fix: upgrade fastmcp to >=3.2.0 to resolve CVE-2026-32871 (CVSS 10.0)

qiskit-docs-mcp-server/pyproject.toml

@@ -7,7 +7,7 @@ requires-python = ">=3.10,<3.15"
 dependencies = [
     "beautifulsoup4>=4.12.0",
     "defusedxml>=0.7.1",
-    "fastmcp>=2.8.1,<3",
+    "fastmcp>=3.2.0,<4",
     "html2text>=2020.1.16",
     "httpx>=0.28.1",
 ]
@@ -64,7 +64,7 @@ test = [
     "pytest-mock>=3.11.0",
 ]
 examples = [
-    "fastmcp>=2.14.0",
+    "fastmcp>=3.2.0,<4",
     "jupyter>=1.1.1",
     "langchain>=1.2.7",
     "langchain-anthropic>=0.1.0",

qiskit-docs-mcp-server/tests/test_server.py

@@ -33,23 +33,21 @@ def test_server_instructions(self):
         assert "lookup_error_code_tool" in mcp.instructions
         assert "qiskit-docs://" in mcp.instructions
 
-    def test_tools_registered(self):
+    async def test_tools_registered(self):
         """Test that all expected tools are registered."""
-        # NOTE: Accessing FastMCP internals for introspection. Update if FastMCP
-        # exposes a public API for listing registered tools/resources.
-        tool_names = {tool.name for tool in mcp._tool_manager._tools.values()}
+        tools = await mcp.list_tools()
+        tool_names = {t.name for t in tools}
         expected_tools = {
             "search_docs_tool",
             "get_page_tool",
             "lookup_error_code_tool",
         }
         assert expected_tools.issubset(tool_names), f"Missing tools: {expected_tools - tool_names}"
 
-    def test_resources_registered(self):
+    async def test_resources_registered(self):
         """Test that all expected resources are registered."""
-        # NOTE: Accessing FastMCP internals for introspection. Update if FastMCP
-        # exposes a public API for listing registered tools/resources.
-        resource_uris = set(mcp._resource_manager._resources.keys())
+        resources = await mcp.list_resources()
+        resource_uris = {str(r.uri) for r in resources}
         expected_resources = {
             "qiskit-docs://modules",
             "qiskit-docs://addons",
@@ -62,21 +60,20 @@ def test_resources_registered(self):
             f"Missing resources: {expected_resources - resource_uris}"
         )
 
-    def test_tool_count(self):
+    async def test_tool_count(self):
         """Test the expected number of tools."""
-        # NOTE: Accessing FastMCP internals for introspection. Update if FastMCP
-        # exposes a public API for listing registered tools/resources.
-        assert len(mcp._tool_manager._tools) == 3
+        tools = await mcp.list_tools()
+        assert len(tools) == 3
 
-    def test_resource_count(self):
+    async def test_resource_count(self):
         """Test the expected number of resources."""
-        assert len(mcp._resource_manager._resources) == 6
+        resources = await mcp.list_resources()
+        assert len(resources) == 6
 
-    def test_old_tools_removed(self):
+    async def test_old_tools_removed(self):
         """Test that old category-specific tools are no longer registered."""
-        # NOTE: Accessing FastMCP internals for introspection. Update if FastMCP
-        # exposes a public API for listing registered tools/resources.
-        tool_names = {tool.name for tool in mcp._tool_manager._tools.values()}
+        tools = await mcp.list_tools()
+        tool_names = {t.name for t in tools}
         removed_tools = {
             "get_sdk_module_docs_tool",
             "get_addon_docs_tool",
@@ -86,9 +83,10 @@ def test_old_tools_removed(self):
             f"Old tools still registered: {removed_tools & tool_names}"
         )
 
-    def test_prompts_registered(self):
+    async def test_prompts_registered(self):
         """Test that all expected prompts are registered."""
-        prompt_names = set(mcp._prompt_manager._prompts.keys())
+        prompts = await mcp.list_prompts()
+        prompt_names = {p.name for p in prompts}
         expected_prompts = {
             "explain_error",
             "module_overview",
@@ -98,13 +96,15 @@ def test_prompts_registered(self):
             f"Missing prompts: {expected_prompts - prompt_names}"
         )
 
