FastMCPOptions - FastMCP TS

Properties

auth?

optional auth?: 
  | TokenVerifier
  | RequestVerifier;

Defined in: server/FastMCP.ts:88 Bearer-token verifier, or a RequestVerifier for header-based (trusted-proxy) deployments. See each type’s docs. A RequestVerifier applies to HTTP transports only; stdio’s FASTMCP_CLI_AUTH_TOKEN needs a TokenVerifier. Wrap either in remoteAuth(...) to also serve RFC 9728 protected resource metadata over HTTP. When both oauth and auth are set, oauth serves the endpoint and auth is ignored.

cacheHints?

optional cacheHints?: Partial<Record<CacheableResultMethod, CacheHint>>;

Defined in: server/FastMCP.ts:148 Cache hints (ttlMs / cacheScope) for the 2026-07-28 protocol revision’s cacheable results (tools/list, prompts/list, resources/list, resources/templates/list, resources/read, server/discover), keyed by operation. Only affects modern (2026-07-28) responses — 2025-era responses never carry these fields. Omitted operations (or omitting this option entirely) keep the conservative defaults (ttlMs: 0, cacheScope: 'private'). Applies uniformly per operation; per-resource cache hints are not currently supported (that per-registration override is only available through the SDK’s high-level McpServer.registerResource, which FastMCP does not use).

dnsRebinding?

optional dnsRebinding?: {
  allowedHosts?: string[];
  allowedOrigins?: string[];
  enabled?: boolean;
};

Defined in: server/FastMCP.ts:212 DNS-rebinding protection for the HTTP listener started by run(): validates the Host and Origin request headers (port-agnostic, by hostname) and rejects mismatches with 403. Defends localhost servers against a malicious web page whose DNS rebinds to 127.0.0.1 (MCP transport security best practice). This option does not apply to fetch(), which has no bind address from which to infer a trusted host. A framework embedding fetch() owns Host/Origin validation at its HTTP boundary. stdio is unaffected. Default posture (option omitted): protection auto-enables when, and only when, run() binds the HTTP server to a loopback host (127.0.0.1, ::1, localhost) — the deployment the attack targets. A server bound to a routable interface (e.g. 0.0.0.0 or a public host) is left open by default, because a localhost-only allowlist would reject its legitimate traffic; such deployments must opt in with an explicit allowedHosts/allowedOrigins for their domain.

allowedHosts?

optional allowedHosts?: string[];

Allowed Host header hostnames (no port; IPv6 in brackets, e.g. [::1]). Supplying this list also implies protection on. Default: localhost, 127.0.0.1, [::1].

allowedOrigins?

optional allowedOrigins?: string[];

Allowed Origin header hostnames (a missing Origin always passes — non-browser clients send none). Supplying this list also implies protection on. Default: localhost, 127.0.0.1, [::1].

enabled?

optional enabled?: boolean;

Force protection on (true) or off (false). Omit for the loopback-auto default.

eventBus?

optional eventBus?: ServerEventBus;

Defined in: server/FastMCP.ts:194 The change-event bus modern (2026-07-28) subscriptions/listen streams subscribe to, and tool()/resource()/prompt() registration publishes change events onto. Defaults to an in-process bus, which is correct for a single server process. Supply your own ServerEventBus implementation over a shared pub/sub backend (e.g. Redis) for a horizontally-scaled deployment, where a subscriptions/listen stream and the request that changed the list it cares about may land on different processes.

http?

optional http?: {
  cors?: boolean | CorsOptions;
  exposeHeaders?: string[];
  redactHeaders?: string[];
};

Defined in: server/FastMCP.ts:108 HTTP request context tuning for ctx.http. redactHeaders adds names to the sensitive set withheld from ctx.http.headers (defaults: authorization, cookie, proxy-authorization, mcp-session-id); use it for deployment-specific credentials such as a proxy shared-secret header. exposeHeaders removes names from the set; it is the explicit, greppable opt-out. Withheld names are listed in ctx.http.redactedHeaderNames. Redaction applies to ctx.http only; a RequestVerifier always sees the full wire headers. cors configures the CORS posture of the HTTP listener run() starts (both serve paths): omitted or true serves the permissive defaults (Access-Control-Allow-Origin: *), false disables CORS handling entirely, and an object narrows it — see CorsOptions. Malformed values throw here, at construction, for every transport. fetch() is unaffected: the embedding framework owns CORS at its HTTP boundary.

cors?

optional cors?: boolean | CorsOptions;

exposeHeaders?

optional exposeHeaders?: string[];

redactHeaders?

optional redactHeaders?: string[];

inputRequired?

