FastMCPOptions - FastMCP TS

Properties

auth?

optional auth?: 
  | TokenVerifier
  | RequestVerifier;

Defined in: server/FastMCP.ts:85 Bearer-token verifier, or a RequestVerifier for header-based (trusted-proxy) deployments. See each type’s docs. A RequestVerifier applies to HTTP transports only; stdio’s FASTMCP_CLI_AUTH_TOKEN needs a TokenVerifier. When both oauth and auth are set, oauth serves the endpoint and auth is ignored.

cacheHints?

optional cacheHints?: Partial<Record<CacheableResultMethod, CacheHint>>;

Defined in: server/FastMCP.ts:145 Cache hints (ttlMs / cacheScope) for the 2026-07-28 protocol revision’s cacheable results (tools/list, prompts/list, resources/list, resources/templates/list, resources/read, server/discover), keyed by operation. Only affects modern (2026-07-28) responses — 2025-era responses never carry these fields. Omitted operations (or omitting this option entirely) keep the conservative defaults (ttlMs: 0, cacheScope: 'private'). Applies uniformly per operation; per-resource cache hints are not currently supported (that per-registration override is only available through the SDK’s high-level McpServer.registerResource, which FastMCP does not use).

dnsRebinding?

optional dnsRebinding?: {
  allowedHosts?: string[];
  allowedOrigins?: string[];
  enabled?: boolean;
};

Defined in: server/FastMCP.ts:209 DNS-rebinding protection for the HTTP listener started by run(): validates the Host and Origin request headers (port-agnostic, by hostname) and rejects mismatches with 403. Defends localhost servers against a malicious web page whose DNS rebinds to 127.0.0.1 (MCP transport security best practice). This option does not apply to fetch(), which has no bind address from which to infer a trusted host. A framework embedding fetch() owns Host/Origin validation at its HTTP boundary. stdio is unaffected. Default posture (option omitted): protection auto-enables when, and only when, run() binds the HTTP server to a loopback host (127.0.0.1, ::1, localhost) — the deployment the attack targets. A server bound to a routable interface (e.g. 0.0.0.0 or a public host) is left open by default, because a localhost-only allowlist would reject its legitimate traffic; such deployments must opt in with an explicit allowedHosts/allowedOrigins for their domain.

allowedHosts?

optional allowedHosts?: string[];

Allowed Host header hostnames (no port; IPv6 in brackets, e.g. [::1]). Supplying this list also implies protection on. Default: localhost, 127.0.0.1, [::1].

allowedOrigins?

optional allowedOrigins?: string[];

Allowed Origin header hostnames (a missing Origin always passes — non-browser clients send none). Supplying this list also implies protection on. Default: localhost, 127.0.0.1, [::1].

enabled?

optional enabled?: boolean;

Force protection on (true) or off (false). Omit for the loopback-auto default.

eventBus?

optional eventBus?: ServerEventBus;

Defined in: server/FastMCP.ts:191 The change-event bus modern (2026-07-28) subscriptions/listen streams subscribe to, and tool()/resource()/prompt() registration publishes change events onto. Defaults to an in-process bus, which is correct for a single server process. Supply your own ServerEventBus implementation over a shared pub/sub backend (e.g. Redis) for a horizontally-scaled deployment, where a subscriptions/listen stream and the request that changed the list it cares about may land on different processes.

http?

optional http?: {
  cors?: boolean | CorsOptions;
  exposeHeaders?: string[];
  redactHeaders?: string[];
};

Defined in: server/FastMCP.ts:105 HTTP request context tuning for ctx.http. redactHeaders adds names to the sensitive set withheld from ctx.http.headers (defaults: authorization, cookie, proxy-authorization, mcp-session-id); use it for deployment-specific credentials such as a proxy shared-secret header. exposeHeaders removes names from the set; it is the explicit, greppable opt-out. Withheld names are listed in ctx.http.redactedHeaderNames. Redaction applies to ctx.http only; a RequestVerifier always sees the full wire headers. cors configures the CORS posture of the HTTP listener run() starts (both serve paths): omitted or true serves the permissive defaults (Access-Control-Allow-Origin: *), false disables CORS handling entirely, and an object narrows it — see CorsOptions. Malformed values throw here, at construction, for every transport. fetch() is unaffected: the embedding framework owns CORS at its HTTP boundary.

cors?

optional cors?: boolean | CorsOptions;

exposeHeaders?

optional exposeHeaders?: string[];

redactHeaders?

optional redactHeaders?: string[];

inputRequired?

