mcp = FastMCP("Server", transforms=[CodeMode()])

Your existing tools don't change — CodeMode wraps them. The default three-stage flow (search → get schemas → execute) is configurable: collapse it to two stages for smaller catalogs, skip discovery entirely for tiny ones. The sandbox supports resource limits on time, memory, and recursion depth.

Read the docs here.

Search Transforms

Code Mode's discovery layer is also available as a standalone transform. SearchTools adds BM25 text search to any server — clients can query against tool names and descriptions and receive ranked results, without needing to know tool names upfront. This is useful anywhere the tool catalog is large, dynamic, or not known in advance.

Prefab Apps

3.1 adds early integration with Prefab, a frontend framework with a Python DSL that compiles to React. The vision: Python developers building MCP servers shouldn't have to leave Python to ship a proper UI. Prefab is still under very active development (their words: "probably shouldn't use it yet"), but the integration is here, the pieces are aligning, and 3.2 is where this gets interesting.

Auth Additions

MultiAuth lets you compose multiple token verification sources into a single auth layer — useful when you need to accept tokens from more than one provider (e.g., internal JWTs alongside a third-party OAuth provider). This release also adds out-of-the-box support for PropelAuth and a Google GenAI sampling handler.

Under the Hood

Heavy imports are now lazy-loaded, meaningfully reducing startup time for servers that don't use every feature. fastmcp run and dev inspector gain a -m/--module flag for module-style invocation, MCPConfigTransport now correctly persists sessions across tool calls, and search_result_serializer gives you a hook to customize how search results are serialized for markdown output. Eight new contributors, and the usual round of fixes.

What's Changed

New Features 🎉

• feat: Search transforms for tool discovery by @jlowin in #3154
• Add experimental CodeMode transform by @aaazzam in #3297
• Add Prefab Apps integration for MCP tool UIs by @jlowin in #3316

Enhancements 🔧

• Lazy-load heavy imports to reduce import time by @jlowin in #3295
• Add http_client parameter to all token verifiers for connection pooling by @jlowin in #3300
• Add in-memory caching for token introspection results by @jlowin in #3298
• Add SessionStart hook to install gh CLI in cloud sessions by @jlowin in #3308
• Fix ty 0.0.19 type errors by @jlowin in #3310
• Code Mode: Add resource limits to MontySandboxProvider by @jlowin in #3326
• Accept transforms as FastMCP init kwarg by @jlowin in #3324
• Split large test files to comply with loq line limit by @jlowin in #3328
• Add -m/--module flag to fastmcp run and dev inspector by @dgenio in #3331
• Add search_result_serializer hook and serialize_tools_for_output_markdown by @MagnusS0 in #3337
• Add MultiAuth for composing multiple token verification sources by @jlowin in #3335
• Adds PropelAuth as an AuthProvider by @andrew-propelauth in #3358
• Replace vendored DI with uncalled-for by @chrisguidry in #3301
• Decompose CodeMode into composable discovery tools by @jlowin in #3354
• feat(contrib): auto-sync MCPMixin decorators with from_function signatures by @AnkeshThakur in #3323
• Add Google GenAI Sampling Handler by @strawgate in #2977
• Add ListTools, search limit, and catalog size annotation to CodeMode by @jlowin in #3359
• Allow configuring FastMCP transport setting in the same way as other configuration by @jvdmr in #1796
• Add include_unversioned option to VersionFilter by @yangbaechu in #3349

Fixes 🐞

• Fix docs banner pushing nav down by @jlowin in #3282
• fix: Replace hardcoded TTL with DEFAULT_TTL_MS - issue #3279 by @cedric57 in #3280
• fix: stop suppressing server stderr in fastmcp call by @jlowin in #3283
• fix: skip max_completion_tokens when maxTokens is None by @eon01 in #3284
• OpenAPI: rewrite $ref under propertyNames and patternProperties in _replace_ref_with_defs; add regression test for dict[StrEnum, Model] by @manojPal23234 in #3306
• Remove stale add_resource() key parameter from docs by @jlowin in #3309
• Handle AuthorizationError as exclusion in AuthMiddleware list hooks by @yangbaechu in #3338
• Fix flaky OpenAPI performance test threshold by @jlowin in #3355
• Fix flaky SSE timeout test by @jlowin in #3343
• Remove system role references from docs by @jlowin in #3356
• Fix session persistence across tool calls in multi-server MCPConfigTransport by @jer805 in #3330

