FastMCP: what’s new in v4.1.3 and our verdict

Our verdict

If you run FastMCP servers, upgrade and read the security notices; the OAuth issuer step is not automatic.

Tested. Tested 2026-10-25 (America/Chicago). First run, 17:35 to 17:55 CDT (its raw log is not published on a /tests page): installed fastmcp 4.1.3 with uv into a fresh Python 3.13 venv. Wrote a two-tool server and called it three ways: in-memory client (add 2+40 returned 42), real stdio subprocess (slugify returned agentic-weekly-tested-tools) and HTTP transport on 127.0.0.1 (add 5+6 returned 11). "fastmcp inspect" listed 2 tools. Not tested: OAuth issuer settings and the CA trust-store fix that this release is about. Test environment: Linux x86_64 box with 8 CPUs and no GPU, no vendor account or API key. No language model was involved in this test, so it says nothing about any model, vendor-hosted or local. Published log (/tests/mcp-python-servers, stdio only, 2026-10-25): the same three-tool server written with FastMCP 4.1.3 and with the official MCP Python SDK 2.3.0 answered calls equally fast (about 1 ms); FastMCP started in 643 to 735 ms against 461 to 516 ms for the SDK on repeats. The public log, /tests/mcp-python-servers, covers only the stdio server comparison (three tools, FastMCP 4.1.3 against the official SDK 2.3.0); the in-memory, HTTP and fastmcp inspect results above are not on that page.

Full test log with exact commands, versions and raw output: FastMCP 4.1.3 and the official MCP Python SDK 2.3.0 (server side) fastmcp 4.1.3; mcp 2.3.0: our test log.

Evidence

Tested (smoke test, 2026-10-25, no language model involved). A smoke test is not a benchmark.

What we ran

First run (2026-10-25, 17:35 to 17:55 CDT; raw log not published on a /tests page): installed fastmcp 4.1.3 with uv, wrote a two-tool server and called it through an in-memory client, a stdio subprocess and HTTP on 127.0.0.1; fastmcp inspect listed 2 tools. Published log (/tests/mcp-python-servers, stdio only): the same three-tool server written with FastMCP 4.1.3 and with the official MCP Python SDK 2.3.0 answered calls equally fast (about 1 ms); FastMCP started in 643 to 735 ms against 461 to 516 ms for the SDK on repeats.

Model used

None; no language model was involved

Environment

Linux x86_64 box, 8 CPUs, no GPU; no vendor account, login or API key

Not tested

OAuth issuer settings and the CA trust-store fix this release is about; Remote (HTTP) transport, authentication and concurrent clients: only local stdio with one client was measured; Large payloads: calls used tiny inputs, so these latencies are protocol and process overhead, not throughput; Anything about answer quality: no model was involved in the latency numbers; These are single smoke-test runs; it is not a benchmark. The machine was shared with other jobs.

Date

Oct 25, 2026 (America/Chicago)

Best for

• Best AI tool for agent building: A widely used Python library for MCP servers; the October releases are security-focused.

What’s new

FastMCP 4.1.2 and 4.1.3 (both Oct 20) are security releases: component authorization now applies after transforms, OAuth client credentials can bind to an issuer, and 4.1.3 updates certificate handling after a CA incident.

• 4.1.2 (Oct 20): Component authorization now applies after transforms and denied resources cannot fall through matching templates.
• 4.1.2: OAuth client credentials providers support issuer binding, but you must set the issuer to enable the protection.
• 4.1.2: Foundation for the SEP-2640 Skills extension and experimental skills discovery.
• 4.1.3: Updates certifi-backed dependencies after the eMudhra CA compromise; FastMCP 4 uses system trust by default, so you must update OS, container or custom trust stores too.

How to set it up: Add FastMCP to a project

Install steps come from the vendor's docs. We ran the install and a short real task on 2026-10-25; see the test notes above for what was and was not covered.

1. Install it

   The README recommends uv.

   uv add fastmcp

2. Set the issuer if you use client credentials OAuth

   Per the 4.1.2 notes, ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider users must set issuer to enable the new protection.

3. Update system trust stores

   The 4.1.3 notes say upgrading FastMCP alone is not enough; follow the repository's SECURITY.md certificate-authority incident notice.

Pros and cons

Alternatives and comparisons

• Mastra: TypeScript framework for AI-powered applications and agents, with a local Studio.
• OpenAI Agents SDK: Lightweight Python framework for multi-agent workflows, with tools, handoffs, sessions and tracing.
• LangGraph: Low-level framework for building long-running, stateful agents as graphs.
• Langflow: MIT-licensed visual builder for AI agents and MCP servers with a very large GitHub following.

See all alternatives to FastMCP

FAQ

What we have not verified

• Whether your deployment is affected by the CA incident

Sources

• FastMCP v4.1.3 release (fetched 2026-10-25)
• FastMCP v4.1.2 release (fetched 2026-10-25)
• README (fetched 2026-10-25)

Last verified Oct 25, 2026 · Agentic Weekly

Part of the week of Oct 19, 2026 archive.

Guides for FastMCP

• How to build an MCP server with FastMCP (Tested (smoke test, 2026-10-25, no LLM involved), stdio only; last verified Oct 26, 2026)

Related tools

• Langflow: MIT-licensed visual builder for AI agents and MCP servers with a very large GitHub following.
• Botpress: Customer-support AI agent platform with a free plan and conversation-based paid plans.
• Gumloop: Agent builder for teams; plans start at $37 per month with 20k included credits.