FastMCP 4.1.0: finish the work before changing its owner
A maintenance release can change identity and session boundaries. The October 8 release needs migration tests, not only an install command.
A maintenance release can change identity and session boundaries. The October 8 release needs migration tests, not only an install command.
FastMCP 4.1.0: finish the work before changing its owner
A maintenance release can change identity and session boundaries. The October 8 release needs migration tests, not only an install command.
Verified release
FastMCP builds MCP servers and clients around Python functions. The official updates page and changelog date 4.1.0 to October 8, 2026. That makes it the relevant release for this October 9 review, rather than the October 4 4.0.11 patch. The repository and LICENSE identify Apache 2.0 for the code. The repository displayed 27,453 stars and 2,285 forks when read on October 9. These are interest signals, not evidence that an application is secure or that a migration works. I read the documentation; I did not install the package or reproduce an exploit.
An identity migration
The most important operational warning is ownership. MultiAuth now qualifies client IDs by their source. According to the changelog, existing MultiAuth sessions and tasks therefore start new ownership scopes, and pending tasks should be finished before upgrading. My interpretation: two identity providers can use the same textual client ID without intending the same principal. A migration checklist should cover task ownership and access after restart, not assume that a familiar string still names the same owner. That explanation is analysis of the documented change, not an independently established incident.
Compatibility boundaries
The release tightens several inputs. Skill files must resolve inside configured directories. OpenAPI path parameters reject dot and dot-dot segments. Regex tool search now uses Pydantic’s engine, without lookarounds or backreferences. HTTP sessions expire after the MCP SDK’s 30-minute idle default instead of living forever. CodeMode requires Monty 1.1, where max_duration_secs becomes max_feed_duration_secs. Python 3.15 support is restored. These are specific compatibility boundaries. Do not turn the word maintenance into a promise that all old inputs or sessions survive.
Install with a record
The installation guide gives uv add fastmcp or pip install fastmcp, with the tasks extra installed separately, then fastmcp version to inspect the environment. Record resolved versions and a dependency lock before changing a server. The sample version in the guide is not proof of the version on your machine. The guide also warns that Cyclopts v4 brings docutils with licensing that can trigger compliance reviews. It offers Cyclopts v5 alpha as an alternative. That is a prerelease option to review, not a blanket recommendation; the project’s Apache license does not settle every dependency.
My proposed test
My proposed test uses synthetic data and two identity providers with the same local client ID. Before the upgrade, record authorized task access and finish pending tasks. After it, verify that one provider cannot read or cancel the other’s tasks and that legitimate access still works. In a disposable environment, test an ordinary path and a dot segment, an in-directory skill and an escaping symlink, one supported regex and one lookaround, and a reconnect after idle expiry. This is a suggested regression matrix, not a test result. MCP may expose private arguments, files and outputs: use narrow credentials and avoid raw production data in logs. The release notes describe maintainer changes, not a safety certificate.