# FastMCP v4.1.3: what's new, verdict & setup Canonical: https://theagenticweekly.com/tools/fastmcp · Released: 2026-10-20 · Last verified: 2026-10-25 · Evidence: Tested (smoke test, 2026-10-25, no language model involved) · Vendor: Prefect · Official site: https://github.com/PrefectHQ/fastmcp > The Pythonic way to build MCP servers and clients. ## Verdict **If you run FastMCP servers, upgrade and read the security notices; the OAuth issuer step is not automatic.** Good for: - Python developers building MCP servers or clients - Teams exposing internal tools to agents - Anyone running OAuth-protected MCP servers Skip if: - You do not use MCP - You cannot update trust stores in your deployment environment Tested. Tested 2026-10-25 (America/Chicago). First run, 17:35 to 17:55 CDT (its raw log is not published on a /tests page): installed fastmcp 4.1.3 with uv into a fresh Python 3.13 venv. Wrote a two-tool server and called it three ways: in-memory client (add 2+40 returned 42), real stdio subprocess (slugify returned agentic-weekly-tested-tools) and HTTP transport on 127.0.0.1 (add 5+6 returned 11). "fastmcp inspect" listed 2 tools. Not tested: OAuth issuer settings and the CA trust-store fix that this release is about. Test environment: Linux x86_64 box with 8 CPUs and no GPU, no vendor account or API key. No language model was involved in this test, so it says nothing about any model, vendor-hosted or local. Published log (/tests/mcp-python-servers, stdio only, 2026-10-25): the same three-tool server written with FastMCP 4.1.3 and with the official MCP Python SDK 2.3.0 answered calls equally fast (about 1 ms); FastMCP started in 643 to 735 ms against 461 to 516 ms for the SDK on repeats. The public log, /tests/mcp-python-servers, covers only the stdio server comparison (three tools, FastMCP 4.1.3 against the official SDK 2.3.0); the in-memory, HTTP and fastmcp inspect results above are not on that page. Test scope: - Kind and date: smoke test, 2026-10-25 (America/Chicago). Not a benchmark. - What we ran: First run (2026-10-25, 17:35 to 17:55 CDT; raw log not published on a /tests page): installed fastmcp 4.1.3 with uv, wrote a two-tool server and called it through an in-memory client, a stdio subprocess and HTTP on 127.0.0.1; fastmcp inspect listed 2 tools. Published log (/tests/mcp-python-servers, stdio only): the same three-tool server written with FastMCP 4.1.3 and with the official MCP Python SDK 2.3.0 answered calls equally fast (about 1 ms); FastMCP started in 643 to 735 ms against 461 to 516 ms for the SDK on repeats. - Model used: None; no language model was involved - Environment: Linux x86_64 box, 8 CPUs, no GPU; no vendor account, login or API key - Not tested: OAuth issuer settings and the CA trust-store fix this release is about; Remote (HTTP) transport, authentication and concurrent clients: only local stdio with one client was measured; Large payloads: calls used tiny inputs, so these latencies are protocol and process overhead, not throughput; Anything about answer quality: no model was involved in the latency numbers; These are single smoke-test runs; it is not a benchmark. The machine was shared with other jobs. Full test log (commands, versions, raw output): [FastMCP 4.1.3 and the official MCP Python SDK 2.3.0 (server side) fastmcp 4.1.3; mcp 2.3.0: our test log](https://theagenticweekly.com/tests/mcp-python-servers) Pricing: Not verified. We have not verified pricing for this tool; see the official site. ## Best for - [Best AI tool for agent building](https://theagenticweekly.com/best/agent-building) (#7): A widely used Python library for MCP servers; the October releases are security-focused. ## What's new FastMCP 4.1.2 and 4.1.3 (both Oct 20) are security releases: component authorization now applies after transforms, OAuth client credentials can bind to an issuer, and 4.1.3 updates certificate handling after a CA incident. - 4.1.2 (Oct 20): Component authorization now applies after transforms and denied resources cannot fall through matching templates. - 4.1.2: OAuth client credentials providers support issuer binding, but you must set the issuer to enable the protection. - 4.1.2: Foundation for the SEP-2640 Skills extension and experimental skills discovery. - 4.1.3: Updates certifi-backed dependencies after the eMudhra CA compromise; FastMCP 4 uses system trust by default, so you must update OS, container or custom trust stores too. ## How to set it up: Add FastMCP to a project Install steps come from the vendor's docs. We ran the install and a short real task on 2026-10-25; see the test notes above for what was and was not covered. 