Create logo HTML. Args: icon_url: Optional custom icon URL. If not provided, uses the FastMCP logo. alt_text: Alt text for the lo

Create an OAuth callback server. Args: port: The port to run the server on callback_path: The path to listen for OAuth redir

Helper to create a FastMCP server with OpenAPIProvider.

Helper to create a FastMCP server with OpenAPIProvider.

Create an HTMLResponse with security headers. Adds X-Frame-Options: DENY to prevent clickjacking attacks per MCP security best practices.

Create an INTERNAL span for provider delegation. Used by FastMCPProvider when delegating to mounted servers. Automatically records any except

Discover files, import modules, and extract components. This is the main entry point for filesystem-based discovery. Args: root: Roo

Run all scanners and return the combined results. Duplicate names across sources are preserved — callers can use :pyattr:`DiscoveredServer.qu

Exchange authorization code for FastMCP-issued tokens. Implements the token factory pattern: 1. Retrieves upstream tokens from stored

Format server information according to the specified format. Args: mcp: The FastMCP instance format: Output format ("fastmcp" or

Format IP address for use in URL (bracket IPv6 addresses). IPv6 addresses must be bracketed in URLs to distinguish the address from the port

Convert a boolean task flag to a TaskConfig.

Extract headers from the current HTTP request if available. Never raises an exception, even if there is no active HTTP request (in which case

Get the latest version of FastMCP from PyPI, using cache when available. Args: include_prereleases: If True, include pre-release versions

Get all recorded notifications, optionally filtered by method.

Get resource by transformed URI with all transforms applied. Note: This method does NOT filter disabled components. The Server (FastM

Get resource template by transformed URI with all transforms applied. Note: This method does NOT filter disabled components. The Server

Get task-eligible components with all transforms applied. Overrides AggregateProvider.get_tasks() to apply server-level transforms af

Get tool by transformed name with all transforms applied. Note: This method does NOT filter disabled components. The Server (FastMCP)

Fetch the real tool catalog, bypassing this transform. The result is deduplicated by name so that only the highest version of each to

Return a spec that satisfies both this spec and other. Used by transforms to combine caller constraints with filter constraints. For

Check if a request is allowed.

Check if a string is a URL.

List tools available on an MCP server. Examples: fastmcp list http://localhost:8000/mcp fastmcp list server.py fastmcp li

Retrieve all prompts available on the server. This method automatically fetches all pages if the server paginates results, returning

Apply transforms to matching tools.

Validate FastMCP JWT by swapping for upstream token. This implements the token swap pattern: 1. Verify FastMCP JWT signature (proves

Load config from server_spec and apply CLI overrides. This consolidates the config parsing logic that was duplicated across run, inspect, and

Implement retry logic for requests.

Apply rate limiting to requests.

Parse the OpenAPI schema into HTTP routes.

Extract the hash from a Prefab renderer URI, or None.

Registers all marked tools, resources, and prompts with the server. This method calls ``register_tools``, ``register_resources``, and

Remove tool(s) from the server. .. deprecated:: Use ``mcp.local_provider.remove_tool(name)`` instead. Args:

Clear all recorded notifications.

Clear all session visibility rules. Use this to reset session visibility back to global defaults. Sends notifications to this sessio

Send a logging/setLevel request.

Bind the default verifier's audience to this server's resource URL. AuthKit with Resource Indicators (RFC 8707) mints tokens whose ``aud``

Determine if an issue should be closed for needing an MRE.

Convert to MCP ImageContent.

Convert to MCP PromptMessage.

Convert to MCP GetPromptResult.

Convert the resource to an SDKResource.

Validate that a function is compatible with this task config.

Validate JWT assertion for private_key_jwt auth. Args: assertion: JWT assertion string from client client: OAuth prox

Validate that a server name is safe for use as a subprocess argument. Raises SystemExit if the name contains shell metacharacters.

Construct the upstream IdP authorization URL using stored transaction data.

Create an OAuth2 client for communicating with the upstream IdP. This is the single point for constructing the client used in token e

Scan root directories and create SkillProvider per valid skill folder.

Coerce a callable into a Tool, respecting @tool decorator metadata.

Combine tool name, description, and parameter info into searchable text.

Pretty-print a tool call result to the console.

Format a message for logging.

Retrieves all methods marked for a specific registration type.

Return the key used to partition file storage. Defaults to ``ctx.session_id``, which is stable for stdio, SSE, and stateful HTTP. The

Get a specific tool by name. Default implementation filters _list_tools() and picks the highest version that matches the spec.

Ensure the name is unique by appending numbers if needed.

Handle callback from upstream IdP and forward to client. This implements the DCR-compliant callback forwarding: 1. Receive IdP callba

Convert MCP ImageContent to Anthropic ImageBlockParam.

Convert MCP ImageContent to OpenAI image_url content part.

Load stored tokens and client info, properly setting token expiry.

True if *tool* was marked as needing a Prefab renderer at registration.

Return all available prompts. Override to provide prompts dynamically. Returns ALL versions of all prompts. The server handles dedupl

Return all available resource templates. Override to provide resource templates dynamically. Returns ALL versions. The server handles

Return all available resources. Override to provide resources dynamically. Returns ALL versions of all resources. The server handles

List all available resources, in the format expected by the low-level MCP server. Supports pagination when list_page_size is configur

Return all available tools. Override to provide tools dynamically. Returns ALL versions of all tools. The server handles deduplicatio

List all tools from the remote server.

Make a cache key for a tool call using a stable hash of name and arguments.

Make a cache key for a prompt get using a stable hash of name and arguments.

Build a HeadlessOAuth with a fake stored 302 response.

Make a cache key for a resource read using a stable hash of URI.

Create session-prefixed key for state storage.

Normalize a Google scope shorthand to its canonical full URI. Google accepts shorthand scopes like "email" and "profile" in authorization req