release: sync fastmcpp v3.4.7.1 from private

HTTPS without OpenSSL, an OAuth-capable client, and a handshake that negotiates.

Reaching https:// no longer needs OpenSSL. With FASTMCPP_ENABLE_OPENSSL off --
the default -- an https:// URL parsed fine and then failed at the TLS handshake.
Two new transports close that, both implementing ITransport so they drop into
Client in place of StreamableHttpTransport:
  * WinHttpTransport (Windows, on by default) -- TLS via Schannel, with the
    system certificate store and enterprise proxy configuration. No third-party
    dependency.
  * CurlTransport (all platforms, FASTMCPP_ENABLE_CURL_TRANSPORT=ON) -- binds to
    whichever TLS backend the platform provides.

Client:
  * HeaderProvider computes headers per request, so a rotating bearer token is
    refreshed without rebuilding the transport and losing its session. It is
    given the outgoing request, so request-signing schemes work too.
  * TransportHttpError retains the status, headers and body of a failure. The
    WWW-Authenticate challenge -- the client's discovery mechanism under the MCP
    authorization spec -- was previously discarded. It derives from
    TransportError, so existing catch sites are unaffected.
  * Credentials are dropped across a cross-origin redirect.
  * Client::set_protocol_version(), and cancel() now accepts a JSON-RPC id.

Protocol:
  * ITransport::notify() frames notifications without an id.
    notifications/initialized was never sent, leaving the handshake incomplete;
    cancel/progress/roots-list-changed went out as requests carrying ids.
  * Servers negotiate: initialize echoes back a recognised requested version
    rather than announcing a constant, so older clients keep working. The
    default advances to 2025-11-25.
  * A timed-out tools/call sends notifications/cancelled naming that request.

Fixes:
  * The Host/Origin guard could reset the connection instead of delivering its
    421/403. httplib runs pre-routing before the body is read, so rejecting a
    POST left it unread and the close sent RST -- and every MCP request is a
    POST with a body.
  * call_tool_mcp's timeout could not fire early: an std::async future's
    destructor blocks, so the exception arrived only after the call finished.
  * clientInfo.version was hardcoded at 2.14.0; it is now the build version.

Versioning: major.minor.patch tracks the upstream fastmcp release this port is
at parity with; the fourth component is a local revision for C++-side work with
no upstream delta, and resets when the parity level moves.

Author: 0xeb

.github/workflows/ci.yml

@@ -64,4 +64,46 @@ jobs:
         run: cmake --build build --config ${{ matrix.build_type }} -- /m:1 /p:CL_MPCount=1
 
       - name: Test
-        run: ctest --test-dir build -C ${{ matrix.build_type }} --output-on-failure
+        # --timeout so a hung test fails its own case instead of running to the
+        # job limit. There is no per-test TIMEOUT property on most of these, and a
+        # blocked process would otherwise hold the whole leg for hours.
+        run: ctest --test-dir build -C ${{ matrix.build_type }} --output-on-failure --timeout 300
+
+  # The default matrix never sets FASTMCPP_ENABLE_CURL_TRANSPORT, so without this
+  # job the libcurl transport is the one piece of the client that CI never
+  # compiles -- on exactly the platforms it exists for. WinHTTP needs no
+  # equivalent: it is on by default and windows-latest is already in the matrix.
+  curl-transport:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+
+    runs-on: ${{ matrix.os }}
+    name: ${{ matrix.os }} (curl transport)
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Cache FetchContent dependencies
+        uses: actions/cache@v4
+        with:
+          path: build-curl/_deps
+          key: curl-deps-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('CMakeLists.txt') }}
+          restore-keys: |
+            curl-deps-${{ runner.os }}-${{ runner.arch }}-
+
+      - name: Configure
+        run: >
+          cmake -B build-curl -S .
+          -DCMAKE_BUILD_TYPE=Release
+          -DFASTMCPP_BUILD_TESTS=ON
+          -DFASTMCPP_BUILD_EXAMPLES=OFF
+          -DFASTMCPP_ENABLE_CURL_TRANSPORT=ON
+
+      - name: Build
+        run: cmake --build build-curl --config Release --parallel 2
+
+      - name: Test
+        run: ctest --test-dir build-curl -C Release --output-on-failure --timeout 300

