pypi / fastmcp-slim
fastmcp-slim
What changed in fastmcp-slim 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.
3 breaking5 security2 new APIs and options24 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initfastmcp-slim 433 changes
Breaking changes 2
Certifi-backed server dependencies and optional SDK integrations now require certifi 2026.10.19 or later following the eMudhra CA compromise.
A tool with an output schema now raises ToolError when it returns an unserializable value.
Security 5
FastMCP 4 uses system trust by default; update operating-system, container, custom, and installer trust stores because upgrading FastMCP alone is insufficient.
Set issuer to bind OAuth client credentials to a configured issuer across fresh and cached-token flows; upgrading alone does not enable this protection.
Authorization now applies after component transforms, so transformed components are checked before being served.
Set issuer to bind OAuth client credentials to a configured issuer across fresh and cached-token flows; upgrading alone does not enable this protection.
Denied resources no longer fall through to matching templates, preventing disabled resources from being served.
New APIs and options 2
Adds a foundation for the SEP-2640 Skills extension.
Adds experimental Skills discovery to SkillsDirectoryProvider.
Fixes and other changes 24
Per-server MCP config timeouts are honored for ordinary requests.
Empty session visibility selections are preserved instead of being lost.
A TimeoutError raised by a tool body's own code is no longer classified as the tool timeout.
Generator results from transform_fn are materialized when run, fixing generator transforms.
The upstream token auth method now defaults to none when there is no client secret, fixing public-client OAuth authentication.
CIMD private_key_jwt assertions now accept ES256 and other RSA/EC algorithms.
Falls back to the client timeout when resolving claimed results.
Fixes ctx.log() failures when extra contains names of LogRecord attributes.
The MCP format of fastmcp inspect now follows pagination.
Keeps fastmcp.json resolvable when deployment.cwd changes the working directory.
Data-backed File resources are named consistently with their MIME subtype.
An explicit is_binary=False is now respected.
FileUpload and session visibility are scoped to a stable client on MCP 2026-07-28.
Adds discovery of Goose Streamable HTTP extensions.
An unbindable OAuth callback port is reported instead of causing SystemExit.
The OAuth callback server no longer requires websockets.
Accepts private_key_jwt without a form client_id.
Python stdio child processes now run in UTF-8 mode.
Built-in read contents preserve public metadata.
Component metadata is preserved for list[ResourceContent] returns.
Valid schema defaults are hydrated while invalid defaults are preserved.
Non-string skill frontmatter descriptions are treated as absent.
Icons are preserved on transformed tools.
The CLI now honors an explicitly selected URL transport.
fastmcp-slim 31 changes
Breaking changes 1
FastMCP's HTTP stack now requires certifi 2026.10.19 or later. Update custom, system, and installer trust stores too; upgrading FastMCP alone is insufficient.