1. **Install it.** The README recommends uv. ``` uv add fastmcp ``` 2. **Set the issuer if you use client credentials OAuth.** Per the 4.1.2 notes, ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider users must set issuer to enable the new protection. 3. **Update system trust stores.** The 4.1.3 notes say upgrading FastMCP alone is not enough; follow the repository's SECURITY.md certificate-authority incident notice. ## Pros and cons Pros: - Apache-2.0 license, high adoption - Prompt security fixes with clear notes - Actively maintained by a company Cons: - Security protections here are opt-in or require environment changes - Two releases in one day suggests fast-moving code - Our test covered only basic tools over stdio and HTTP, not OAuth or the security fixes ## Guides for FastMCP - [How to build an MCP server with FastMCP](https://theagenticweekly.com/guides/build-an-mcp-server-with-fastmcp) (Tested (smoke test, 2026-10-25, no LLM involved), stdio only; last verified 2026-10-26) ## Alternatives - [Mastra](https://theagenticweekly.com/tools/mastra): TypeScript framework for AI-powered applications and agents, with a local Studio. - [OpenAI Agents SDK](https://theagenticweekly.com/tools/openai-agents-sdk): Lightweight Python framework for multi-agent workflows, with tools, handoffs, sessions and tracing. - [LangGraph](https://theagenticweekly.com/tools/langgraph): Low-level framework for building long-running, stateful agents as graphs. - [Langflow](https://theagenticweekly.com/tools/langflow): MIT-licensed visual builder for AI agents and MCP servers with a very large GitHub following. - [Botpress](https://theagenticweekly.com/tools/botpress): Customer-support AI agent platform with a free plan and conversation-based paid plans. - [Gumloop](https://theagenticweekly.com/tools/gumloop): Agent builder for teams; plans start at $37 per month with 20k included credits. - [Lindy](https://theagenticweekly.com/tools/lindy): AI 'employee' builder that connects to your tools; Free plan with $50 in credits that last 7 days, then credit-based plans. - [Microsoft Copilot Studio](https://theagenticweekly.com/tools/copilot-studio): Microsoft's platform for creating and managing custom agents, workflows and apps with no code. - [Pydantic AI](https://theagenticweekly.com/tools/pydantic-ai): Python agent framework built on Pydantic types, covering agents, realtime voice, image generation and embeddings. - [Relevance AI](https://theagenticweekly.com/tools/relevance-ai): Platform for specialist AI agents for sales, customer success, marketing and HR, with an embedded deployment team. - [Voiceflow](https://theagenticweekly.com/tools/voiceflow): Platform for chat and voice AI agents for customer experience teams. - [Vercel AI SDK](https://theagenticweekly.com/tools/vercel-ai-sdk): Vercel's TypeScript SDK that gives one API across many model providers, with streaming and agent helpers. ## FAQ ### What changed in FastMCP 4.1.2? Component authorization now applies after transforms, denied resources can no longer fall through to templates, and OAuth client credentials can bind to a configured issuer. ### Is upgrading FastMCP enough after the CA incident? No. The 4.1.3 release notes say you must also update OS, container or custom trust stores, following SECURITY.md. ### How do I install FastMCP? uv add fastmcp. ## What we have not verified - Whether your deployment is affected by the CA incident ## Sources - [FastMCP v4.1.3 release](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.3) (fetched 2026-10-25) - [FastMCP v4.1.2 release](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2) (fetched 2026-10-25) - [README](https://github.com/PrefectHQ/fastmcp) (fetched 2026-10-25) ## How to cite Agentic Weekly, "FastMCP v4.1.3: what's new, verdict & setup", last updated 2026-10-25, https://theagenticweekly.com/tools/fastmcp Keep the Reported or Tested label when you quote the verdict.