Enable FastMCP sessions for proper HTTP context in unauthenticated calls #580
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Prevents AttributeError when context is None and trying to access context attributes. Still investigating why get_http_headers() returns empty for MCP without auth. The root issue is that FastMCP may not be passing headers to unauthenticated requests.
Changed stateless_http from True to False to allow proper HTTP request context for header access in unauthenticated calls. Problem: - MCP list_authorized_properties failed without auth - get_http_headers() returned empty in stateless mode - Tenant detection from headers (Apx-Incoming-Host) failed Solution: - Enable sessions (stateless_http=False) - FastMCP maintains HTTP context across request lifecycle - get_http_headers() can now access headers even without auth Note: The deprecation warning shows stateless_http is deprecated anyway, so this aligns with FastMCP's recommended approach. Testing: MCP list_authorized_properties should now work without auth token, detecting tenant from Apx-Incoming-Host header.
bokelley
added a commit
that referenced
this pull request
Oct 24, 2025
The session-based mode (stateless_http=False) introduced in PR #580 causes protocol compatibility issues with MCP clients, resulting in 'Unknown error' failures. Analysis: - FastMCP sessions require proper session establishment flow - Current MCP clients don't implement session management - Errors occur at protocol layer before our code executes - get_http_headers() works via context vars regardless of session mode Solution: - Revert to stateless_http=True (previous working state) - Keep all context safety fixes from PRs #577, #578, #580 - get_http_headers(include_all=True) still works for tenant detection This maintains A2A functionality while fixing MCP protocol compatibility.
4 tasks
EmmaLouise2018
pushed a commit
that referenced
this pull request
Oct 24, 2025
…lls (#580) * Add context=None check for header fallbacks (debugging MCP issue) Prevents AttributeError when context is None and trying to access context attributes. Still investigating why get_http_headers() returns empty for MCP without auth. The root issue is that FastMCP may not be passing headers to unauthenticated requests. * Enable FastMCP sessions for proper HTTP context access Changed stateless_http from True to False to allow proper HTTP request context for header access in unauthenticated calls. Problem: - MCP list_authorized_properties failed without auth - get_http_headers() returned empty in stateless mode - Tenant detection from headers (Apx-Incoming-Host) failed Solution: - Enable sessions (stateless_http=False) - FastMCP maintains HTTP context across request lifecycle - get_http_headers() can now access headers even without auth Note: The deprecation warning shows stateless_http is deprecated anyway, so this aligns with FastMCP's recommended approach. Testing: MCP list_authorized_properties should now work without auth token, detecting tenant from Apx-Incoming-Host header.
danf-newton
pushed a commit
to Newton-Research-Inc/salesagent
that referenced
this pull request
Nov 24, 2025
…lls (adcontextprotocol#580) * Add context=None check for header fallbacks (debugging MCP issue) Prevents AttributeError when context is None and trying to access context attributes. Still investigating why get_http_headers() returns empty for MCP without auth. The root issue is that FastMCP may not be passing headers to unauthenticated requests. * Enable FastMCP sessions for proper HTTP context access Changed stateless_http from True to False to allow proper HTTP request context for header access in unauthenticated calls. Problem: - MCP list_authorized_properties failed without auth - get_http_headers() returned empty in stateless mode - Tenant detection from headers (Apx-Incoming-Host) failed Solution: - Enable sessions (stateless_http=False) - FastMCP maintains HTTP context across request lifecycle - get_http_headers() can now access headers even without auth Note: The deprecation warning shows stateless_http is deprecated anyway, so this aligns with FastMCP's recommended approach. Testing: MCP list_authorized_properties should now work without auth token, detecting tenant from Apx-Incoming-Host header.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Fixes MCP
list_authorized_propertiestenant detection for unauthenticated calls by enabling FastMCP sessions.This completes the fix for test-agent.adcontextprotocol.org MCP endpoint.
Problem
MCP with
stateless_http=Truedoesn't maintain HTTP request context:get_http_headers()returns empty for unauthenticated callsApx-Incoming-Host,Host, orx-adcp-tenantheadersRuntimeError: No tenant context setRoot Cause
In stateless mode, FastMCP doesn't set up the HTTP request context variables that
get_http_headers()needs to access headers.Solution
Enable sessions (
stateless_http=False):get_http_headers()can access headers even without authenticationApx-Incoming-Hostheader works correctlyChanges
stateless_httpfromTruetoFalseBonus
The deprecation warning shows
stateless_httpparameter is deprecated anyway, so this aligns with FastMCP's recommended approach.Impact
list_authorized_propertiesnow works without authenticationTest Results (Expected)
Before:
After:
publisher_domainssuccessfullyRelated
🤖 Generated with Claude Code