Repository navigation
Fix gimp_mcp_server import crash on mcp >= 1.13 (#45) - #46
Conversation
FastMCP stopped accepting arbitrary **settings kwargs in mcp 1.13.0, so description= -- which older releases silently swallowed and ignored -- now raises TypeError while gimp_mcp_server is being imported, taking the whole server down before it can serve a single tool. instructions= is the supported field for this text and works on every release from 1.10.1 through 1.29.1. Dependency metadata was unbounded, which left two ways to end up broken: - mcp>=1.28.1 clears CVE-2025-66416, CVE-2026-52869 and CVE-2026-59950 - mcp<2 because 2.x renames FastMCP to MCPServer and drops mcp.server.fastmcp altogether - fastmcp is dropped because nothing imports it; the code uses mcp.server.fastmcp, which ships inside mcp uv.lock is refreshed to match. The previous lock pinned pydantic-core 2.33.2, which publishes no cp314 wheel and fails its Rust build on Python 3.14, so uv sync could only succeed on 3.13 or older.
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
MCP API and dependency update gimp_mcp_server.py, pyproject.toml |
The FastMCP constructor now uses instructions. The project replaces separate mcp and fastmcp dependencies with mcp>=1.28.1,<2. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix · Severity of issue fixed: Medium
Merge Risk: 
340ab
-
No actionable merge-blocking risk was identified in the dependency or MCP API update.
Architecture risk: 
340ab
-
The change affects 2 systems.
Changed systems:
gimp_mcp_server.py,pyproject.tomlArchitecture concerns
No architecture-level concerns identified.Review details
-
Systems and components
- observed — gimp_mcp_server.py (service) was modified; 1 changed file maps to changed impact.
- observed — pyproject.toml (service) was modified; 1 changed file maps to changed impact.
Before / after behavior
- observed — Modified behavior in gimp_mcp_server.py:
FastMCPnow receives the integration text throughinstructionsinstead ofdescription. - observed — Modified behavior in pyproject.toml: The dependency list replaces
mcpandfastmcpwithmcpconstrained to versions>=1.28.1and<2.
-
Pre-merge checks: 
-
Check name Status Explanation Resolution Linked Issues check The changed source and pyproject.tomlimplement theinstructions=change, themcp>=1.28.1,<2bound, and removal of the unusedfastmcpdependency required by#45. The PR description reports a r…Provide reviewable evidence that the committed dependency lock resolves successfully on Python 3.14 and permits import gimp_mcp_server.-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly identifies the main change: fixing the gimp_mcp_server import crash caused by MCP version compatibility. It is concise and related to the changeset. Out of Scope Changes check The reviewed source and dependency changes address the client-side import failure described in #45. The dependency cleanup and lock refresh support that fix. No unrelated change is shown, and the in-G…Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Full details: Out of Scope Changes check
-
Explanation
The reviewed source and dependency changes address the client-side import failure described in
#45. The dependency cleanup and lock refresh support that fix. No unrelated change is shown, and the in-GIMP socket plugin is not changed.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)
-
Full details: Linked Issues check
-
Explanation
The changed source and
pyproject.tomlimplement theinstructions=change, themcp>=1.28.1,<2bound, and removal of the unusedfastmcpdependency required by#45. The PR description reports a refresheduv.lockand successful Python 3.14 import testing. However,uv.lockis excluded from review, so the lock refresh and the resulting Python 3.14 dependency resolution cannot be independently established.Resolution
Provide reviewable evidence that the committed dependency lock resolves successfully on Python 3.14 and permits
import gimp_mcp_server.
-
Finishing Touches
-
Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Fixes #45.
Summary
gimp_mcp_server.pycurrently cannot be imported on anymcprelease that a fresh resolve produces, so the MCP server process exits before serving a single tool. This fixes that and closes the two ways a user ends up broken today.The in-GIMP socket plugin is not involved here - it works fine. This is purely the client-side server process.
Root cause
FastMCP.__init__used to end with**settings: Any, which silently absorbed unknown keywords, sodescription=never actually applied - it was a no-op from the day it was added. That catch-all was removed in mcp 1.13.0, turning the same call into a hardTypeErrorat import time.Measured per release, calling
FastMCP('x', description='d')againstFastMCP('x', instructions='i'):description=instructions=mcp.server.fastmcpremovedSeparately, the committed lock pinned
pydantic-core 2.33.2, which has no cp314 wheel, souv synccould only succeed on Python 3.13 or older. Between the two, keeping the old lock broke 3.14 and refreshing it broke every Python.Changes
instructions=instead ofdescription=. This is the supported field for this text and is compatible from 1.10.1 through 1.29.1, so it does not force anyone to upgrade. Worth flagging that it is not a pure rename:description=was discarded entirely, whereasinstructionsis actually sent to clients, so the string becomes visible in client handshakes for the first time. That seems to be the intent of the original line, but happy to drop the argument instead if you would rather not surface it.mcp>=1.28.1,<2. The floor clears CVE-2025-66416, CVE-2026-52869 and CVE-2026-59950; the ceiling keeps this v1-API code off the 2.xFastMCP->MCPServerrename, which the SDK's own error message recommends pinning against.fastmcp. Nothing imports it. The only usage isfrom mcp.server.fastmcp import ..., which is a submodule ofmcpitself. Removing it also dropsauthliband friends from the lock, taking it from 86 packages to 41.uv.lockto match, which brings inpydantic-core 2.46.5and its 3.14 wheels.Test plan
uv syncandimport gimp_mcp_serververified on Python 3.11, 3.12, 3.13 and 3.14 (3.14 previously failed at thepydantic-corebuild)run_tests.pyagainst live GIMP 3.2.4 on macOS: 59/59 PASSEDruff checkclean at the version CI pins (0.15.11);pre-commit run --all-filespassesopen_image,auto_levels,adjust_curves,adjust_hue_saturation,sharpen,get_state_snapshotwith region zoom,new_canvas,get_histogramPrepared with AI assistance; every result above was executed and verified against a real GIMP 3.2.4 install rather than inferred.
Summary by CodeRabbit
Bug Fixes
Chores