Is fastmcp safe?

process = await asyncio.create_subprocess_exec(
        *cmd,
        env=env,
        start_new_session=sys.platform != "win32",
    )

subprocess.run([cmd, "--version"], check=True, capture_output=True)

process = subprocess.run(
            [npx_cmd, inspector_cmd, *uv_cmd],
            check=True,
            env=env,
        )

process = subprocess.run(cmd, check=True, env=env)

process = subprocess.run(cmd, check=True, env=env)

result = subprocess.run(
                [claude_in_path, "--version"],
                check=True,
                capture_output=True,
                text=True,
            )

result = subprocess.run(
                    [str(path), "--version"],
                    check=True,
                    capture_output=True,
                    text=True,
                )

subprocess.run(cmd_parts, check=True, capture_output=True, text=True)

subprocess.run(
                [gemini_in_path, "--version"],
                check=True,
                capture_output=True,
            )

subprocess.run(
                    [str(path), "--version"],
                    check=True,
                    capture_output=True,
                )

subprocess.run(cmd_parts, check=True, capture_output=True, text=True)

subprocess.run(["open", url], check=True, capture_output=True)

subprocess.run(["xdg-open", url], check=True, capture_output=True)

process = subprocess.run(cmd, check=True)

process = await asyncio.create_subprocess_exec(
                *cmd,
                stdin=None,
                stdout=None,
                stderr=None,
                # Own process group so _terminate_process can kill the whole tree …

subprocess.run(
                [
                    "uv",
                    "init",
                    "--project",
                    str(output_dir),
                    "--name",
                    "fastmcp-env",
                ] …

subprocess.run(
                    [
                        "uv",
                        "python",
                        "pin",
                        self.python,
                        "--project",
                        str(outpu …

subprocess.run(
                [
                    "uv",
                    "add",
                    *dependencies,
                    "--no-sync",
                    "--project",
                    str(output_dir), …

subprocess.run(
                    [
                        "uv",
                        "add",
                        "-r",
                        str(req_path),
                        "--no-sync",
                        "--project" …

subprocess.run(
                    [
                        "uv",
                        "add",
                        "--editable",
                        *editable_paths,
                        "--no-sync",
                        " …

subprocess.run(
                ["uv", "sync", "--project", str(output_dir)],
                check=True,
                capture_output=True,
                text=True,
            )

r = subprocess.run(
        [sys.executable, "-c", code],
        capture_output=True,
        text=True,
        timeout=30,
    )

examples=["127.0.0.1", "0.0.0.0", "localhost"],

app_bridge_js = app_bridge_cache.read_text(encoding="utf-8")

with open(Path(server_spec)) as f:

data = json.loads(path.read_text())

text = path.read_text()

text = path.read_text()

text = path.read_text()

content = config_file.read_text().strip()

with open(config_path) as f:

with open(config_path) as f:

content := file_path.read_text(encoding="utf-8").strip()

content: str | bytes = await self._async_path.read_bytes()

content = await self._async_path.read_text(encoding=self.encoding)

with open(path, "rb") as f:

return main_file_path.read_text(encoding="utf-8")

return full_path.read_text(encoding="utf-8")

return full_path.read_bytes()

return full_path.read_text(encoding="utf-8")

return full_path.read_bytes()

content = main_file.read_text(encoding="utf-8")

with open(config_path) as f:

with open(self.path, "rb") as f:

with open(self.path, "rb") as f:

with open(self.path, "rb") as f:

app_bridge_cache.write_text(app_bridge_js, encoding="utf-8")

with open(output_path, "w") as f:

output_path.write_text(script)

skill_path.write_text(skill_content)

config_file.write_text('{"mcpServers": {}}')

file_path.write_text(self.model_dump_json(indent=2), encoding="utf-8")

with open(output, "w") as f:

file_path.write_text(content.text)

file_path.write_bytes(base64.b64decode(content.blob))

cache_path.write_text(
            json.dumps({"latest_version": latest_version, "timestamp": time.time()})
        )

from urllib.parse import urlparse

parsed_url = urlparse(args.url)

from urllib.parse import urlencode

import httpx

with httpx.Client(timeout=30.0) as client:

with httpx.Client(timeout=30.0) as client:

with httpx.Client(timeout=30.0) as client:

url = "/launch?" + urlencode({"tool": tool, "args": json.dumps(tool_args)})

client = httpx.AsyncClient(
            timeout=httpx.Timeout(60.0, read=None), trust_env=False
        )

# These providers pull in heavy deps (authlib, cryptography, key_value.aio,

f"/.well-known/openid-configuration{issuer_path}",

# Always register /.well-known/openid-configuration regardless of path depth.

#    /{prefix}/.well-known/openid-configuration arrives here as

#    /.well-known/openid-configuration.

"/.well-known/openid-configuration",

from authlib.common.security import generate_token

from authlib.integrations.httpx_client import AsyncOAuth2Client

- Forward refresh requests to upstream using authlib

If None, authlib will use its default (typically "client_secret_basic").

access_token, and for OIDC providers may include id_token,

to verify a different token (e.g., the OIDC id_token for providers

# When alternate verification is in use (e.g., id_token

# JWTs for both access_token and id_token, which would cause

authorization_endpoint: AnyHttpUrl | str | None = None  # Strict

enforce("authorization_endpoint", True)

verify_id_token: If True, verify the OIDC id_token instead of the access_token.

id_token is always a standard JWT verifiable via the provider's JWKS.

If None, authlib will use its default (typically "client_secret_basic").

not self.oidc_config.authorization_endpoint

self.oidc_config.authorization_endpoint

When verify_id_token is enabled, returns the id_token from the

id_token = upstream_token_set.raw_token_data.get("id_token")

if id_token is None:

mcp = FastMCP()