Docs 📚

• Add v3.0.2 release notes by @jlowin in #3276
• Fix "FastMCP Constructor Parameters" in documentation server.mdx (Remove old parameters & Add new parameter) by @wangyy04 in #3317
• Fix stale docs: tag filtering API and missing output_schema param by @jlowin in #3322
• Narrate search example clients by @jlowin in #3321
• Code Mode: Document resource limits and fix docs formatting by @jlowin in #3327
• Add reverse proxy (nginx) section to HTTP deployment docs by @dgenio in #3344
• Restructure docs navigation: CLI section, Composition, More by @jlowin in #3361

Other Changes 🦾

• Don't advertise sampling.tools capability by default by @jlowin in #3334

New Contributors

• @cedric57 made their first contribution in #3280
• @eon01 made their first contribution in #3284
• @manojPal23234 made their first contribution in #3306
• @wangyy04 made their first contribution in #3317
• @yangbaechu made their first contribution in #3338
• @andrew-propelauth made their first contribution in #3358
• @jer805 made their first contribution in #3330
• @jvdmr made their first contribution in #1796

Full Changelog: v3.0.2...v3.1.0

Two community-contributed fixes: auth headers from MCP transport no longer leak through to downstream OpenAPI APIs, and background task workers now correctly receive the originating request ID. Plus a new docs example for context-aware tool factories.

What's Changed

Fixes 🐞

• fix: prevent MCP transport auth header from leaking to downstream OpenAPI APIs (#3260) by @stakeswky in #3262
• fix: propagate origin_request_id to background task workers by @gfortaine in #3175

Docs 📚

• Add v3.0.1 release notes by @jlowin in #3259
• docs: add context-aware tool factory example by @machov in #3264

New Contributors

• @stakeswky made their first contribution in #3262
• @machov made their first contribution in #3264

Full Changelog: v3.0.1...v3.0.2

First patch after 3.0 — mostly smoothing out rough edges discovered in the wild. The big ones: middleware state that wasn't surviving the trip to tool handlers now does, Tool.from_tool() accepts callables again, OpenAPI schemas with circular references no longer crash discovery, and decorator overloads now return the correct types in function mode. Also adds verify_id_token to OIDCProxy for providers (like some Azure AD configs) that issue opaque access tokens but standard JWT id_tokens.

What's Changed

Enhancements 🔧

• Add verify_id_token option to OIDCProxy by @jlowin in #3248

Fixes 🐞

• Fix v3.0.0 changelog compare link by @jlowin in #3223
• Fix MDX parse error in upgrade guide prompts by @jlowin in #3227
• Fix non-serializable state lost between middleware and tools by @jlowin in #3234
• Accept callables in Tool.from_tool() by @jlowin in #3235
• Preserve skill metadata through provider wrapping by @jlowin in #3237
• Fix circular reference crash in OpenAPI schemas by @jlowin in #3245
• Fix NameError with future annotations and Context/Depends parameters by @jlowin in #3243
• Fix ty ignore syntax in OpenAPI provider by @jlowin in #3253
• Use max_completion_tokens instead of deprecated max_tokens in OpenAI handler by @jlowin in #3254
• Fix ty compatibility with upgraded deps by @jlowin in #3257
• Fix decorator overload return types for function mode by @jlowin in #3258

Docs 📚

• Sync README with welcome.mdx, fix install count by @jlowin in #3224
• Document dict-to-Message prompt migration in upgrade guides by @jlowin in #3225
• Fix v2 upgrade guide: remove incorrect v1 import advice by @jlowin in #3226
• Animated banner by @jlowin in #3231
• Document mounted server state store isolation in upgrade guide by @jlowin in #3236

Full Changelog: v3.0.0...v3.0.1

FastMCP 3.0 is stable. Two betas, two release candidates, 21 new contributors, and more than 100,000 pre-release installs later — the architecture held up, the upgrade path was smooth, and we're shipping it.

The surface API is largely unchanged — @mcp.tool() still works exactly as before. What changed is everything underneath: a provider/transform architecture that makes FastMCP extensible, observable, and composable in ways v2 couldn't support. If we did our jobs right, you'll barely notice the redesign. You'll just notice that more is possible.