optional inputRequired?: {
  legacyShim?: boolean;
  maxRounds?: number;
  roundTimeoutMs?: number;
};

Defined in: server/FastMCP.ts:174 Multi-round-trip (inputRequired) serving knobs (protocol revision 2026-07-28). On 2026-era requests the client fulfils input_required returns directly; on 2025-era connections the SDK’s legacy shim fulfils them server-side (real server→client requests + handler re-entry) — so handlers written with inputRequired(...) serve both eras unchanged.

legacyShim?

optional legacyShim?: boolean;

false disables the legacy shim: an inputRequired(...) return on a 2025-era request fails loudly instead of being bridged. Default: true.

maxRounds?

optional maxRounds?: number;

Handler re-entries per originating request before the shim fails (legacy era only). Default: 8.

roundTimeoutMs?

optional roundTimeoutMs?: number;

Per-leg timeout (ms) for the legacy shim’s embedded server→client requests. Default: 600_000 (10 minutes) — human-paced, deliberately above the 60s protocol default.

logger?

optional logger?: Logger;

Defined in: server/FastMCP.ts:119 Sink for the framework’s own diagnostic logs (lifecycle, warnings, errors). console and Winston loggers satisfy the shape directly; see the logging docs for a Pino adapter. Default: a built-in stderr logger (styled on a TTY, plain single-line format otherwise). Client-facing MCP logging (ctx.log) is a separate channel and is not affected. Do not use logger: console with the stdio transport: console.info and console.debug write to stdout, which carries the JSON-RPC stream on that transport.

logLevel?

optional logLevel?: "debug" | "info" | "warn" | "error" | "silent";

Defined in: server/FastMCP.ts:126 Minimum level for framework logs, applied before any logger (injected or default) is called. Precedence: this option, then the FASTMCP_LOG_LEVEL environment variable, then ‘info’. ‘silent’ disables framework logging. Malformed values throw here, at construction, for every transport.

middleware?

optional middleware?: Middleware[];

Defined in: server/FastMCP.ts:134 Middleware applied to every request in registration order.

name

name: string;

Defined in: server/FastMCP.ts:78

oauth?

optional oauth?: OAuthConfig;

Defined in: server/FastMCP.ts:90 Full OAuth 2.1 server with Dynamic Client Registration support.

promptsPageSize?

optional promptsPageSize?: number;

Defined in: server/FastMCP.ts:132 Maximum number of prompts returned per prompts/list page. Default: 50.

requestState?

optional requestState?: {
  bind?: (ctx) => string;
  key: string | Uint8Array<ArrayBufferLike>;
  ttlSeconds?: number;
};

Defined in: server/FastMCP.ts:157 HMAC-SHA256 integrity protection for multi-round-trip requestState (protocol revision 2026-07-28) — see ctx.requestState() / ctx.mintRequestState(). Backed by the SDK’s createRequestStateCodec. When omitted, requestState passes through unverified (the raw wire string) — the client can read and tamper with it, so this MUST be configured for any flow whose requestState influences authorization, resource access, or business logic.

bind?

optional bind?: (ctx) => string;

Binds a minted requestState to, e.g., the authenticated principal and/or the originating method — a value minted under one binding is rejected when echoed under a different one. See RequestStateCodecOptions.bind.

Parameters

ctx

ServerContext

Returns

string

key

key: string | Uint8Array<ArrayBufferLike>;

HMAC secret. A string is UTF-8-encoded; MUST be at least 32 bytes (256 bits).

ttlSeconds?

optional ttlSeconds?: number;

How long a minted requestState stays valid, in seconds. Default: 600 (10 minutes).

resourcesPageSize?

optional resourcesPageSize?: number;

Defined in: server/FastMCP.ts:130 Maximum number of resources (or templates) returned per page. Default: 50.

toolsPageSize?

optional toolsPageSize?: number;

Defined in: server/FastMCP.ts:128 Maximum number of tools returned per listTools page. Default: 50.

transforms?

optional transforms?: Transform[];

Defined in: server/FastMCP.ts:136 Transforms applied to component list responses in registration order.

version?

optional version?: string;

Defined in: server/FastMCP.ts:79

​Properties

​auth?

​cacheHints?

​dnsRebinding?

​allowedHosts?

​allowedOrigins?

​enabled?

​eventBus?

​http?

​cors?

​exposeHeaders?

​redactHeaders?

​inputRequired?

​legacyShim?

​maxRounds?

​roundTimeoutMs?

​logger?

​logLevel?

​middleware?

​name

​oauth?

​promptsPageSize?

​requestState?

​bind?