CMakeLists.txt

@@ -3,7 +3,14 @@ cmake_minimum_required(VERSION 3.16)
 if(POLICY CMP0169)
   cmake_policy(SET CMP0169 OLD)
 endif()
-project(fastmcpp VERSION 3.4.7 LANGUAGES CXX)
+# major.minor.patch = upstream fastmcp parity level; optional 4th = local revision.
+project(fastmcpp VERSION 3.4.7.1 LANGUAGES CXX)
+
+# Empty for a 3-component version, which would expand to FASTMCPP_VERSION_TWEAK=.
+if(NOT DEFINED PROJECT_VERSION_TWEAK OR PROJECT_VERSION_TWEAK STREQUAL "")
+  set(PROJECT_VERSION_TWEAK 0)
+endif()
+set(FASTMCPP_VERSION_STRING "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}.${PROJECT_VERSION_TWEAK}")
 
 set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
@@ -16,6 +23,17 @@ option(FASTMCPP_FETCH_CURL "Fetch and build libcurl statically for POST streamin
 option(FASTMCPP_ENABLE_SAMPLING_HTTP_HANDLERS "Enable built-in OpenAI/Anthropic sampling handlers (requires libcurl)" OFF)
 option(FASTMCPP_ENABLE_OPENSSL "Enable HTTPS/SSL support via OpenSSL (for cpp-httplib)" OFF)
 
+# TLS via Schannel, no extra dependency. Reaches https:// without OpenSSL.
+if(WIN32)
+  option(FASTMCPP_ENABLE_WINHTTP "Build the WinHTTP client transport (Windows only)" ON)
+else()
+  set(FASTMCPP_ENABLE_WINHTTP OFF)
+endif()
+
+# Portable https://, using whichever TLS backend libcurl binds to. Off by default
+# because it pulls libcurl into the build.
+option(FASTMCPP_ENABLE_CURL_TRANSPORT "Build the libcurl client transport (all platforms)" OFF)
+
 add_library(fastmcpp_core STATIC
     src/types.cpp
     src/util/schema_build.cpp
@@ -55,18 +73,33 @@ add_library(fastmcpp_core STATIC
     src/client/client.cpp
     src/client/sampling_handlers.cpp
     src/client/transports.cpp
+    src/client/http_detail.cpp
+    src/client/sse_stream.cpp
+    src/client/http_rpc_transport.cpp
     src/telemetry.cpp
     src/util/json_schema.cpp
     src/util/json_schema_type.cpp
     src/settings.cpp
 )
+if(WIN32 AND FASTMCPP_ENABLE_WINHTTP)
+  target_sources(fastmcpp_core PRIVATE src/client/winhttp_transport.cpp)
+  target_link_libraries(fastmcpp_core PUBLIC winhttp)
+  target_compile_definitions(fastmcpp_core PUBLIC FASTMCPP_HAS_WINHTTP)
+  message(STATUS "FASTMCPP_ENABLE_WINHTTP=ON: WinHTTP client transport enabled")
+endif()
+
 target_include_directories(fastmcpp_core PUBLIC
     $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
     $<INSTALL_INTERFACE:include>
 )
 
 # Version header is public
-target_compile_definitions(fastmcpp_core PUBLIC FASTMCPP_VERSION_MAJOR=${PROJECT_VERSION_MAJOR} FASTMCPP_VERSION_MINOR=${PROJECT_VERSION_MINOR} FASTMCPP_VERSION_PATCH=${PROJECT_VERSION_PATCH})
+target_compile_definitions(fastmcpp_core PUBLIC
+    FASTMCPP_VERSION_MAJOR=${PROJECT_VERSION_MAJOR}
+    FASTMCPP_VERSION_MINOR=${PROJECT_VERSION_MINOR}
+    FASTMCPP_VERSION_PATCH=${PROJECT_VERSION_PATCH}
+    FASTMCPP_VERSION_TWEAK=${PROJECT_VERSION_TWEAK}
+    FASTMCPP_VERSION_STRING="${FASTMCPP_VERSION_STRING}")
 