This is also the release where FastMCP moves from jlowin/fastmcp to PrefectHQ/fastmcp. GitHub forwards all links, PyPI is the same, imports are the same. A major version felt like the right moment to make it official.

Build servers from anything

🔌 Components no longer have to live in one file with one server. FileSystemProvider discovers tools from directories with hot-reload. OpenAPIProvider wraps REST APIs. ProxyProvider proxies remote MCP servers. SkillsProvider delivers agent skills as resources. Write your own provider for whatever source makes sense. Compose multiple providers into one server, share one across many, or chain them with transforms that rename, namespace, filter, version, and secure components as they flow to clients. ResourcesAsTools and PromptsAsTools expose non-tool components to tool-only clients.

Ship to production

🔐 Component versioning: serve @tool(version="2.0") alongside older versions from one codebase. Granular authorization on individual components with async auth checks, server-wide policies via AuthMiddleware, and scope-based access control. OAuth gets CIMD, Static Client Registration, Azure OBO via dependency injection, JWT audience validation, and confused-deputy protections. OpenTelemetry tracing with MCP semantic conventions. Response size limiting. Background tasks with distributed Redis notification and ctx.elicit() relay. Security fixes include dropping diskcache (CVE-2025-69872) and upgrading python-multipart and protobuf for additional CVEs.

Adapt per session

💾 Session state persists across requests via ctx.set_state() / ctx.get_state(). ctx.enable_components() and ctx.disable_components() let servers adapt dynamically per client — show admin tools after authentication, progressively reveal capabilities, or scope access by role.

Develop faster

⚡ --reload auto-restarts on file changes. Standalone decorators return the original function, so decorated tools stay callable in tests and non-MCP contexts. Sync functions auto-dispatch to a threadpool. Tool timeouts, MCP-compliant pagination, composable lifespans, PingMiddleware for keepalive, and concurrent tool execution when the LLM returns multiple calls in one response.

Use FastMCP as a CLI

🖥️ fastmcp list and fastmcp call query and invoke tools on any server from a terminal. fastmcp discover scans your editor configs (Claude Desktop, Cursor, Goose, Gemini CLI) and finds configured servers by name. fastmcp generate-cli writes a standalone typed CLI where every tool is a subcommand. fastmcp install registers your server with Claude Desktop, Cursor, or Goose in one command.

Build apps (3.1 preview)

📱 Spec-level support for MCP Apps is in: ui:// resource scheme, typed UI metadata via AppConfig, extension negotiation, and runtime detection. The full Apps experience lands in 3.1.

If you hit 3.0 because you didn't pin your dependencies and something breaks — the upgrade guides will get you sorted. We minimized breaking changes, but a major version is a major version.

pip install fastmcp -U

📖 Documentation
🚀 Upgrade from FastMCP v2
🔀 Upgrade from MCP Python SDK
📰 What's New in FastMCP 3.0

What's Changed

New Features 🎉

• Refactor resource behavior and add meta support by @jlowin in #2611
• Refactor prompt behavior and add meta support by @jlowin in #2610
• feat: Provider abstraction for dynamic MCP components by @jlowin in #2622
• Unify component storage in LocalProvider by @jlowin in #2680
• Introduce ResourceResult as canonical resource return type by @jlowin in #2734
• Introduce Message and PromptResult as canonical prompt types by @jlowin in #2738
• Add --reload flag for auto-restart on file changes by @jlowin in #2816
• Add FileSystemProvider for filesystem-based component discovery by @jlowin in #2823
• Add standalone decorators and eliminate fastmcp.fs module by @jlowin in #2832
• Add authorization checks to components and servers by @jlowin in #2855
• Decorators return functions instead of component objects by @jlowin in #2856
• Add transform system for modifying components in provider chains by @jlowin in #2836
• Add OpenTelemetry tracing support by @chrisguidry in #2869
• Add component versioning and VersionFilter transform by @jlowin in #2894
• Add version discovery and calling a certain version for components by @jlowin in #2897
• Refactor visibility to mark-based enabled system by @jlowin in #2912
• Add session-specific visibility control via Context by @jlowin in #2917
• Add Skills Provider for exposing agent skills as MCP resources by @jlowin in #2944
• Add MCP Apps Phase 1 — SDK compatibility (SEP-1865) by @jlowin in #3009
• Add fastmcp list and fastmcp call CLI commands by @jlowin in #3054
• Add fastmcp generate-cli command by @jlowin in #3065
• Add CIMD (Client ID Metadata Document) support for OAuth by @jlowin in #2871

