Skip to content

fix(server): upgrade FastMCP to v3#1388

Open
trentzeigler wants to merge 2 commits into
sooperset:mainfrom
Evernorth:fix/fastmcp-3-cve-upgrade
Open

fix(server): upgrade FastMCP to v3#1388
trentzeigler wants to merge 2 commits into
sooperset:mainfrom
Evernorth:fix/fastmcp-3-cve-upgrade

Conversation

@trentzeigler

Copy link
Copy Markdown

Description

Upgrades FastMCP from 2.x to 3.x to address the FastMCP CVE floor called out in #1234 and updates the server integration for FastMCP 3 API changes.

Fixes: #1234
Fixes: #1348

Changes

  • Raise mcp and fastmcp dependency bounds.
  • Migrate FastMCP tool listing from get_tools() dictionary handling to list_tools() list handling.
  • Update server mounting to use namespace=.
  • Preserve schema compatibility by flattening nested nullable schemas emitted by FastMCP/Pydantic.
  • Update unit tests and tool-doc generation for FastMCP 3 behavior.

Testing

  • Unit tests added/updated
  • Integration tests passed
  • Manual checks performed: uv run pytest -q; uv run pre-commit run --all-files

Checklist

  • Code follows project style guidelines (linting passes).
  • Tests added/updated for changes.
  • All tests pass locally.
  • Documentation updated (if needed).

@szotrj

szotrj commented Jun 20, 2026

Copy link
Copy Markdown

Requesting priority review on this PR. It addresses high-severity security vulnerabilities that are actively blocking development progress. Thanks!

@sarah25ahmed

Copy link
Copy Markdown

@sooperset I am also requesting priority on this PR. Clearly these critical CVEs are blocking multiple users and enterprises and this PR resolves the issue. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Wrong fastmcp requirement [Security]: FastMCP 2.x has 3 unpatched CVEs — upgrade to 3.2.0+ required

3 participants