 # MSVC: avoid parallel compilation PDB contention (C1041) in large targets
 if(MSVC)
@@ -135,7 +168,7 @@ else()
 endif()
 
 # Optional: libcurl for POST streaming and sampling handlers (modular)
-if(FASTMCPP_ENABLE_POST_STREAMING OR FASTMCPP_ENABLE_SAMPLING_HTTP_HANDLERS)
+if(FASTMCPP_ENABLE_POST_STREAMING OR FASTMCPP_ENABLE_SAMPLING_HTTP_HANDLERS OR FASTMCPP_ENABLE_CURL_TRANSPORT)
   if(FASTMCPP_FETCH_CURL)
     message(STATUS "FASTMCPP_FETCH_CURL=ON: fetching curl via FetchContent (static-only)")
     include(FetchContent)
@@ -196,13 +229,22 @@ if(FASTMCPP_ENABLE_POST_STREAMING OR FASTMCPP_ENABLE_SAMPLING_HTTP_HANDLERS)
     if(FASTMCPP_ENABLE_POST_STREAMING)
       target_compile_definitions(fastmcpp_core PRIVATE FASTMCPP_POST_STREAMING)
     endif()
+    if(FASTMCPP_ENABLE_CURL_TRANSPORT)
+      target_sources(fastmcpp_core PRIVATE src/client/curl_transport.cpp)
+      # PUBLIC: the header is installed, so consumers need the same guard.
+      target_compile_definitions(fastmcpp_core PUBLIC FASTMCPP_HAS_CURL_TRANSPORT)
+      message(STATUS "FASTMCPP_ENABLE_CURL_TRANSPORT=ON: libcurl client transport enabled")
+    endif()
   else()
     if(FASTMCPP_ENABLE_POST_STREAMING)
       message(STATUS "libcurl not found; POST streaming will be disabled at runtime (request_stream_post throws)")
     endif()
     if(FASTMCPP_ENABLE_SAMPLING_HTTP_HANDLERS)
       message(STATUS "libcurl not found; built-in sampling handlers will be unavailable")
     endif()
+    if(FASTMCPP_ENABLE_CURL_TRANSPORT)
+      message(FATAL_ERROR "FASTMCPP_ENABLE_CURL_TRANSPORT=ON but libcurl was not found; set FASTMCPP_FETCH_CURL=ON or provide a curl toolchain")
+    endif()
   endif()
 endif()
 
@@ -222,6 +264,13 @@ endif()
 
 if(FASTMCPP_BUILD_TESTS)
   enable_testing()
+
+  # Routes a failed Debug assert to stderr instead of a modal dialog.
+  # OBJECT, not STATIC: nothing references it, so STATIC would link but not run.
+  # link_libraries() covers every test target created below.
+  add_library(fastmcpp_test_crt OBJECT tests/support/crt_bootstrap.cpp)
+  link_libraries(fastmcpp_test_crt)
+
   add_executable(fastmcp_smoke tests/smoke.cpp)
   target_link_libraries(fastmcp_smoke PRIVATE fastmcpp_core)
   add_test(NAME fastmcp_smoke COMMAND fastmcp_smoke)
@@ -507,6 +556,50 @@ if(FASTMCPP_BUILD_TESTS)
   target_link_libraries(fastmcpp_client_transports PRIVATE fastmcpp_core)
   add_test(NAME fastmcpp_client_transports COMMAND fastmcpp_client_transports)
 
+  add_executable(fastmcpp_client_header_provider tests/client/header_provider.cpp)
+  target_link_libraries(fastmcpp_client_header_provider PRIVATE fastmcpp_core)
+  add_test(NAME fastmcpp_client_header_provider COMMAND fastmcpp_client_header_provider)
+
+  add_executable(fastmcpp_client_http_rpc_transport tests/client/http_rpc_transport.cpp)
+  target_link_libraries(fastmcpp_client_http_rpc_transport PRIVATE fastmcpp_core)
+  add_test(NAME fastmcpp_client_http_rpc_transport COMMAND fastmcpp_client_http_rpc_transport)
+
+  add_executable(fastmcpp_client_sse_stream tests/client/sse_stream.cpp)
+  target_link_libraries(fastmcpp_client_sse_stream PRIVATE fastmcpp_core)
+  add_test(NAME fastmcpp_client_sse_stream COMMAND fastmcpp_client_sse_stream)
+
+  add_executable(fastmcpp_client_version_reporting tests/client/version_reporting.cpp)
+  target_link_libraries(fastmcpp_client_version_reporting PRIVATE fastmcpp_core)
+  add_test(NAME fastmcpp_client_version_reporting COMMAND fastmcpp_client_version_reporting)
+
+  add_executable(fastmcpp_client_cancel_on_timeout tests/client/cancel_on_timeout.cpp)
+  target_link_libraries(fastmcpp_client_cancel_on_timeout PRIVATE fastmcpp_core)
+  add_test(NAME fastmcpp_client_cancel_on_timeout COMMAND fastmcpp_client_cancel_on_timeout)
+
+  if(WIN32 AND FASTMCPP_ENABLE_WINHTTP)
+    add_executable(fastmcpp_client_winhttp_transport tests/client/winhttp_transport.cpp)
+    target_link_libraries(fastmcpp_client_winhttp_transport PRIVATE fastmcpp_core)
+    add_test(NAME fastmcpp_client_winhttp_transport COMMAND fastmcpp_client_winhttp_transport)
+  endif()
+
+  if(FASTMCPP_ENABLE_CURL_TRANSPORT)
+    add_executable(fastmcpp_client_curl_transport tests/client/curl_transport.cpp)
+    target_link_libraries(fastmcpp_client_curl_transport PRIVATE fastmcpp_core)
+    add_test(NAME fastmcpp_client_curl_transport COMMAND fastmcpp_client_curl_transport)
+  endif()
+
+  add_executable(fastmcpp_client_http_error_detail tests/client/http_error_detail.cpp)
+  target_link_libraries(fastmcpp_client_http_error_detail PRIVATE fastmcpp_core)
+  add_test(NAME fastmcpp_client_http_error_detail COMMAND fastmcpp_client_http_error_detail)
+
+  add_executable(fastmcpp_client_notifications tests/client/notifications.cpp)
+  target_link_libraries(fastmcpp_client_notifications PRIVATE fastmcpp_core)
+  add_test(NAME fastmcpp_client_notifications COMMAND fastmcpp_client_notifications)
+
+  add_executable(fastmcpp_client_protocol_version tests/client/protocol_version.cpp)
+  target_link_libraries(fastmcpp_client_protocol_version PRIVATE fastmcpp_core)
+  add_test(NAME fastmcpp_client_protocol_version COMMAND fastmcpp_client_protocol_version)
+
   add_executable(fastmcpp_client_http_client_security tests/client/http_client_security.cpp)
   target_link_libraries(fastmcpp_client_http_client_security PRIVATE fastmcpp_core)
   add_test(NAME fastmcpp_client_http_client_security COMMAND fastmcpp_client_http_client_security)
@@ -738,6 +831,9 @@ if(FASTMCPP_BUILD_TESTS)
   endif()
 endif()
 
