Skip to content

fix: propagate version to components in FileSystemProvider#3458

Merged
jlowin merged 1 commit intoPrefectHQ:mainfrom
martimfasantos:fix/tool-version-providers
Mar 13, 2026
Merged

fix: propagate version to components in FileSystemProvider#3458
jlowin merged 1 commit intoPrefectHQ:mainfrom
martimfasantos:fix/tool-version-providers

Conversation

@martimfasantos
Copy link
Copy Markdown
Contributor

@martimfasantos martimfasantos commented Mar 10, 2026

Summary

FileSystemProvider.extract_components() in filesystem_discovery.py does not pass version=meta.version when constructing Tool, Resource, ResourceTemplate, or Prompt objects from decorated functions. This causes all components discovered through FileSystemProvider to have version=None, breaking version-based deduplication (_dedupe_with_versions) and the meta.fastmcp.version/meta.fastmcp.versions metadata in the MCP wire output.

Problem

When tools are registered using the @tool decorator with a version parameter and discovered via FileSystemProvider, the version information is silently discarded.

Root Cause

In fastmcp/server/providers/filesystem_discovery.py, the extract_components() function reads ToolMeta, ResourceMeta, and PromptMeta from decorated functions but omits the version field when calling *.from_function():

# Current code (lines ~224-238) — version is missing for ALL component types
if isinstance(meta, ToolMeta):
    tool = Tool.from_function(
        obj,
        name=meta.name,
        title=meta.title,
        description=meta.description,
        icons=meta.icons,
        tags=meta.tags,
        output_schema=meta.output_schema,
        annotations=meta.annotations,
        meta=meta.meta,
        task=resolved_task,
        exclude_args=meta.exclude_args,
        serializer=meta.serializer,
        auth=meta.auth,
        # ❌ version=meta.version is MISSING
    )

The same omission applies to the ResourceMeta → Resource/ResourceTemplate and PromptMeta → Prompt branches.

Comparison with LocalProvider

The LocalProvider decorators correctly pass version:

# local_provider/decorators/tools.py — correct
tool = Tool.from_function(
    tool,
    ...,
    version=fmeta.version,  # ✅ version is passed
    ...
)

Impact

  1. _meta.fastmcp.version is always missing — Clients relying on tool.meta["fastmcp"]["version"] get None
  2. _meta.fastmcp.versions is never populated — The _dedupe_with_versions() function in mcp_operations.py checks c.version is not None to decide whether to inject the versions list. Since all components have version=None, the list is never built.
  3. Multi-version tools collapse silently — Two versions of the same tool (e.g., hello_world v1.0 and v2.0 with different Python function names) are treated as unversioned duplicates, and the deduplication picks one arbitrarily instead of by version ordering.
  4. Version-targeted call_tool fails — Clients sending _meta.fastmcp.version in call_tool requests won't match specific versions since the server doesn't know tools have versions.

Reproduction

# tools/hello_world.py
from fastmcp.tools import tool

@tool(name="hello_world", version="1.0", description="v1")
def hello_world_v1(name: str) -> str:
    return f"Hello {name}"

@tool(name="hello_world", version="2.0", description="v2")
def hello_world_v2(name: str, age: int) -> str:
    return f"Hello {name}, age {age}"
# client.py
from fastmcp import Client
import asyncio

async def main():
    async with Client("http://localhost:3000/mcp") as client:
        tools = await client.list_tools()
        for t in tools:
            meta = t.meta or {}
            fastmcp = meta.get("fastmcp", {})
            print(f"{t.name}: version={fastmcp.get('version')}, versions={fastmcp.get('versions')}")
            # Expected: hello_world: version=2.0, versions=['2.0', '1.0']
            # Actual:   hello_world: version=None, versions=None

asyncio.run(main())

