pypi / fastmcp
fastmcp
What changed in fastmcp 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.
2 breaking3 security2 new APIs and options1 behavior and defaults27 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initfastmcp 434 changes
Breaking changes 2
Certifi-backed server dependencies and optional SDK integrations now require certifi 2026.10.19 or later following the eMudhra CA compromise.
FastMCP 4 uses system trust by default; developers may need to update operating-system, container, custom, and installer trust stores because upgrading FastMCP alone is insufficient.
Security 3
Authorization now applies after component transforms, so transformed components are authorized before use.
OAuth client credentials can be bound to a configured issuer across fresh and cached-token flows. Users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection.
Denied or disabled resources can no longer be served through matching templates.
New APIs and options 2
Adds a foundation for the SEP-2640 Skills extension.
Adds experimental Skills discovery to SkillsDirectoryProvider.
Behavior and default changes 1
The upstream token auth method now defaults to none when there is no client secret, fixing public-client OAuth authentication.
Fixes and other changes 26
Ordinary requests now honor timeout settings in per-server MCP configuration.
Empty session visibility selections are now preserved.
A TimeoutError raised by a tool body's own code is no longer classified as the tool timeout.
Generator results from transform_fn are now materialized when run, fixing handling of generator transforms.
Preserves public metadata in built-in read contents.
Accepts ES256 and other RSA/EC algorithms for CIMD private_key_jwt assertions.
Uses the client timeout when resolving claimed results if no other timeout applies.
Fixes ctx.log() when extra contains names that are attributes of LogRecord.
The MCP-format inspect output follows pagination and escapes server metadata in its text summary.
Keeps fastmcp.json resolvable when deployment.cwd changes the working directory.
Data-backed File resources are named consistently with their MIME subtype.
Respects an explicit is_binary=False value.
FileUpload and session visibility are scoped to a stable client on MCP 2026-07-28.
Adds discovery of Goose Streamable HTTP extensions.
Reports an unbindable OAuth callback port instead of raising SystemExit.
The OAuth callback server no longer requires websockets.
Accepts private_key_jwt without a form client_id.
Python stdio child processes now run in UTF-8 mode.
Synchronous resource templates now run in the threadpool.
Preserves component metadata for list[ResourceContent] returns.
Valid schema defaults are hydrated while invalid defaults are preserved.
Preserves shared dependency scopes without optional task dependencies.
Treats non-string skill frontmatter descriptions as absent.
Raises ToolError when a tool with an output schema returns an unserializable value.
Preserves icons on transformed tools.
The CLI now honors an explicitly specified URL transport.
fastmcp 31 changes
Fixes and other changes 1
Update custom, system, and installer trust stores too; upgrading FastMCP alone is insufficient.