+# End of test scope: examples must not inherit the Debug CRT bootstrap.
+set_property(DIRECTORY PROPERTY LINK_LIBRARIES "")
+
 if(FASTMCPP_BUILD_EXAMPLES)
   add_executable(fastmcpp_example_server examples/server_quick_start.cpp)
   target_link_libraries(fastmcpp_example_server PRIVATE fastmcpp_core)

README.md

@@ -15,17 +15,27 @@ fastmcpp is a C++ port of the Python [fastmcp](https://github.com/jlowin/fastmcp
 
 **Status:** Beta – core MCP features track the Python `fastmcp` reference.
 
-**Current version:** 3.4.7
+**Current version:** 3.4.7.1
 
 ## Features
 
 - Core MCP protocol implementation (JSON‑RPC).
 - Multiple transports: STDIO, HTTP (SSE), Streamable HTTP.
 - Streamable HTTP transport (MCP spec 2025-03-26) with session management.
+- WinHTTP client transport on Windows: HTTPS through Schannel, with the system
+  certificate store and enterprise proxy configuration, and no OpenSSL.
+- libcurl client transport on every platform, binding to whichever TLS backend
+  the platform provides (`FASTMCPP_ENABLE_CURL_TRANSPORT=ON`).
+- Per-request header provider for rotating credentials such as OAuth tokens.
+- HTTP failures reported as `TransportHttpError`, retaining the status code,
+  response headers (including `WWW-Authenticate`) and body.
 - Tool management and invocation.
 - Resources and prompts support.
 - Resource templates with URI pattern matching.
 - Resource annotations (MCP 2025-11-25): audience targeting, priority hints, icons.
+- MCP protocol version `2025-11-25` by default, with negotiation: a server echoes
+  back the revision a client asked for when it recognises it, so an older client
+  keeps working. Override per client with `Client::set_protocol_version()`.
 - JSON Schema validation.
 - FastMCP high-level application class.
 - ProxyApp for backend server proxying.
@@ -40,13 +50,47 @@ fastmcpp is a C++ port of the Python [fastmcp](https://github.com/jlowin/fastmcp
 ## Requirements
 
 - C++17 or later compiler.
-- CMake 3.20 or higher.
+- CMake 3.16 or higher.
 - `nlohmann/json` (fetched automatically).
 