Fix

Add version=meta.version to all three *.from_function() calls in extract_components():

 if isinstance(meta, ToolMeta):
     tool = Tool.from_function(
         obj,
         name=meta.name,
+        version=meta.version,
         title=meta.title,
         ...
     )
 elif isinstance(meta, ResourceMeta):
     ...
     resource = ResourceTemplate.from_function(
         fn=obj,
+        version=meta.version,
         ...
     )
     ...
     resource = Resource.from_function(
         fn=obj,
+        version=meta.version,
         ...
     )
 elif isinstance(meta, PromptMeta):
     prompt = Prompt.from_function(
         obj,
+        version=meta.version,
         ...
     )
  • My change closes #(issue number)
  • I have followed the repository's development workflow
  • I have tested my changes manually and by adding relevant tests
  • I have performed all required documentation updates

Review Checklist

  • I have self-reviewed my changes
  • My Pull Request is ready for review

@marvin-context-protocol marvin-context-protocol Bot added bug Something isn't working. Reports of errors, unexpected behavior, or broken functionality. server Related to FastMCP server implementation or server-side functionality. tests labels Mar 10, 2026
jlowin
jlowin approved these changes Mar 13, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@jlowin jlowin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you! In the future, please don't combine issue reports and PRs. PRs must reference (and close) a separate issue.

