Validate a stored transaction redirect URI before sending a browser to it.

Verify and extract payload from signed cookie. Returns: payload if signature valid, None otherwise

Extract the FastMCP component version from the request's lifted _meta.

Poll until the callback server's socket is accepting connections. uvicorn sets `Server.started = True` right after it binds and starts listen

Filter for files that should trigger reload.

Add a resource template to the server. Args: template: A ResourceTemplate instance to add Returns: The templ

Constructs a final httpx2.Request object, handling all OpenAPI serialization. Args: route: HTTPRoute containing OpenAPI

A transport that believes it already holds a session built for `options`.

Capture current context for background task execution. ``owning_tool_name``/``owning_tool_version`` identify the exact tool the call

Check if Docket is configured with a distributed backend. The CLI worker runs as a separate process, so it needs Redis/Valkey to coordinate w

Create a FastMCP server from a MCPConfig.

Helper to create a FastMCP server with OpenAPIProvider.

Helper to create a FastMCP server with OpenAPIProvider.

Create a FastMCP server with tools, resources, and prompts.

Create a FastMCP server with tools, resources, and prompts.

Exchange FastMCP refresh token for new FastMCP access token. Implements two-tier refresh: 1. Verify FastMCP refresh token 2.

Names of spans emitted by FastMCP's own instrumentation scope.

Forward directly to parent tool without transformation. This function bypasses all argument transformation and validation, calling the parent

Load configuration from a JSON file. Args: file_path: Path to the configuration file Returns: MCPServerConfi

Get auth attributes for the current request, if authenticated.

Extract headers from the current HTTP request if available. Never raises an exception, even if there is no active HTTP request (in which case

Return components eligible for background task execution. Returns components that have task_config.mode != 'forbidden'. This includes

Get tool by transformed name.

Load visibility rule dicts from session state.

An `httpx2.AsyncClient` bound to the in-process app, for raw HTTP assertions. Relative URLs resolve against the server's base URL, and absolu

Generate the stdio command for running a FastMCP server. Args: file: Path to the server file server_object: Optional server objec

Send a prompts/list request and return the complete MCP protocol result. Args: cursor: Optional pagination cursor from a previous

Send a resources/listResourceTemplates request and return the complete MCP protocol result. Args: cursor: Optional pagination cur

Retrieve all resources available on the server. This method automatically fetches all pages if the server paginates results, returnin

Send a resources/list request and return the complete MCP protocol result. Args: cursor: Optional pagination cursor from a previo

Mark tools by visibility state.

Handle errors for all messages.

Apply sliding window rate limiting to requests.

The per-request `_meta` block that opts the tasks extension in.

Interpret the --verify value as a boolean toggle or a CA bundle path.

Parse a version string into a sortable key. Args: version: The version string, or None for unversioned. Returns: A VersionKe

Return a leg's outstanding input requests, keyed by surfaced key. Empty when the leg is not waiting on input. Consumed by ``tasks/get`` to bu

Read the contents of a resource or resolved template. Args: uri (AnyUrl | str): The URI of the resource to read. Can be a string

Record an exception and error status on a span.

Reconnect `client` and return the pid of the freshly spawned subprocess.

Register a session for in-process background task access. Called automatically when a task is submitted to Docket. The session is stored as a

Release the per-task update lock.

Clear all recorded calls.

The effective Docket settings for `server`'s registered tasks extension. Reads the *registered* `TasksExtension`'s resolved settings, not the

Resolve the effective security policy for this template. A per-component ``security`` overrides the server default. ``INHERIT_SECURIT

Return the appropriate MIME type for a resource URI. For ``ui://`` scheme resources, defaults to ``UI_MIME_TYPE`` when no explicit MIME type

Run auth checks with AND logic, classifying the denial cause. Returns ``(authorized, missing_scopes)``. ``missing_scopes`` names every scope

Run the server using stdio transport. Args: show_banner: Whether to display the server banner log_level: Log level fo

Save visibility rule dicts to session state and send notifications. Args: context: The context to save rules for. rules: The visi

Scopes a check list requires but the token lacks, without running it. Returns ``None`` when the list contains any opaque (non-scope) check. Such

Open the per-request SERVER span at the FastMCP middleware seam. The span is named after the method and carries the base MCP attributes (`mcp

Fetch URL with SSRF protection and return response metadata. This is equivalent to :func:`ssrf_safe_fetch` but returns response headers and s

Convert the prompt to an MCP prompt.

Convert to MCP GetPromptResult.

Convert the resource template to an SDKResourceTemplate.

Check all parameter values against the configured policy. String values (and lists of strings, from wildcard `{path*}` parameters tha

Validate an ID-JAG and return its claims. Args: assertion: The compact-serialized ID-JAG JWT. client_id: The authenti

Validate get_oidc_configuration call.

Verify and decode a FastMCP token. Validates JWT signature, expiration, issuer, audience, and token type. Args: token: J

Verify token using the configured token verifier.

Get a sort key for a component based on its version. Use with sorted() or max() to order components by version. The key is a `(VersionKey, r

Poll until the given pid is gone, failing clearly if it never exits. The subprocesses under test self-terminate within a fraction of a second,

Write configuration to JSON file.

Get a specific claim from the access token. This dependency extracts a single claim value from the current access token. It's useful for gett

Initialize a private_key_jwt OAuth provider. Args: mcp_url: Full URL to the MCP endpoint (e.g. "https://host/mcp").

Create ResourceResult. Args: contents: String, bytes, or list of ResourceContent objects. meta: Optional metadata abo

Initialize WorkOS OAuth provider. Args: client_id: WorkOS client ID client_secret: WorkOS client secret a

Create Message with automatic serialization. Args: content: The message content. str passes through directly.

The accepted form content for one answered elicitation. ``ctx.input_responses`` values are the raw SDK union (``ElicitResult | CreateMessageR

Return state updates for all three status lists.

Expand local schema references while collecting ``allOf`` members.

Block until the enqueued execution is visible (durable-create MUST). The metadata write above already makes ``tasks/get`` resolvable; this extra

Base64url-encode a JSON value as a JWT segment (no padding).