Enhancements 🔧

• Convert mounted servers to MountedProvider by @jlowin in #2635
• Simplify .key as computed property by @jlowin in #2648
• Refactor MountedProvider into FastMCPProvider + TransformingProvider by @jlowin in #2653
• Enable background task support for custom component subclasses by @jlowin in #2657
• Use CreateTaskResult for background task creation by @jlowin in #2660
• Refactor provider execution: components own their execution by @jlowin in #2663
• Add supports_tasks() method to replace string mode checks by @jlowin in #2664
• Replace type: ignore[attr-defined] with isinstance assertions in tests by @jlowin in #2665
• Add poll_interval to TaskConfig by @jlowin in #2666
• Refactor task module: rename protocol.py to requests.py and reduce redundancy by @jlowin in #2667
• Refactor FastMCPProxy into ProxyProvider by @jlowin in #2669
• Move OpenAPI to providers/openapi submodule by @jlowin in #2672
• Use ergonomic provider initialization pattern by @jlowin in #2675
• Fix ty 0.0.5 type errors by @jlowin in #2676
• Remove execution methods from Provider base class by @jlowin in #2681
• Add type-prefixed keys for globally unique component identification by @jlowin in #2704
• Skip parallel MCP config test on Windows by @jlowin in #2711
• Consolidate notification system with unified API by @jlowin in #2710
• Skip test_multi_client on Windows by @jlowin in #2714
• Parallelize provider operations by @jlowin in #2716
• Consolidate get_* and list* methods into single API by @jlowin in #2719
• Consolidate execution method chains into single public API by @jlowin in #2728
• Add documentation check to required PR workflow by @jlowin in #2730
• Parallelize list_* calls in Provider.get_tasks() by @jlowin in #2731
• Consistent decorator-based MCP handler registration by @jlowin in #2732
• Make ToolResult a BaseModel for serialization support by @jlowin in #2736
• Align prompt handler with resource pattern by @jlowin in #2740
• Update class...

FastMCP 3 rc3 is being released solely to ensure that the release pipeline is intact from the new repo. If successful, it will be followed immediately by 3.0 GA.

RC2 is a small release with a bugfix and a breaking change (that should have been in RC1): fastmcp dev is now a subcommand group, with the inspector moving to fastmcp dev inspector. We're planning to add new dev tools — mock servers, apps testing — that the Inspector alone can't handle, and this is the right time to claim the CLI namespace.

What's Changed

Fixes 🐞

• Fix include_tags/exclude_tags ignored without tools in MCPConfig by @jlowin in #3186

Breaking Changes 🛫

• Move fastmcp dev to fastmcp dev inspector by @jlowin in #3188

Dependencies 📦

• chore(deps): bump cryptography from 46.0.4 to 46.0.5 in the uv group across 1 directory by @dependabot[bot] in #3147

Full Changelog: v3.0.0rc1...v3.0.0rc2

FastMCP 3 RC1 means we believe the API is stable. Beta 2 drew a wave of real-world adoption — production deployments, migration reports, integration testing — and the feedback overwhelmingly confirmed that the architecture works. This release closes gaps that surfaced under load: auth flows that needed to be async, background tasks that needed reliable notification delivery, and APIs still carrying beta-era naming. If nothing unexpected surfaces, this is what 3.0.0 looks like.

🚨 Breaking Changes — The ui= parameter is now app= with a unified AppConfig class (matching the feature's actual name), and 16 FastMCP() constructor kwargs have finally been removed. If you've been ignoring months of deprecation warnings (not you, reader, I'm talking about other users), you'll get a TypeError with specific migration instructions.

