Add MseeP.ai badge

[lwsinclair]

Hi there,

This pull request shares a security update on fastapi_mcp.

We also have an entry for fastapi_mcp in our directory, MseeP.ai, where we provide regular security and trust updates on your app.

We invite you to add our badge for your MCP server to your README to help your users learn from a third party that provides ongoing validation of fastapi_mcp.

You can easily take control over your listing for free: visit it at https://mseep.ai/app/canopy-land-new-gen-product-mcp.

Yours Sincerely,

Lawrence W. Sinclair
CEO/SkyDeck AI
Founder of MseeP.ai
MCP servers you can trust

---

Here are our latest evaluation results of fastapi_mcp

Security Scan Results

Security Score: 100/100

Risk Level: low

Scan Date: 2025-06-13

Score starts at 100, deducts points for security issues, and adds points for security best practices

This security assessment was conducted by MseeP.ai, an independent security validation service for MCP servers. Visit our website to learn more about our security reviews.

---

TL;DR

This PR introduces a major overhaul of fastapi-mcp, focusing on robust authentication, flexible deployment, and comprehensive documentation, alongside significant internal refactoring and improved OpenAPI schema conversion.

Why we made these changes

To enhance the security, usability, and maintainability of fastapi-mcp by providing native authentication support, enabling more flexible deployment scenarios, and offering extensive, clear documentation for developers. This also includes critical bug fixes and improved handling of HTTP request information for tool calls.

What changed?

• Core Architecture & Authentication: Major refactor of FastApiMCP and introduction of LowlevelMCPServer to support AuthConfig for OAuth 2.0 and token passthrough, including proxying OAuth endpoints and injecting HTTP request info into tool calls. New type definitions for OAuth and authentication configurations.
• Documentation & Examples: Added extensive new documentation (Mintlify-based) covering advanced topics like authentication, deployment, transport, and customization, along with a Chinese README. Numerous new and updated examples demonstrate basic usage, schema customization, separate server deployment, and various authentication flows.
• OpenAPI Conversion: Enhanced convert_openapi_to_mcp_tools to preserve more OpenAPI parameter schema properties (e.g., enum, format).
• Testing & Coverage: Expanded test suite with new unit and integration tests for _execute_api_tool, SSE transport, and authentication types. Improved test fixtures and updated coverage configuration to include subprocesses.
• Dependency & Project Updates: Bumped project version to 0.3.3, updated development dependencies, and added new ones for JWT and cryptography. Updated CHANGELOG.md with recent versions and breaking changes.

Validation

• Comprehensive unit tests for _execute_api_tool covering various parameter types and non-ASCII responses.
• Unit and integration tests for SSE transport, including error handling and client functionalities.
• Validation tests for OAuthMetadata and AuthConfig Pydantic models.
• Tests confirming Authorization headers are correctly passed to API tool handlers.
• Expanded test coverage for OpenAPI schema conversion, including request body properties and edge cases.
• Automated coverage reporting configured via .coveragerc and pytest.ini.
  

[mesa-dot-dev]

What Changed

This pull request introduces a substantial set of features and improvements, far exceeding the scope suggested by its title. The key changes include:

• New Authentication Layer: A major feature addition is the built-in support for authentication. This includes a proxy for OAuth 2.0 flows and simple token passthrough, primarily implemented in fastapi_mcp/auth/proxy.py and configured via a new AuthConfig model.

• Core Server Refactoring: The FastApiMCP server has been refactored to use httpx.ASGITransport by default. This is a breaking change that simplifies usage by enabling direct, in-process communication with the FastAPI app, removing the need for the base_url parameter.

• Documentation Overhaul: The project's documentation has been completely migrated to Mintlify, with the addition of numerous .mdx files providing a structured quickstart, guides for advanced features like authentication, and API configurations.

• Expanded Examples: The examples directory was reorganized and expanded with new code samples demonstrating features like authentication, custom timeouts, and separate server deployments.

• Security Badge: As per the title, a MseeP.ai security assessment badge was added to the main README.md.

Risks / Concerns

While the feature additions are valuable, this PR's scope is much larger than its title suggests, making it difficult to review. Several risks were identified:

• Potential Runtime Error: A potential None value issue in the new authentication proxy at fastapi_mcp/auth/proxy.py:223 could lead to a runtime error if an OAuth URL is not configured.
• Outdated Translation: The Chinese README (README_zh-CN.md) is significantly outdated and does not include the new authentication features or the security badge, creating an inconsistent experience for users.
• Inconsistent Examples: Several examples contain hardcoded values (examples/04_separate_server_example.py), incomplete configurations (examples/07_configure_http_timeout_example.py), or are missing from the index (examples/README.md).
• Documentation Placeholders: The new documentation contains placeholder URLs and hostnames that could confuse users during setup.
• Unreachable Test Code: There is unreachable code in tests/test_sse_real_transport.py, indicating a logic flaw in the test itself.

^{54 files reviewed | 13 comments | Review on Mesa | Edit Reviewer Settings}