@jlowin jlowin merged commit f082057 into PrefectHQ:main Mar 13, 2026
8 checks passed
jlowin added a commit that referenced this pull request Mar 30, 2026
@jlowin @claude
@voidborne-d @marvin-context-protocol @dependabot @strawgate @Sumanshu-Nankana @ericrobinson-indeed @martimfasantos @mtthidoteu @saschabuehrle @hkc5 @nightcityblade @mhallo @zzstoatzz @shulkx @radoshi @shigechika @jer805 @pandego @4444J99 @mostafa6765
Publish docs for v3.2.0 (#3713)
3a9717e 
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Jeremiah Lowin <[email protected]>
Co-authored-by: Marvin Context Protocol <41898282+Marvin Context [email protected]>
Co-authored-by: voidborne-d <[email protected]>
Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com>
Co-authored-by: Claude <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: d 🔹 <[email protected]>
Co-authored-by: Jeremiah Lowin <[email protected]>
Co-authored-by: nightcityblade <[email protected]>
Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: Bill Easton <[email protected]>
Co-authored-by: Sumanshu Nankana <[email protected]>
Co-authored-by: Eric Robinson <[email protected]>
Co-authored-by: Martim Santos <[email protected]>
Co-authored-by: d 🔹 <[email protected]>
Co-authored-by: Matthieu B <[email protected]>
Co-authored-by: Sascha Buehrle <[email protected]>
Co-authored-by: Hakancan <[email protected]>
Co-authored-by: nightcityblade <[email protected]>
Co-authored-by: Matt Hallowell <[email protected]>
Co-authored-by: nate nowack <[email protected]>
Co-authored-by: Bill Easton <[email protected]>
Co-authored-by: Marcus Shu <[email protected]>
Co-authored-by: Rushabh Doshi <[email protected]>
Co-authored-by: AIKAWA Shigechika <[email protected]>
Co-authored-by: Jeremy Simon <[email protected]>
Co-authored-by: Miguel Miranda Dias <[email protected]>
Co-authored-by: Anthony James Padavano <[email protected]>
Co-authored-by: Mostafa Kamal <[email protected]>
Fix auto-close MRE script posting comment without closing (#3386)
Fix WorkOS token scope verification bypass 🤖 Generated with Codex (#3407)
Fix initialize McpError fallthrough 🤖 Generated with Codex (#3413)
Fix transform arg collisions with passthrough params (#3431)
Fix get_* returning None when latest version is disabled (#3439)
Fix get_* returning None when latest version is disabled (#3421)
Fix server lifespan overlap teardown (#3415)
Fix $ref output schema object detection regression (#3420)
resolved annotations (#3429)
Fix async partial callables rejected by iscoroutinefunction (#3438)
Fix async partial callables rejected by iscoroutinefunction (#3423)
fix: add version to components (#3458)
fix: use intent-based flag for OIDC scope patch in load_access_token (#3465)
Fixes #3461
fix: normalize Google scope shorthands and surface valid_scopes (#3477)
fix: resolve ty 0.0.23 type-checking errors and bump pin (#3481)
fix: shield lifespan teardown from cancellation (#3480)
fix: forward custom_route endpoints from mounted servers (#3462)
fix updates _get_additional_http_routes() to traverse providers,
Fixes #3457
fix: remove hardcoded version from CLI help text (#3456)
fix: monty 0.0.8 compatibility, drop external_functions from constructor (#3468)
fix: task test teardown hanging 5s per test (#3499)
Closes #3498
fix: validate workspace path is a directory before cursor install (#3440)
Fixes #3426
fix: handle re.error from malformed URI templates in build_regex (#3501)
fix: reject empty/OIDC-only required_scopes in AzureProvider (#3503)
fix: restrict $ref resolution to local refs only (SSRF/LFI) (#3502)
fix warnings and timeouts (#3504)
close upgrade check issue when build passes (#3505)
Closes #3484
fix: URL-encode path params to prevent SSRF/path traversal (GHSA-vv7q-7jx5-f767) (#3507)
fix: prevent path traversal in skill download (#3493)
fix: prefer IdP-granted scopes over client-requested scopes in OAuthProxy (#3492)
fix: remove unrelated transform and http.py changes from PR scope
fix: remove forced follow_redirects from httpx_client_factory calls (#3496)
fix: stop passing follow_redirects to httpx_client_factory
fix: restore follow_redirects=True for custom httpx client factories
Closes #3509
fix: CSRF double-submit cookie check in consent flow (#3519)
fix: validate server names in install commands (#3522)
fix: use raw strings for regex in pytest.raises match (#3523)
fix: reject refresh tokens used as Bearer access tokens (#3524)
fix: route ResourcesAsTools/PromptsAsTools through server middleware (#3495)
fix: resolve Pyright "Module is not callable" on @tool, @resource, @prompt decorators (#3540)
fix: filter warnings by message in KEY_PREFIX test (#3549)
fix: suppress output schema for ToolResult subclass annotations (#3548)
fix: increase sleep duration in proxy cache tests (#3567)
fix: store absolute token expiry to prevent stale expires_in on reload (#3572)
fix: preserve tool properties named 'title' during schema compression (#3582)
Fix loopback redirect URI port matching per RFC 8252 §7.3 (#3589)
Fix app tool routing: visibility check and middleware propagation (#3591)
Fix query parameter serialization to respect OpenAPI explode/style settings (#3595)
Fix dev apps form: union types, textarea support, JSON parsing (#3597)
fix(google): replace deprecated /oauth2/v1/tokeninfo with /oauth2/v3/userinfo (#3603)
fix: resolve EntraOBOToken dependency injection through MultiAuth (#3609)
fix(docs): correct misleading stateless_http header (#3622)
fix: filesystem provider import machinery (#3626)
Closes #3625 (issues 2, 3, 6)
fix: recover StdioTransport after subprocess exits (#3630)
fix(server): preserve mounted tool task metadata (#3632)
fix: scope deprecation warning filter to FastMCPDeprecationWarning (#3649)
fix imports, add PrefabAppConfig (#3650)
fix: resolve CurrentFastMCP/ctx.fastmcp to child server in mounted background tasks (#3651)
Fix blocking docs issues: chart imports, Select API, Rx consistency (#3652)
closed by default (#3657)
Fix prompt caching middleware missing wrap/unwrap round-trip (#3666)
fix: serialize object query params per OpenAPI style/explode rules (#3662)
Fixes #2857
fix: HTTP request headers not accessible in background task workers (#3631)
fix: restore HTTP headers in worker execution path for background tasks (#3681)
fix: strip discriminator after dereferencing schemas (#3682)
fix: remove stale ty:ignore directives for ty 0.0.26 (#3684)
Fix docs gaps in app provider pages (#3690)
fix: dev apps log panel UX improvements (#3698)
fix dev server empty string args (#3700)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jlowin jlowin jlowin approved these changes

Assignees

No one assigned

Labels

bug Something isn't working. Reports of errors, unexpected behavior, or broken functionality. server Related to FastMCP server implementation or server-side functionality. tests

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@martimfasantos @jlowin