 Optional:
 
-- libcurl (for HTTP POST streaming; can be fetched when `FASTMCPP_FETCH_CURL=ON`).
+- libcurl (for HTTP POST streaming and the libcurl client transport; fetched
+  when `FASTMCPP_FETCH_CURL=ON`, which is the default).
 - cpp‑httplib (HTTP server, fetched automatically).
+- OpenSSL, only if you want HTTPS through the cpp‑httplib transports
+  (`FASTMCPP_ENABLE_OPENSSL=ON`). See "Reaching `https://` servers" below for
+  the alternatives that need no extra dependency.
+
+### Reaching `https://` servers
+
+The cpp‑httplib transports negotiate TLS only when cpp‑httplib itself is
+compiled with `CPPHTTPLIB_OPENSSL_SUPPORT`, so with the default
+`FASTMCPP_ENABLE_OPENSSL=OFF` an `https://` URL fails at runtime with
+`'https' scheme is not supported`. The URL parser accepts the scheme and
+defaults to port 443; only the TLS handshake is missing.
+
+Three ways to fix that:
+
+- **Windows** — use `fastmcpp::client::WinHttpTransport`, built by default
+  (`FASTMCPP_ENABLE_WINHTTP=ON`). TLS comes from Schannel, and the system
+  certificate store, enterprise proxy settings and CA policy come with it. No
+  extra dependency.
+- **Any platform** — use `fastmcpp::client::CurlTransport`, built with
+  `FASTMCPP_ENABLE_CURL_TRANSPORT=ON`. libcurl binds to whichever TLS backend
+  the platform provides, so this reaches `https://` on Linux and macOS as well
+  as Windows.
+- **OpenSSL** — set `FASTMCPP_ENABLE_OPENSSL=ON`, with one caveat worth knowing:
+  it is necessary but not sufficient when your project supplies its own
+  `httplib::httplib` target. fastmcpp then leaves `CPPHTTPLIB_OPENSSL_SUPPORT`
+  to that target to avoid an ODR mismatch, so cpp‑httplib must itself be built
+  with its `openssl` feature or the build will succeed and then fail at runtime.
+
+All three implement `ITransport`, so they drop into `Client` in place of
+`StreamableHttpTransport`. The two above share `HttpRpcTransport`, which owns
+the JSON-RPC framing, the redirect policy and session handling, so they also
+support the per-request header provider and report failures as
+`TransportHttpError`.
 
 ## Building
 
@@ -75,8 +119,15 @@ Key options:
 | Option                           | Default | Description                                      |
 |----------------------------------|---------|--------------------------------------------------|
 | `CMAKE_BUILD_TYPE`              | Debug   | Build configuration (Debug/Release/RelWithDebInfo) |
+| `FASTMCPP_BUILD_TESTS`          | ON      | Build the test suite                             |
+| `FASTMCPP_BUILD_EXAMPLES`       | ON      | Build the example programs                       |
+| `FASTMCPP_BUILD_CLI`            | ON      | Build the `fastmcpp` command-line executable     |
 | `FASTMCPP_ENABLE_POST_STREAMING` | OFF     | Enable HTTP POST streaming (requires libcurl)   |
-| `FASTMCPP_FETCH_CURL`           | OFF     | Fetch and build curl (via FetchContent) if not found |
+| `FASTMCPP_FETCH_CURL`           | ON      | Fetch and build curl (via FetchContent) if not found |
+| `FASTMCPP_ENABLE_OPENSSL`       | OFF     | HTTPS for the cpp-httplib transports, via OpenSSL |
+| `FASTMCPP_ENABLE_WINHTTP`       | ON (Windows) | Build the WinHTTP client transport          |
+| `FASTMCPP_ENABLE_CURL_TRANSPORT` | OFF    | Build the libcurl client transport (all platforms) |
+| `FASTMCPP_ENABLE_SAMPLING_HTTP_HANDLERS` | OFF | Built-in OpenAI/Anthropic sampling handlers |
 | `FASTMCPP_ENABLE_STREAMING_TESTS` | OFF   | Enable SSE streaming tests                      |
 
 ### Platform notes
@@ -355,7 +406,7 @@ See the `examples/` directory for complete programs, including:
 fastmcpp/
   include/fastmcpp/   # Public headers (client, server, tools, etc.)
   src/                # Implementation
-  tests/              # Test suite (GoogleTest)
+  tests/              # Test suite (standalone executables, no framework)
   examples/           # Example programs
   CMakeLists.txt      # Build configuration
   LICENSE             # Apache 2.0 license

include/fastmcpp.hpp

@@ -32,8 +32,11 @@
 
 // Client
 #include "fastmcpp/client/client.hpp"
+#include "fastmcpp/client/curl_transport.hpp"
+#include "fastmcpp/client/http_rpc_transport.hpp"
 #include "fastmcpp/client/transports.hpp"
 #include "fastmcpp/client/types.hpp"
+#include "fastmcpp/client/winhttp_transport.hpp"
 
 // Server
 #include "fastmcpp/server/context.hpp"