Release 0.5.4 — fastmcp 4.0.0

[CoderDayton]

fastmcp 4.0.0 was published and fastmcp>=3.2 admitted it at the next uvx start, so the server stopped importing: 4.0.0 removed fastmcp.tools.tool, whose ToolResult the tool layer imports. The dependency is now fastmcp>=4.0.0,<5.

Breaking changes that touched this codebase

Change	Impact
fastmcp.tools.tool removed	Hard crash. 2 import sites.
Context.list_roots() removed	Feature loss — recovered via the raw session, see below.
MCP SDK v2 camelCase → snake_case	ImageContent(mime_type=); tests moved to output_schema / input_schema / mime_type.

Not hit: httpx→httpx2, pydantic>=2.12 floor, ctx.sample, as_proxy, import_server, serializer=, exclude_args=, the wider middleware traffic (only on_call_tool is used, unchanged).

Relative paths are not a regression

Context.list_roots() is gone because the sessionless 2026-07-28 era has no back-channel — but the capability survives on handshake-era connections through the raw session, so roots/list is asked there. A client that advertises roots is answered exactly as under 3.x. Verified end-to-end against a real server subprocess launched with cwd=/, so the cwd fallback could not fake the pass:

advertised root -> /tmp/rootsprobe-aqwuakwk
  <- server asked roots/list
read('marker.txt') -> {"path": "/tmp/rootsprobe-aqwuakwk/marker.txt", "content": "resolved-via-client-root\n"}

Also

serverInfo.version had always reported fastmcp's version (3.4.2, then 4.0.0) because FastMCP() was constructed without version=. It now reports 0.5.4. This is visible to clients — anything keying off that field sees the version go backwards once.

Verification

uv run pytest -q                      → 4923 passed, 6 skipped, 0 warnings
uv run mypy src/                      → Success: no issues found in 41 source files
uv run ruff check src/ tests/         → All checks passed!
uv run ruff format --check src/ tests/→ 90 files already formatted
uv run bandit -q -c pyproject.toml -r src/ → rc=0
stdio initialize + tools/list         → 13 tools, version 0.5.4

No tool name, parameter, or return shape changed. No new dependencies. ImageContent still serializes mimeType on the wire.

New: tests/test_client_root.py (9 tests) covering root resolution, non-file:// roots, missing back-channel, missing session, and once-only caching.