optional inputRequired?: {
  legacyShim?: boolean;
  maxRounds?: number;
  roundTimeoutMs?: number;
};

Defined in: server/FastMCP.ts:171 Multi-round-trip (inputRequired) serving knobs (protocol revision 2026-07-28). On 2026-era requests the client fulfils input_required returns directly; on 2025-era connections the SDK’s legacy shim fulfils them server-side (real server→client requests + handler re-entry) — so handlers written with inputRequired(...) serve both eras unchanged.

legacyShim?

optional legacyShim?: boolean;

false disables the legacy shim: an inputRequired(...) return on a 2025-era request fails loudly instead of being bridged. Default: true.

maxRounds?

optional maxRounds?: number;

Handler re-entries per originating request before the shim fails (legacy era only). Default: 8.

roundTimeoutMs?

optional roundTimeoutMs?: number;

Per-leg timeout (ms) for the legacy shim’s embedded server→client requests. Default: 600_000 (10 minutes) — human-paced, deliberately above the 60s protocol default.

logger?

optional logger?: Logger;

Defined in: server/FastMCP.ts:116 Sink for the framework’s own diagnostic logs (lifecycle, warnings, errors). console and Winston loggers satisfy the shape directly; see the logging docs for a Pino adapter. Default: a built-in stderr logger (styled on a TTY, plain single-line format otherwise). Client-facing MCP logging (ctx.log) is a separate channel and is not affected. Do not use logger: console with the stdio transport: console.info and console.debug write to stdout, which carries the JSON-RPC stream on that transport.

logLevel?

optional logLevel?: "debug" | "info" | "warn" | "error" | "silent";

Defined in: server/FastMCP.ts:123 Minimum level for framework logs, applied before any logger (injected or default) is called. Precedence: this option, then the FASTMCP_LOG_LEVEL environment variable, then ‘info’. ‘silent’ disables framework logging. Malformed values throw here, at construction, for every transport.

middleware?

optional middleware?: Middleware[];

Defined in: server/FastMCP.ts:131 Middleware applied to every request in registration order.

name

name: string;

Defined in: server/FastMCP.ts:76

oauth?

optional oauth?: OAuthConfig;

Defined in: server/FastMCP.ts:87 Full OAuth 2.1 server with Dynamic Client Registration support.

promptsPageSize?

optional promptsPageSize?: number;

Defined in: server/FastMCP.ts:129 Maximum number of prompts returned per prompts/list page. Default: 50.

requestState?

optional requestState?: {
  bind?: (ctx) => string;
  key: string | Uint8Array<ArrayBufferLike>;
  ttlSeconds?: number;
};

Defined in: server/FastMCP.ts:154 HMAC-SHA256 integrity protection for multi-round-trip requestState (protocol revision 2026-07-28) — see ctx.requestState() / ctx.mintRequestState(). Backed by the SDK’s createRequestStateCodec. When omitted, requestState passes through unverified (the raw wire string) — the client can read and tamper with it, so this MUST be configured for any flow whose requestState influences authorization, resource access, or business logic.

bind?

optional bind?: (ctx) => string;

Binds a minted requestState to, e.g., the authenticated principal and/or the originating method — a value minted under one binding is rejected when echoed under a different one. See RequestStateCodecOptions.bind.

Parameters

ctx

ServerContext

Returns

string

key

key: string | Uint8Array<ArrayBufferLike>;

HMAC secret. A string is UTF-8-encoded; MUST be at least 32 bytes (256 bits).

ttlSeconds?

optional ttlSeconds?: number;

How long a minted requestState stays valid, in seconds. Default: 600 (10 minutes).

resourcesPageSize?

optional resourcesPageSize?: number;

Defined in: server/FastMCP.ts:127 Maximum number of resources (or templates) returned per page. Default: 50.

toolsPageSize?

optional toolsPageSize?: number;

Defined in: server/FastMCP.ts:125 Maximum number of tools returned per listTools page. Default: 50.

transforms?

optional transforms?: Transform[];

Defined in: server/FastMCP.ts:133 Transforms applied to component list responses in registration order.

version?

optional version?: string;

Defined in: server/FastMCP.ts:77

​Properties

​auth?

​cacheHints?

​dnsRebinding?

​allowedHosts?

​allowedOrigins?

​enabled?

​eventBus?

​http?

​cors?

​exposeHeaders?

​redactHeaders?

​inputRequired?

​legacyShim?

​maxRounds?

​roundTimeoutMs?

​logger?

​logLevel?

​middleware?

​name

​oauth?

​promptsPageSize?

​requestState?

​bind?