FastMCP Files

Component authorization now applies after transforms, denied resources cannot fall through matching templates, and OAuth client credentials providers support issuer binding across fresh and cached-token flows. Existing configurations remain compatible, but users of ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider must set issuer to enable this protection; upgrading alone is insufficient. Thanks to our 18 contributors, including 9 first-time contributors.

What's Changed

Security 🔒

• Authorize transformed components and prevent denied-resource template fallback by @zzstoatzz and @rishid in https://github.com/PrefectHQ/fastmcp/pull/5933
• Bind OAuth client credentials to a configured issuer, including cached-token renewal, by @zzstoatzz and @LHMisme420 in https://github.com/PrefectHQ/fastmcp/pull/5933

Enhancements ✨

• Add SEP-2640 Skills extension foundation by @strawgate in https://github.com/PrefectHQ/fastmcp/pull/5057
• Write down triage and merge norms in docs/development by @zzstoatzz in https://github.com/PrefectHQ/fastmcp/pull/5872
• Add experimental Skills discovery to SkillsDirectoryProvider by @zzstoatzz in https://github.com/PrefectHQ/fastmcp/pull/5704

Fixes 🐞

• Do not require websockets for the OAuth callback server by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5693
• Keep fastmcp.json resolvable when deployment.cwd changes the working directory by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5700
• Fix ctx.log() failing when extra contains LogRecord attribute names by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5688
• Use a monotonic clock in the rate limiters by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5689
• Escape server metadata in the fastmcp inspect text summary by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5701
• Respect an explicit is_binary=False on FileResource by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5696
• Follow pagination in the MCP format of fastmcp inspect by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5691
• Visit each reference once when finding access-restricted properties by @AarnavNoble in https://github.com/PrefectHQ/fastmcp/pull/5751
• Run sync resource templates in the threadpool by @hardness1020 in https://github.com/PrefectHQ/fastmcp/pull/5742
• Require openapi-pydantic 0.6.0 so OpenAPI 3.1.2 specs load by @jsphbtst in https://github.com/PrefectHQ/fastmcp/pull/5647
• Scope FileUpload and session visibility to a stable client on MCP 2026-07-28 by @zzstoatzz in https://github.com/PrefectHQ/fastmcp/pull/5651
• fix(auth): accept private_key_jwt without form client_id by @HootRock and @imranq2 in https://github.com/PrefectHQ/fastmcp/pull/5832
• fix(cli): honor explicit URL transport by @mikamikasuki in https://github.com/PrefectHQ/fastmcp/pull/5529
• Remove legacy logging state when HTTP sessions close by @mikamikasuki in https://github.com/PrefectHQ/fastmcp/pull/5539
• Name data-backed File resources consistently with their MIME subtype by @nandanadileep in https://github.com/PrefectHQ/fastmcp/pull/5568
• fix(client): run Python stdio children in UTF-8 mode by @ningmao-hlyz in https://github.com/PrefectHQ/fastmcp/pull/5642
• Report an unbindable OAuth callback port instead of SystemExit by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5692
• Accept ES256 and other RSA/EC algorithms for CIMD private_key_jwt assertions by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5695
• Preserve icons on transformed tools by @asasemahmed in https://github.com/PrefectHQ/fastmcp/pull/5702
• Hydrate valid schema defaults while preserving invalid defaults by @nandanadileep in https://github.com/PrefectHQ/fastmcp/pull/5738
• fix(resources): preserve public metadata in built-in read contents by @HootRock in https://github.com/PrefectHQ/fastmcp/pull/5778
• Preserve shared dependency scopes without optional task dependencies by @HootRock and @BlueX888 in https://github.com/PrefectHQ/fastmcp/pull/5817
• fix: treat non-string skill frontmatter descriptions as absent by @BlueX888 in https://github.com/PrefectHQ/fastmcp/pull/5823
• fix(resources): preserve component meta for list[ResourceContent] returns by @BlueX888 in https://github.com/PrefectHQ/fastmcp/pull/5843
• Fall back to the client timeout when resolving claimed results by @marcinbelczewski in https://github.com/PrefectHQ/fastmcp/pull/5190
• Discover Goose Streamable HTTP extensions by @jiuyueQ and @ch-z-hc in https://github.com/PrefectHQ/fastmcp/pull/5582
• Raise ToolError when a tool with an output schema returns an unserializable value by @massimiliano1991 in https://github.com/PrefectHQ/fastmcp/pull/5063
• Stop deploy tests from spawning PowerShell on every state access by @zzstoatzz in https://github.com/PrefectHQ/fastmcp/pull/5874
• Give the timeout-override test headroom for the follow-up tools/list by @zzstoatzz in https://github.com/PrefectHQ/fastmcp/pull/5875
• Keep disabled resources from being served by matching templates by @zzstoatzz in https://github.com/PrefectHQ/fastmcp/pull/5876

Docs 📚

• Fix codespell typo in v4.1.1 changelog by @zzstoatzz in https://github.com/PrefectHQ/fastmcp/pull/5818
• context: stop documenting session_id as a cross-request key by @zzstoatzz in https://github.com/PrefectHQ/fastmcp/pull/5862

Examples & Contrib 💡

• fix(contrib): preserve BulkToolCaller tool prefixes by @mikamikasuki in https://github.com/PrefectHQ/fastmcp/pull/5555

Other Changes 🦾

• chore(deps): Update github actions by @prefect-renovate[bot] in https://github.com/PrefectHQ/fastmcp/pull/5707

New Contributors

• @AarnavNoble made their first contribution in https://github.com/PrefectHQ/fastmcp/pull/5751
• @hardness1020 made their first contribution in https://github.com/PrefectHQ/fastmcp/pull/5742
• @jsphbtst made their first contribution in https://github.com/PrefectHQ/fastmcp/pull/5647
• @marcinbelczewski made their first contribution in https://github.com/PrefectHQ/fastmcp/pull/5190
• @jiuyueQ made their first contribution in https://github.com/PrefectHQ/fastmcp/pull/5582

• @massimiliano1991 made their first contribution in https://github.com/PrefectHQ/fastmcp/pull/5063

• @imranq2 made their first contribution in https://github.com/PrefectHQ/fastmcp/pull/5832

• @rishid made their first contribution in https://github.com/PrefectHQ/fastmcp/pull/5933
• @LHMisme420 made their first contribution in https://github.com/PrefectHQ/fastmcp/pull/5933

Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v4.1.1...v4.1.2