🔐 Auth Improvements — Three changes that together round out FastMCP's auth story for production. auth= checks can now be async, so you can hit databases or external services during authorization — previously, passing an async function silently passed because the unawaited coroutine was truthy. Static Client Registration lets clients provide a pre-registered client_id/client_secret directly, bypassing DCR for servers that don't support it. And Azure OBO flows are now declarative via dependency injection:

from fastmcp.server.auth.providers.azure import EntraOBOToken

@mcp.tool()
async def get_emails(
    graph_token: str = EntraOBOToken(["https://graph.microsoft.com/Mail.Read"]),
):
    # OBO exchange already happened — just use the token
    ...

⚡ Concurrent Sampling — When an LLM returns multiple tool calls in a single response, context.sample() can now execute them in parallel. Opt in with tool_concurrency=0 for unlimited parallelism, or set a bound. Tools that aren't safe to parallelize can declare sequential=True.

📡 Background Task Notifications — Background tasks now reliably push progress updates and elicit user input through the standard MCP protocol. A distributed Redis queue replaces polling (7,200 round-trips/hour → one blocking call), and ctx.elicit() in background tasks automatically relays through the client's standard elicitation_handler.

✅ OpenAPI Output Validation — When backends don't conform to their own OpenAPI schemas, the MCP SDK rejects the response and the tool fails. validate_output=False disables strict schema checking while still passing structured JSON to clients — a necessary escape hatch for imperfect APIs.

What's Changed

Enhancements 🔧

• generate-cli: auto-generate SKILL.md agent skill by @jlowin in #3115
• Scope Martian triage to bug-labeled issues for jlowin by @jlowin in #3124
• Add Azure OBO dependencies, auth token injection, and documentation by @jlowin in #2918
• feat: add Static Client Registration (#3085) by @martimfasantos in #3086
• Add concurrent tool execution with sequential flag by @strawgate in #3022
• Add validate_output option for OpenAPI tools by @jlowin in #3134
• Relay task elicitation through standard MCP protocol by @chrisguidry in #3136
• Bump py-key-value-aio to >=0.4.0,<0.5.0 by @strawgate in #3143
• Support async auth checks by @jlowin in #3152
• Make $ref dereferencing optional via FastMCP(dereference_refs=...) by @jlowin in #3151
• Expose local_provider property, deprecate FastMCP.remove_tool() by @jlowin in #3155
• Add helpers for converting FunctionTool and TransformedTool to SamplingTool by @strawgate in #3062
• Updates to github actions / workflows for claude by @strawgate in #3157

Fixes 🐞

• Updated deprecation URL for V3 by @SrzStephen in #3108
• Fix Windows test timeouts in OAuth proxy provider tests by @strawgate in #3123
• Fix session visibility marks leaking across sessions by @jlowin in #3132
• Fix unhandled exceptions in OpenAPI POST tool calls by @jlowin in #3133
• feat: distributed notification queue + BLPOP elicitation for background tasks by @gfortaine in #2906
• fix: snapshot access token for background tasks (#3095) by @gfortaine in #3138
• Stop duplicating path parameter descriptions into tool prose by @jlowin in #3149
• fix: guard client pagination loops against misbehaving servers by @jlowin in #3167
• Fix stale get_* references in docs and examples by @jlowin in #3168
• Support non-serializable values in Context.set_state by @jlowin in #3171
• Fix stale request context in StatefulProxyClient handlers by @jlowin in #3172

Breaking Changes 🛫

• Rename ui= to app= and consolidate ToolUI/ResourceUI into AppConfig by @jlowin in #3117
• Remove deprecated FastMCP() constructor kwargs by @jlowin in #3148

Docs 📚

• Update docs to reference beta 2 by @jlowin in #3112
• docs: add pre-registered OAuth clients to v3-features by @jlowin in #3129
• docs: update all references from 3.0.0b2 to 3.0.0rc1 by @jlowin in #3173

Dependencies 📦

• chore(deps): bump cryptography from 46.0.3 to 46.0.5 in /examples/testing_demo in the uv group across 1 directory by @dependabot[bot] in #3140

Other Changes 🦾

• docs: add v3.0.0rc1 features to v3-features tracking by @jlowin in #3145
• docs: remove nonexistent MSALApp from rc1 notes by @jlowin in #3146

New Contributors

• @martimfasantos made their first contribution in #3086

Full Changelog: v3.0.0b2...v3.0.0rc1

FastMCP 3 Beta 2 reflects the huge number of people that have kicked the tires on Beta 1. Seven new contributors landed changes in this release, and early migration reports have gone even smoother than expected, including teams on Prefect Horizon upgrading from v2. All of which makes a strong case for moving toward a stable release. As such, most of Beta 2 is refinement: fixing what people found, filling gaps from real usage, hardening edges. But a few new features did land along the way.