-    def test_prompt_count(self):
+    async def test_prompt_count(self):
         """Test the expected number of prompts."""
-        assert len(mcp._prompt_manager._prompts) == 3
+        prompts = await mcp.list_prompts()
+        assert len(prompts) == 3
 
-    def test_resource_templates_registered(self):
+    async def test_resource_templates_registered(self):
         """Test that all expected resource templates are registered."""
-        template_uris = set(mcp._resource_manager._templates.keys())
+        templates = await mcp.list_resource_templates()
+        template_uris = {str(t.uri_template) for t in templates}
         expected_templates = {
             "qiskit-docs://modules/{module_name}",
             "qiskit-docs://guides/{guide_name}",

qiskit-gym-mcp-server/pyproject.toml

@@ -6,7 +6,7 @@ readme = "README.md"
 requires-python = ">=3.10,<3.14"
 
 dependencies = [
-    "fastmcp>=2.12.4,<3",
+    "fastmcp>=3.2.0,<4",
     "qiskit-gym>=0.3.0",
     "qiskit>=1.3.0",
     "nest-asyncio>=1.5.0",

qiskit-gym-mcp-server/tests/test_server.py

@@ -33,9 +33,10 @@ def test_server_instructions(self):
         assert "synthesize_permutation_tool" in mcp.instructions
         assert "qiskit-gym://" in mcp.instructions
 
-    def test_resources_registered(self):
+    async def test_resources_registered(self):
         """Test that all expected static resources are registered."""
-        resource_uris = set(mcp._resource_manager._resources.keys())
+        resources = await mcp.list_resources()
+        resource_uris = {str(r.uri) for r in resources}
         expected_resources = {
             "qiskit-gym://presets/coupling-maps",
             "qiskit-gym://algorithms",
@@ -50,13 +51,15 @@ def test_resources_registered(self):
             f"Missing resources: {expected_resources - resource_uris}"
         )
 
-    def test_resource_count(self):
+    async def test_resource_count(self):
         """Test the expected number of static resources."""
-        assert len(mcp._resource_manager._resources) == 8
+        resources = await mcp.list_resources()
+        assert len(resources) == 8
 
-    def test_prompts_registered(self):
+    async def test_prompts_registered(self):
         """Test that all expected prompts are registered."""
-        prompt_names = set(mcp._prompt_manager._prompts.keys())
+        prompts = await mcp.list_prompts()
+        prompt_names = {p.name for p in prompts}
         expected_prompts = {
             "train_synthesis_model",
             "synthesize_circuit",
@@ -66,13 +69,15 @@ def test_prompts_registered(self):
             f"Missing prompts: {expected_prompts - prompt_names}"
         )
 
-    def test_prompt_count(self):
+    async def test_prompt_count(self):
         """Test the expected number of prompts."""
-        assert len(mcp._prompt_manager._prompts) == 3
+        prompts = await mcp.list_prompts()
+        assert len(prompts) == 3
 
-    def test_resource_templates_registered(self):
+    async def test_resource_templates_registered(self):
         """Test that all expected resource templates are registered."""
-        template_uris = set(mcp._resource_manager._templates.keys())
+        templates = await mcp.list_resource_templates()
+        template_uris = {str(t.uri_template) for t in templates}
         expected_templates = {
             "qiskit-gym://environments/{env_id}",
             "qiskit-gym://models/{model_name}",
@@ -82,6 +87,7 @@ def test_resource_templates_registered(self):
             f"Missing resource templates: {expected_templates - template_uris}"
         )
 
