---
title: "FastMCP Connector"
url: "https://docs.caracal.run/sdks/connectors/fastmcp/"
markdown_url: "https://docs.caracal.run/markdown/sdks/connectors/fastmcp.md"
description: "FastMCP token verifiers for TypeScript and Python servers."
page_type: "page"
concepts: []
requires: []
---

# FastMCP Connector

Canonical URL: https://docs.caracal.run/sdks/connectors/fastmcp/
Markdown URL: https://docs.caracal.run/markdown/sdks/connectors/fastmcp.md
Description: FastMCP token verifiers for TypeScript and Python servers.
Page type: page
Concepts: none
Requires: none

---

FastMCP connectors expose small verifier APIs that delegate to the MCP transport packages. Use them when your FastMCP integration needs to authenticate a bearer token before running a tool.

## Install

| Ecosystem | Package |
| --- | --- |
| TypeScript | `npm install @caracalai/mcp-fastmcp @caracalai/transport-mcp @caracalai/revocation` |
| Python | `pip install caracalai-mcp-fastmcp` |

## TypeScript verifier

```ts
import { extractBearer, verifyFastMcpToken } from "@caracalai/mcp-fastmcp";
import { createMandateVerifier } from "@caracalai/transport-mcp";
import { InMemoryRevocationStore } from "@caracalai/revocation";

const verifier = createMandateVerifier({
  issuer: "https://sts.example.com",
  audience: "https://mcp.example.com",
  zoneId: "zone_prod",
  revocations: new InMemoryRevocationStore(),
});

const token = extractBearer(request.headers.get("authorization") ?? "");
if (!token) throw new Error("missing bearer token");

const context = await verifyFastMcpToken(token, verifier, {
  requiredScopes: ["mcp:tool:call"],
  requiredTargets: ["https://mcp.example.com"],
  requireAgent: true,
});

console.log(context.sub, context.zoneId, context.scope);
```

`verifyFastMcpToken()` returns `{ sub, zoneId, scope }` or throws `FastMcpAuthError`.

## Python verifier

```python
from caracalai_mcp_fastmcp import CaracalAuth, CaracalAuthError

auth = CaracalAuth(
    issuer="https://sts.example.com",
    audience="https://mcp.example.com",
    zone_id="zone_prod",
    required_scopes=["mcp:tool:call"],
    required_targets=["https://mcp.example.com"],
    require_agent=True,
    revocations=revocations,
)

try:
    context = await auth.verify_token(token)
except CaracalAuthError as exc:
    raise RuntimeError(exc.code) from exc
```

## Boundary

The connector verifies tokens; it does not create agent sessions or delegation edges. Use the [Python SDK](/sdks/python/) or [TypeScript SDK](/sdks/typescript/) to create Caracal context before making outbound calls.

## Related pages

- [Protect a FastMCP App](/guides/protect-fastmcp/)
- [MCP Auth Transport](/sdks/transport-mcp/)
- [Sessions and Revocation](/concepts/sessions-revocation/)