🖥️ Client CLI — fastmcp list, fastmcp call, fastmcp discover, and fastmcp generate-cli turn any MCP server into something you can poke at from a terminal. Discover servers configured in Claude Desktop, Cursor, Goose, or project-level mcp.json files and reference them by name. generate-cli reads a server's schemas and writes a standalone typed CLI script where every tool is a proper subcommand with flags and help text.

🔐 CIMD (Client ID Metadata Documents) adds an alternative to Dynamic Client Registration for OAuth. Clients host a static JSON document at an HTTPS URL; that URL becomes the client_id. Server-side support includes SSRF-hardened fetching, cache-aware revalidation, and private_key_jwt validation. Enabled by default on OAuthProxy.

📱 MCP Apps — Spec-level compliance for the MCP Apps extension: ui:// resource scheme, typed UI metadata on tools and resources, extension negotiation, and ctx.client_supports_extension() for runtime detection. This is the foundation layer; FastMCP's full Apps experience is coming soon...

⏳ Background Task Context — Context now works transparently in Docket workers. ctx.elicit() routes through Redis-based coordination so background tasks can pause for user input without any code changes.

🛡️ ResponseLimitingMiddleware caps tool response sizes with UTF-8-safe truncation for text and schema-aware error handling for structured outputs.

🪿 Goose Integration — fastmcp install goose generates deeplink URLs for one-command server installation into Goose.

What's Changed

New Features 🎉

• Add MCP Apps Phase 1 — SDK compatibility (SEP-1865) by @jlowin in #3009
• Add fastmcp list and fastmcp call CLI commands by @jlowin in #3054
• Add fastmcp generate-cli command by @jlowin in #3065
• Add CIMD (Client ID Metadata Document) support for OAuth by @jlowin in #2871

Enhancements 🔧

• Make duplicate bot less aggressive by @jlowin in #2981
• Remove uv lockfile monitoring from Dependabot by @jlowin in #2986
• Run static checks with --upgrade, remove lockfile check by @jlowin in #2988
• Adjust workflow triggers for Marvin by @strawgate in #3010
• Move tests to a reusable action and enable nightly checks by @strawgate in #3017
• feat: option to add upstream claims to the FastMCP proxy JWT by @JonasKs in #2997
• Fix ty 0.0.14 compatibility and upgrade dependencies by @jlowin in #3027
• fix: automatically include offline_access as a scope in the Azure provider to enable automatic token refreshing by @JonasKs in #3001
• feat: expand --reload to watch frontend file types by @jlowin in #3028
• Add fastmcp install stdio command by @jlowin in #3032
• Update martian-issue-triage.yml for Workflow editing guidance by @strawgate in #3033
• feat: Goose integration + dedicated install command by @jlowin in #3040
• [Doc]: fixing spelling issues in multiple files by @didier-durand in #2996
• Add fastmcp discover and name-based server resolution by @jlowin in #3055
• feat(context): Add background task support for Context (SEP-1686) by @gfortaine in #2905
• Add server version to banner by @richardkmichael in #3076
• Add @handle_tool_errors decorator for standardized error handling by @dgenio in #2885
• Update Anthropic and OpenAI clients to use Omit instead of NotGiven by @jlowin in #3088
• Add ResponseLimitingMiddleware for tool response size control by @dgenio in #3072
• Infer MIME types from OpenAPI response definitions by @jlowin in #3101
• Remove require_auth in favor of scope-based authorization by @jlowin in #3103

