Server accepts self-mount without error

[strawgate]

`mcp.mount(mcp)` is accepted silently, causing infinite recursion when listing tools.

from fastmcp import FastMCP

mcp = FastMCP("test")
mcp.mount(mcp)  # no error

tools = await mcp.list_tools()  # infinite recursion

The `mount()` method has no guard against mounting a server onto itself. A simple identity check would catch this at mount time instead of producing confusing errors later.

[marvin-context-protocol]

Triage

tl;dr — All three gaps are confirmed and have one-line fixes in src/fastmcp/server/server.py. Add guards to mount() for self-mount and non-FastMCP first arg, and to add_middleware() for identity duplicates. Case 3 is the most user-hostile (no error anywhere — list_tools returns [] with only a WARNING log).

• Read FastMCP.mount() and add_middleware() in server.py
• Verify the three reported behaviors
• Check tests covering these paths
• Search for related issues/PRs
• Draft recommendation and action plan

Recommendation

Add three small, targeted guards. They are independent but belong in one PR since they share the same theme (fail loudly on obvious misuse). No deprecation needed — all three inputs are programming errors that today produce silent failures, infinite recursion, or misleading warnings.

# src/fastmcp/server/server.py

def add_middleware(self, middleware: Middleware) -> None:
    if any(m is middleware for m in self.middleware):
        raise ValueError(
            f"Middleware instance {middleware!r} is already registered. "
            "Create a new instance if you intend to run it more than once."
        )
    self.middleware.append(middleware)

def mount(
    self,
    server: FastMCP[LifespanResultT],
    namespace: str | None = None,
    ...
) -> None:
    if not isinstance(server, FastMCP):
        raise TypeError(
            f"mount() expected a FastMCP server as the first argument, got {type(server).__name__}. "
            "Signature is mount(server, namespace=...); did you swap the arguments?"
        )
    if server is self:
        raise ValueError("Cannot mount a FastMCP server onto itself — this would cause infinite recursion.")
    # ... existing body

Use identity (is), not equality, for the duplicate-middleware check — two instances of the same Middleware subclass with different config are legitimate, but the same instance added twice is never intentional.

Findings

mount() — src/fastmcp/server/server.py:1998-2099

• Signature is mount(server: FastMCP, namespace: str | None = None, ...).
• Body performs no runtime type check on server. It is passed directly to FastMCPProvider(server) (src/fastmcp/server/providers/fastmcp_provider.py:500-507), which also doesn't check. The failure only surfaces later when provider._list_tools() calls self.server.list_tools() on the string.
• No self-check of server is self.

add_middleware() — src/fastmcp/server/server.py:478-479

def add_middleware(self, middleware: Middleware) -> None:
    self.middleware.append(middleware)

Unconditional append — no identity check.

Verified behavior (see Verification below):

1. Self-mount: mount(self) accepted silently at mount time. Any later traversal recurses until Python's recursion limit.
2. Duplicate middleware: add_middleware(mw); add_middleware(mw) results in two identical entries in self.middleware; the middleware chain invokes mw twice per request.
3. Wrong arg order mount("child_ns", child): accepted silently; _list_tools logs a WARNING with 'str' object has no attribute 'list_tools' in aggregate.py:124 and returns []. The user gets no exception at all — just missing tools.

No existing tests cover any of these misuse paths (searched tests/server/mount/ and all tests/ for add_middleware.*add_middleware, mount(self), etc.).

Verification

Repro script against current main (7d76074):

=== 1) self-mount ===
mount(self) accepted silently (no runtime error at mount time)

=== 2) duplicate middleware ===
delta: 2
instances of mw: 2

=== 3) wrong arg order ===
mount with string as first arg accepted silently
[WARNING aggregate.py:124] Error during list_tools from provider ... 'str' object has no attribute 'list_tools'
list_tools returned []

All three behaviors match the issue report exactly. Case 3 is arguably the worst UX: the error is buried in a WARNING log and callers see an empty tool list, not an exception.

Detailed Action Plan

1. Edit src/fastmcp/server/server.py

   • In add_middleware (line 478): add the identity check shown above before self.middleware.append(middleware).
   • In mount (line 1998): add the two guards shown above at the top of the body, before the deprecated-prefix handling so that swapped arguments fail cleanly even when prefix= is used. Note: as_proxy=True rebinds server to a FastMCPProxy which is a FastMCP subclass, so ordering the isinstance check at the top is fine.

2. Add tests — create tests/server/test_server_safety.py (or add to existing tests/server/test_server.py):

   • test_mount_self_raises: mcp.mount(mcp) raises ValueError mentioning "itself".
   • test_mount_rejects_non_fastmcp_first_arg: mcp.mount("child_ns", child) raises TypeError mentioning "FastMCP"; message hints at argument order.
   • test_add_middleware_rejects_same_instance_twice: adding the same Middleware instance twice raises ValueError.
   • test_add_middleware_allows_two_instances_of_same_class: constructing two separate instances of the same Middleware subclass and adding both succeeds (regression guard for the identity-vs-equality distinction).
   • test_mount_rejects_non_fastmcp_preserves_prefix_warning_path: passing prefix="x" with a non-FastMCP server still raises TypeError (no FastMCPDeprecationWarning leak).

3. Run the required checks per CLAUDE.md:

   uv sync
   uv run pytest -n auto tests/server/test_server.py  # or the new file
   uv run prek run --all-files

4. PR labeling: this is a bug (silent failures on invalid input). No docs changes required — mount()'s docstring already documents server as FastMCP.

Edge cases to keep in mind:

• FastMCPProxy is a subclass of FastMCP, so isinstance(server, FastMCP) correctly accepts proxies (as_proxy=True path still works).
• The prefix=-only deprecated path still passes server first, so the type check correctly catches swapped args there too.
• Internally-created DereferenceRefsMiddleware (added in __init__ at line 415) is a different instance every time, so the duplicate check won't affect multiple FastMCP() instances sharing the dereference default.

Related Items

Repository	Issue or PR	Relevance
PrefectHQ/fastmcp	#3794	Related composition-time safety issue (context state across mounted servers).
PrefectHQ/fastmcp	#3734	Another "silently corrupts shared state on misuse" bug in mounting.

Related Files

Repository	File	Relevance	Sections
PrefectHQ/fastmcp	src/fastmcp/server/server.py	mount() and add_middleware() — the two methods that need guards.	478-479, 1998-2099
PrefectHQ/fastmcp	src/fastmcp/server/providers/fastmcp_provider.py	FastMCPProvider.__init__ accepts the (un-validated) server; where the eventual runtime error originates.	500-521
PrefectHQ/fastmcp	tests/server/mount/test_mount.py	Natural home for the mount-safety tests (or a sibling test_mount_safety.py).	—

View job run

---

Marvin Context Protocol | Type /marvin to interact further

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.