Bump fastmcp from 2.8.1 to 3.2.0 in the pip group across 1 directory

[dependabot]

Bumps the pip group with 1 update in the / directory: fastmcp.

Updates fastmcp from 2.8.1 to 3.2.0

Release notes

Sourced from fastmcp's releases.

v3.2.0: Show Don't Tool

FastMCP 3.2 is the Apps release. The 3.0 architecture gave you providers and transforms; 3.1 shipped Code Mode for tool discovery. 3.2 puts a face on it: your tools can now return interactive UIs — charts, dashboards, forms, maps — rendered right inside the conversation.

FastMCPApp

FastMCPApp is a new provider class for building interactive applications inside MCP. It separates the tools the LLM sees (@app.ui()) from the backend tools the UI calls (@app.tool()), manages visibility automatically, and gives tool references stable identifiers that survive namespace transforms and server composition — without requiring host cooperation.

from fastmcp import FastMCP, FastMCPApp
from prefab_ui.actions.mcp import CallTool
from prefab_ui.components import Column, Form, Input, Button, ForEach, Text
app = FastMCPApp("Contacts")
@​app.tool()
def save_contact(name: str, email: str) -> list[dict]:
db.append({"name": name, "email": email})
return list(db)
@​app.ui()
def contact_manager() -> PrefabApp:
with PrefabApp(state={"contacts": list(db)}) as view:
with Column(gap=4):
ForEach("contacts", lambda c: Text(c.name))
with Form(on_submit=CallTool("save_contact")):
Input(name="name", required=True)
Input(name="email", required=True)
Button("Save")
return view
mcp = FastMCP("Server", providers=[app])

The UI is built with Prefab, a Python component library that compiles to interactive UIs. You write Python; the user sees charts, tables, forms, and dashboards. FastMCP handles the MCP Apps protocol machinery — renderer resources, CSP configuration, structured content serialization — so you don't have to.

For simpler cases where you just want to visualize data without server interaction, set app=True on any tool and return Prefab components directly:

@mcp.tool(app=True)
def revenue_chart(year: int) -> PrefabApp:
    with PrefabApp() as app:
        BarChart(data=revenue_data, series=[ChartSeries(data_key="revenue")])
    return app

Built-in Providers

Five ready-made providers you add with a single add_provider() call:

• FileUpload — drag-and-drop file upload with session-scoped storage

... (truncated)

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

Enhancements ✨

• Dedupe discriminator-required helper across schema converters by @​jlowin in #4362
• Add real Monty sandbox e2e coverage for CodeMode call_tool by @​AlexlaGuardia in #4274
• Switch prettier hook to rbubley/mirrors-prettier by @​jlowin in #4366
• feat(remote): add --verify flag for TLS certificate verification by @​jlowin in #4369

Security 🔒

• fix(deps): clear Dependabot security alerts via lockfile bumps by @​jlowin in #4393
• Clarify resource path parameter safety by @​jlowin in #4398
• Fix dev apps launch escaping by @​jlowin in #4399
• Block NAT64 SSRF bypass by @​jlowin in #4400
• [codex] Fix event store replay isolation by @​jlowin in #4402
• Fix DCR redirect URI validation by @​jlowin in #4408
• Protect streamable HTTP from DNS rebinding by @​jlowin in #4405
• Block unsafe OAuth redirect schemes by @​jlowin in #4419
• Block IPv6 transition SSRF bypasses by @​jlowin in #4426

Fixes 🐞

• fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by @​gmenziesint in #4301
• Fix: async rate limiting middleware get_client_id callbacks by @​Chotom in #4319
• Recognize all GitHub issue-link forms in require-issue-link workflow by @​jlowin in #4359
• fix: preserve required discriminator tags by @​he-yufeng in #4297
• fix(proxy): shield stateful proxy disconnect during session teardown by @​jlowin in #4363
• fix(fs): isolate same-named package imports across providers by @​jlowin in #4361
• fix: StatefulProxyClient.clear() no longer causes KeyError on session teardown by @​tcconnally in #4328
• fix: guard recursive refs in json_schema_to_type by @​Epochex in #4312
• Forward IdP auth errors to MCP client instead of showing HTML error page by @​bobbyjames839 in #4293
• fix(resources): round-trip path values with reserved characters in URI templates by @​jlowin in #4368
• fix: bracket IPv6 hosts in server startup log URL by @​jlowin in #4372
• fix: bound default OIDC discovery timeout and expose it on provider wrappers by @​jlowin in #4374
• fix: validate task tool arguments against declared types by @​jlowin in #4373
• fix(tools): honor serialize_by_alias in tool result serialization by @​jlowin in #4391
• Fix/cimd flow issue by @​twjackysu in #4206
• Reject empty env var keys by @​CodingFeng101 in #4410
• fix: correct replace_type docstring parameter descriptions by @​hiSandog in #4375
• Fix ty 0.0.55 diagnostics and prefab-ui protocol version drift by @​jlowin in #4428
• [codex] Fix OpenAPI resource template requests by @​jlowin in #4407

Docs 📚

• fix: RST docstrings in fastmcp.types render raw on gofastmcp.com by @​jlowin in #4367

... (truncated)

Commits

• 665514e Add forward_resource flag to OAuthProxy (#3711)
• f189d1f Bump pydantic-monty to 0.0.9 (#3707)
• 6faa2d6 Remove hardcoded prefab-ui version from pinning warnings (#3708)
• dd8816c chore: Update SDK documentation (#3701)
• d274959 docs: note that custom routes are unauthenticated (#3706)
• 4a54be2 Add examples gallery page (#3705)
• 961dd50 Add interactive map example with geocoding (#3702)
• f01d0c5 Add quiz example app, fix dev server empty string args (#3700)
• 85b7efd chore: Update SDK documentation (#3694)
• 27abe3c Add sales dashboard and live system monitor examples, bump prefab-ui to 0.17 ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.