-    def test_resource_template_count(self):
+    async def test_resource_template_count(self):
         """Test the expected number of resource templates."""
-        assert len(mcp._resource_manager._templates) == 3
+        templates = await mcp.list_resource_templates()
+        assert len(templates) == 3

qiskit-ibm-runtime-mcp-server/pyproject.toml

@@ -5,7 +5,7 @@ description = "MCP server for IBM Quantum computing services through Qiskit IBM
 readme = "README.md"
 requires-python = ">=3.10,<3.15"
 dependencies = [
-    "fastmcp>=2.8.1,<3",
+    "fastmcp>=3.2.0,<4",
     "qiskit-ibm-runtime>=0.40.0",
     "qiskit-mcp-server",
     "pydantic>=2.0.0",

qiskit-ibm-runtime-mcp-server/tests/test_server.py

@@ -2481,32 +2481,32 @@ class TestAccountManagementToolsExist:
     def test_delete_saved_account_tool_exists(self):
         """Test delete_saved_account_tool is registered as MCP tool."""
         assert delete_saved_account_tool is not None
-        assert hasattr(delete_saved_account_tool, "name")
+        assert callable(delete_saved_account_tool)
 
     def test_list_saved_accounts_tool_exists(self):
         """Test list_saved_accounts_tool is registered as MCP tool."""
         assert list_saved_accounts_tool is not None
-        assert hasattr(list_saved_accounts_tool, "name")
+        assert callable(list_saved_accounts_tool)
 
     def test_active_account_info_tool_exists(self):
         """Test active_account_info_tool is registered as MCP tool."""
         assert active_account_info_tool is not None
-        assert hasattr(active_account_info_tool, "name")
+        assert callable(active_account_info_tool)
 
     def test_active_instance_info_tool_exists(self):
         """Test active_instance_info_tool is registered as MCP tool."""
         assert active_instance_info_tool is not None
-        assert hasattr(active_instance_info_tool, "name")
+        assert callable(active_instance_info_tool)
 
     def test_available_instances_tool_exists(self):
         """Test available_instances_tool is registered as MCP tool."""
         assert available_instances_tool is not None
-        assert hasattr(available_instances_tool, "name")
+        assert callable(available_instances_tool)
 
     def test_usage_info_tool_exists(self):
         """Test usage_info_tool is registered as MCP tool."""
         assert usage_info_tool is not None
-        assert hasattr(usage_info_tool, "name")
+        assert callable(usage_info_tool)
 
 
 class TestExampleCircuits:
@@ -2635,9 +2635,10 @@ def test_server_name(self):
         """Test the server name is correct."""
         assert mcp.name == "Qiskit IBM Runtime"
 
-    def test_resources_registered(self):
+    async def test_resources_registered(self):
         """Test that all expected static resources are registered."""
-        resource_uris = set(mcp._resource_manager._resources.keys())
+        resources = await mcp.list_resources()
+        resource_uris = {str(r.uri) for r in resources}
         expected_resources = {
             "ibm://status",
             "circuits://bell-state",
@@ -2649,25 +2650,29 @@ def test_resources_registered(self):
             f"Missing resources: {expected_resources - resource_uris}"
         )
 
-    def test_resource_count(self):
+    async def test_resource_count(self):
         """Test the expected number of static resources."""
-        assert len(mcp._resource_manager._resources) == 5
+        resources = await mcp.list_resources()
+        assert len(resources) == 5
 
-    def test_prompts_registered(self):
+    async def test_prompts_registered(self):
         """Test that all expected prompts are registered."""
-        prompt_names = set(mcp._prompt_manager._prompts.keys())
+        prompts = await mcp.list_prompts()
+        prompt_names = {p.name for p in prompts}
         expected_prompts = {"run_bell_state", "explore_backend", "monitor_job"}
         assert expected_prompts.issubset(prompt_names), (
             f"Missing prompts: {expected_prompts - prompt_names}"
         )
 
-    def test_prompt_count(self):
+    async def test_prompt_count(self):
         """Test the expected number of prompts."""
-        assert len(mcp._prompt_manager._prompts) == 3
+        prompts = await mcp.list_prompts()
+        assert len(prompts) == 3
 
-    def test_resource_templates_registered(self):
+    async def test_resource_templates_registered(self):
         """Test that all expected resource templates are registered."""
-        template_uris = set(mcp._resource_manager._templates.keys())
+        templates = await mcp.list_resource_templates()
+        template_uris = {str(t.uri_template) for t in templates}
         expected_templates = {
             "ibm://backends/{backend_name}",
             "ibm://jobs/{job_id}",
@@ -2676,9 +2681,10 @@ def test_resource_templates_registered(self):
             f"Missing resource templates: {expected_templates - template_uris}"
         )
 
