Skip to content

Conversation

ruhz3
Copy link

@ruhz3 ruhz3 commented Aug 18, 2025

Added support for the verify option to the create_mcp_http_client function and related client factories, allowing users to control SSL certificate verification when creating an httpx AsyncClient.

Motivation and Context

Some users need to disable SSL verification (e.g., for testing or internal endpoints), or use a custom CA bundle. This change makes it possible to pass verify=True, verify=False, or a custom ssl.SSLContext when creating MCP HTTP clients.

How Has This Been Tested?

Tested by creating AsyncClient instances with different verify values (True, False, and custom context) and confirming correct behavior for secure and insecure endpoints. Existing unit tests for HTTP client creation were also run.

Breaking Changes

No breaking changes. The new verify parameter is optional and defaults to the previous behavior.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

This change improves flexibility for users working in environments with custom or self-signed certificates, or those who need to disable SSL verification for

resolves #870
This PR does not fully resolve the linked issue, but it applies the necessary modifications to the current repository. Further functional modifications following this PR are needed in the fastmcp repository.

@ruhz3 ruhz3 requested review from a team and dsp-ant August 18, 2025 13:39
@Kludex
Copy link
Member

Kludex commented Aug 20, 2025

We should be passing the client, instead of allowing more and more options.

@ruhz3
Copy link
Author

ruhz3 commented Aug 24, 2025

Respecting the original author's intention to avoid exposing AsyncClient directly to users, the FactoryClient was modified to accept kwargs.

Copy link
Contributor

@felixweinberger felixweinberger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIUC I don't think the intention here was to pass through arbitrary arguments through to the underlying client, but refactoring to remove the factory in the first place and explicitly use the client.

See #1177 for context. I'm going to mark this as pending that change.

@felixweinberger felixweinberger added needs more work Not ready to be merged yet, needs additional changes. pending dependency updates This change depends on updates to dependencies pending linked change Depends on a change linked in a comment and removed pending dependency updates This change depends on updates to dependencies labels Sep 23, 2025
@felixweinberger felixweinberger self-assigned this Sep 23, 2025
@felixweinberger felixweinberger added the needs maintainer action Potentially serious issue - needs proactive fix and maintainer attention label Sep 23, 2025
@ruhz3 ruhz3 changed the title Support SSL certificate verification option when creating httpx AsyncClient Replace httpx_client_factory with direct httpx_client parameter for better flexibility Sep 30, 2025
@ruhz3
Copy link
Author

ruhz3 commented Sep 30, 2025

I’d greatly appreciate any active and constructive reviews.

@felixweinberger
Copy link
Contributor

Hi @ruhz3 thank you for updating this PR - I don't think we'll go with this approach as we're actually intending to remove all the arguments other than the httpx.AsyncClient

We're currently working on this here: #1177

I'm closing this for now, feel free to chime in on the linked PR though if it's missing something you need!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs maintainer action Potentially serious issue - needs proactive fix and maintainer attention needs more work Not ready to be merged yet, needs additional changes. pending linked change Depends on a change linked in a comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add SSL Certificate Verification Options to FastMCP Client
3 participants