chore(deps): bump fastmcp from 3.4.7 to 4.0.1

[dependabot]

Bumps fastmcp from 3.4.7 to 4.0.1.

Release notes

Sourced from fastmcp's releases.

v4.0.1: Come Back Any Time

ClientGroup now reference-counts its context the way Client does, so entering a connected group from a nested block or a concurrent task reuses the existing connections instead of raising. Adapters written against Client's reentrancy can hold a ClientGroup the same way.

What's Changed

Fixes 🐞

• ci: fix the published-docs PR step's working base by @​zzstoatzz in PrefectHQ/fastmcp#4960
• client: make ClientGroup context reentrant by @​zzstoatzz in PrefectHQ/fastmcp#4975

Docs 📚

• docs: update banner for FastMCP 4 GA by @​zzstoatzz in PrefectHQ/fastmcp#4958
• docs: correct whats-new and upgrade guide for GA by @​zzstoatzz in PrefectHQ/fastmcp#4961
• docs: drop prerelease install framing from installation and SDK migration guides by @​zzstoatzz in PrefectHQ/fastmcp#4963
• docs: refresh sidebar tags and fix audit findings by @​zzstoatzz in PrefectHQ/fastmcp#4965

Other Changes 🦾

• docs: add v4.0.1 changelog entries by @​zzstoatzz in PrefectHQ/fastmcp#4976

Full Changelog: PrefectHQ/fastmcp@v4.0.0...v4.0.1

v4.0.0: Four Real

FastMCP 4 is stable. Five betas, five weeks, 23 contributors, and more than 80 pull requests later — the new protocol engine held up under real gateways, agent frameworks, and production servers, and most FastMCP 3 applications upgrade without code changes.

This is the FastMCP release for the new MCP. On July 28, MCP released the 2026-07-28 protocol revision and the rewritten Python SDK v2 shipped the same day. FastMCP 4 is built on both: modern requests are sessionless and self-contained, so any replica behind an ordinary load balancer can answer them, and one FastMCP 4 deployment negotiates the best protocol version per connection — new clients get the new protocol, old clients keep working, and Client(url) does the same negotiation from the other side.

The new protocol's capabilities come through FastMCP's usual high-level surfaces:

• Interactive tools return a request for input — approval, a missing field — and re-run with the client's answers available on the context.
• Background tasks (@mcp.tool(task=True)) run outside the request path via the io.modelcontextprotocol/tasks extension, shipped in the optional fastmcp-tasks package on the same Docket engine as FastMCP 3.
• Extensions register with add_extension(): a negotiated capability, additive request methods, tool-call interception, and a lifespan. Tasks are built this way, outside core.
• Argument completion for prompt and resource-template inputs, with already-supplied arguments visible to the handler.
• Auth for agents and services: identity assertion (SEP-990, beta), provider-neutral role checks, insufficient-scope challenges that name the missing scopes, and client-credentials auth.
• Infrastructure hooks: server-level cache hints, and Mcp-Method/Mcp-Name routing headers so gateways can route without parsing JSON-RPC.

The framework grew alongside the protocol: dependency injection can bind a dependency to arguments of the call it serves (Depends(get_account, user_id=CallArgument("owner"))) while keeping it out of the tool schema, and ClientGroup manages one client per server with collision-checked namespacing — each member negotiating its own protocol version.

The beta period motivated a bunch of correctness work. Most of it was auth: hardened OAuth consent flows, issuer validation, and JWT verification, plus proxies that strip cookies and connection-owned headers at trust boundaries. The rest was durability and compatibility — encrypted task snapshots, serialized event-store writes, response caching handling empty results, errors, and versioned components, and dozens of smaller fixes from CodeMode to Python 3.14 compat.

Breaking changes: server-initiated sampling and roots are removed (no live connection exists to call back into mid-request), ctx.elicit() is old-protocol-only, FastMCP 3's deprecated APIs are gone, MCP model fields are snake_case (with a warning compatibility bridge for the old names), and background tasks moved to fastmcp-tasks. Passing a bare string like Client("server.py") to run local code is deprecated in favor of Path, for removal in FastMCP 5.

The upgrade guide covers every change and includes a copyable prompt for auditing an application with a coding agent.

Happy (context) engineering!

What's Changed

New Features 🎉

• Migrate to MCP Python SDK v2 by @​jlowin in PrefectHQ/fastmcp#4437
• Teach fastmcp.Client the modern protocol: mode negotiation, MRTR driver, response cache by @​jlowin in PrefectHQ/fastmcp#4450

... (truncated)

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.0.3: Once Is Enough

Multi-server clients with legacy-only backends now avoid unnecessary startup retries, and tools returning unconstrained sequences no longer send images twice. This patch also fixes task timing values rejected by strict clients and cleans up unfinished Monty callbacks when execution ends.

Enhancements ✨

• ci: deploy docs through Mintlify's admin API and wait for a verdict by @​zzstoatzz in #4996
• perf: avoid duplicate startup for mixed-era backends by @​ningmao-hlyz in #4971
• docs: clarify release title history lookup by @​zzstoatzz in #5006

Fixes 🐞

• fix: don't infer an output schema for unconstrained sequences by @​fsecada01 in #4999
• Clean up unfinished Monty callbacks by @​zzstoatzz in #5005
• Fix task timing field serialization by @​LarryHu0217 in #5003

Docs 📚

• docs: point What's New at the changelog for later releases by @​zzstoatzz in #4992
• docs: attribute the back-channel removal to SEP-2322/2575, not SEP-2577 by @​zzstoatzz in #4988

New Contributors

• @​fsecada01 made their first contribution in #4999
• @​ningmao-hlyz made their first contribution in #4971

Full Changelog: v4.0.2...v4.0.3

v4.0.2: Root Access

ClientGroup is now importable from the package root, from fastmcp import ClientGroup, with the same lazy export and install hint as Client, so integrations no longer couple to FastMCP's internal module layout.

Enhancements ✨

• Expose ClientGroup from package root by @​jlowin in #4987
• skills: add release skill with changelog entry helper by @​zzstoatzz in #4982

Fixes 🐞

• docs: escape <1 in changelog so MDX parses by @​zzstoatzz in #4978

Docs 📚

• docs: note the 4.0.1 floor for ClientGroup reentrancy by @​zzstoatzz in #4980
• docs: link the GA announcement and blog from What's New by @​zzstoatzz in #4984

Full Changelog: v4.0.1...v4.0.2

... (truncated)

Commits

• b46cd58 docs: add v4.0.1 changelog entries (#4976)
• 5c679ba client: make ClientGroup context reentrant (#4975)
• 62ef226 docs: refresh sidebar tags and fix audit findings across servers/clients page...
• 4f33763 docs: drop prerelease install framing from installation and SDK migration gui...
• 01c5218 docs: correct whats-new and upgrade guide for GA (#4961)
• 729a6b2 ci: check out published-docs itself before opening the publication PR (#4960)
• 76f6531 docs: update banner for FastMCP 4 GA (#4958)
• 7e51c1d docs: add v4.0.0 changelog and updates entries (#4955)
• aeb98e1 chore: add zzstoatzz alongside jlowin in maintainer references (#4953)
• 3685866 client: deprecate inferring stdio transports from str, prefer Path (#4941)
• Additional commits viewable in compare view