-    def test_resource_template_count(self):
+    async def test_resource_template_count(self):
         """Test the expected number of resource templates."""
-        assert len(mcp._resource_manager._templates) == 2
+        templates = await mcp.list_resource_templates()
+        assert len(templates) == 2
 
 
 # Assisted by watsonx Code Assistant

qiskit-ibm-transpiler-mcp-server/pyproject.toml

@@ -6,7 +6,7 @@ readme = "README.md"
 requires-python = ">=3.10,<3.14"
 
 dependencies = [
-    "fastmcp>=2.12.4,<3",
+    "fastmcp>=3.2.0,<4",
     "qiskit-ibm-transpiler>=0.15.0",
     "nest-asyncio>=1.5.0",
     "qiskit-mcp-server",

qiskit-ibm-transpiler-mcp-server/tests/unit/test_server.py

@@ -22,9 +22,10 @@ def test_server_name(self):
         """Test the server name is correct."""
         assert mcp.name == "Qiskit IBM Transpiler"
 
-    def test_tools_registered(self):
+    async def test_tools_registered(self):
         """Test that all expected tools are registered."""
-        tool_names = {tool.name for tool in mcp._tool_manager._tools.values()}
+        tools = await mcp.list_tools()
+        tool_names = {t.name for t in tools}
         expected_tools = {
             "setup_ibm_quantum_account_tool",
             "ai_routing_tool",
@@ -36,13 +37,15 @@ def test_tools_registered(self):
         }
         assert expected_tools.issubset(tool_names), f"Missing tools: {expected_tools - tool_names}"
 
-    def test_tool_count(self):
+    async def test_tool_count(self):
         """Test the expected number of tools."""
-        assert len(mcp._tool_manager._tools) == 7
+        tools = await mcp.list_tools()
+        assert len(tools) == 7
 
-    def test_resources_registered(self):
+    async def test_resources_registered(self):
         """Test that all expected resources are registered."""
-        resource_uris = set(mcp._resource_manager._resources.keys())
+        resources = await mcp.list_resources()
+        resource_uris = {str(r.uri) for r in resources}
         expected_resources = {
             "qiskit-ibm-transpiler://info",
             "qiskit-ibm-transpiler://synthesis-types",
@@ -51,13 +54,15 @@ def test_resources_registered(self):
             f"Missing resources: {expected_resources - resource_uris}"
         )
 
-    def test_resource_count(self):
+    async def test_resource_count(self):
         """Test the expected number of resources."""
-        assert len(mcp._resource_manager._resources) == 2
+        resources = await mcp.list_resources()
+        assert len(resources) == 2
 
-    def test_prompts_registered(self):
+    async def test_prompts_registered(self):
         """Test that all expected prompts are registered."""
-        prompt_names = set(mcp._prompt_manager._prompts.keys())
+        prompts = await mcp.list_prompts()
+        prompt_names = {p.name for p in prompts}
         expected_prompts = {
             "transpile_circuit",
             "optimize_circuit",
@@ -67,6 +72,7 @@ def test_prompts_registered(self):
             f"Missing prompts: {expected_prompts - prompt_names}"
         )
 
-    def test_prompt_count(self):
+    async def test_prompt_count(self):
         """Test the expected number of prompts."""
-        assert len(mcp._prompt_manager._prompts) == 3
+        prompts = await mcp.list_prompts()
+        assert len(prompts) == 3

qiskit-mcp-server/pyproject.toml

@@ -5,7 +5,7 @@ description = "MCP server for Qiskit quantum computing capabilities with circuit
 readme = "README.md"
 requires-python = ">=3.10,<3.15"
 dependencies = [
-    "fastmcp>=2.8.1,<3",
+    "fastmcp>=3.2.0,<4",
     "qiskit>=1.3.0",
     "qiskit-qasm3-import>=0.5.0",
     "pydantic>=2.0.0",