Fixes 🐞

• Fix FastAPI mounting examples in docs by @jlowin in #2962
• Remove outdated 'FastMCP 3.0 is coming!' CLI banner by @jlowin in #2974
• Pin httpx < 1.0 and simplify beta install docs by @jlowin in #2975
• Add enabled field to ToolTransformConfig by @jlowin in #2991
• fix phue2 import in smart_home example by @zzstoatzz in #2999
• fix: broaden combine_lifespans type to accept Mapping return types by @aminsamir45 in #3005
• fix: type narrowing for skills resource contents by @strawgate in #3023
• fix: correctly send resource when exchanging code for the upstream to… by @JonasKs in #3013
• MCP Apps: structured CSP/permissions types, resource meta propagation fix, QR example by @jlowin in #3031
• chore: upgrade python-multipart to 0.0.22 (CVE-2026-24486) by @jlowin in #3042
• chore: upgrade protobuf to 6.33.5 (CVE-2026-0994) by @jlowin in #3043
• fix: use MCP spec error code -32002 for resource not found by @jlowin in #3041
• Fix tool_choice reset for structured output sampling by @strawgate in #3014
• Fix workflow notification URL formatting in upgrade checks by @strawgate in #3047
• Fix Field() handling in prompts by @strawgate in #3050
• fix: use SkipJsonSchema to exclude callable fields from JSON schema generation by @strawgate in #3048
• fix: Preserve metadata in FastMCPProvider component wrappers by @NeelayS in #3057
• Mock network calls in CLI tests and use MemoryStore for OAuth tests by @strawgate in #3051
• Remove OpenAPI timeout parameter, make client optional, surface timeout errors by @jlowin in #3067
• fix: enforce redirect URI validation when allowed_client_redirect_uris is supplied by @nathanwelsh8 in #3066
• Fix --reload port conflict when using explicit port by @jlowin in #3070
• Fix compress_schema to preserve additionalProperties: false for MCP compatibility by @jlowin in #3102
• Fix CIMD redirect allowlist bypass and cache revalidation by @jlowin in #3098
• Exclude content-type from get_http_headers() to prevent HTTP 415 errors by @jlowin in #3104

Docs 📚

• Prepare docs for v3.0 beta release by @jlowin in #2954
• Restructure docs: move transforms to dedicated section by @jlowin in #2956
• Remove unecessary pip warning by @jlowin in #2958
• Update example MCP version in installation docs by @jlowin in #2959
• Update brand images by @jlowin in #2960
• Restructure README and welcome page with motivated narrative by @jlowin in #2963
• Restructure README and docs with motivated narrative by @jlowin in #2964
• Favicon update and Prefect Horizon docs by @jlowin in #2978
• Add dependency injection documentation and DI-style dependencies by @jlowin in #2980
• docs: document expanded reload behavior and restructure beta sections by @jlowin in #3039
• Add output_schema caveat to response limiting docs by @jlowin in #3099
• Document token passthrough security in OAuth Proxy docs by @jlowin in #3100

Dependencies 📦

• Bump ty from 0.0.12 to 0.0.13 by @dependabot[bot] in #2984
• Bump prek from 0.2.30 to 0.3.0 by @dependabot[bot] in #2982

Other Changes 🦾

• Normalize resource URLs before comparison to support RFC 8707 query parameters by @abhijeethp in #2967
• Bump pydocket to 0.17.2 (memory leak fix) by @chrisguidry in #2998
• Add AzureJWTVerifier for Managed Identity token verification by @jlowin in https://github.co...

Fixes a memory leak in the memory:// docket broker where cancelled tasks accumulated instead of being cleaned up. Bumps pydocket to ≥0.17.2.

What's Changed

Enhancements 🔧

• Bump pydocket to 0.17.2 (memory leak fix) by @chrisguidry in #2992

Docs 📚

• Add release notes for v2.14.4 and v2.14.5 by @jlowin in #3063

Full Changelog: v2.14.4...v2.14.5

This patch release fixes a fresh install bug where the packaging library was previously installed as a transitive dependency but is no longer—causing an import error on fresh installs without dev dependencies. Also includes a pydocket version pin to avoid Redis connection noise in tests, plus backports from 3.x for $ref dereferencing in tool schemas and the task capabilities location fix.

What's Changed

Enhancements 🔧

• Add release notes for v2.14.2 and v2.14.3 by @jlowin in #2851

Fixes 🐞

• Backport: Dereference $ref in tool schemas for MCP client compatibility by @jlowin in #2861
• Fix task capabilities location (issue #2870) by @jlowin in #2874
• Add missing packaging dependency by @jlowin in #2989

Full Changelog: v2.14.3...v2.14.4