---
type: "post"
id: "fastmcp-4-1-1-bounds-regex-tool-search-c332f6"
slug: "fastmcp-4-1-1-bounds-regex-tool-search-c332f6"
title: "FastMCP 4.1.1 bounds regex tool search to 1,000-character patterns and about one second of runtime"
description: "FastMCP released v4.1.1 on October 18. The release adds bounds to its regex-based tool search patterns longer than 1 000 characters are rejected and a search stops after about one second. The feature lets clients find tools by pattern rather"
retrieval_nugget: "FastMCP released v4.1.1 on October 18. The release adds bounds to its regex-based tool search patterns longer than 1 000 characters are rejected and a search stops after about one second. The feature lets clients find tools by pattern rather"
published_at: "2026-10-23"
updated_at: "2026-10-23"
record_date: "2026-10-23"
date_kind: "published_at"
topics: ["agent-security","sandbox"]
entities: ["FastMCP","PrefectHQ","SkillsDirectoryProvider"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","agent-protocols-become-interoperability-layer"]
novelty_label: "new_fact"
what_changed: "FastMCP 4.1.1 adds security bounds to regex tool search: patterns are capped at 1,000 characters and execution at about one second."
prior_refs: ["memory:4fe2b1b2-b257-83a7-a108-b7bcc747c607"]
source_url: "https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.1"
source_urls: ["https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.1"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:fastmcp-4-1-1-bounds-regex-tool-search-c332f6"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/fastmcp-4-1-1-bounds-regex-tool-search-c332f6/","markdown":"https://newruntime.com/posts/fastmcp-4-1-1-bounds-regex-tool-search-c332f6.md","json":"https://newruntime.com/posts/fastmcp-4-1-1-bounds-regex-tool-search-c332f6.json"}
---

# FastMCP 4.1.1 bounds regex tool search to 1,000-character patterns and about one second of runtime

## Retrieval answer

FastMCP released v4.1.1 on October 18. The release adds bounds to its regex-based tool search patterns longer than 1 000 characters are rejected and a search stops after about one second. The feature lets clients find tools by pattern rather

FastMCP released v4.1.1 on October 18. The release adds bounds to its regex-based tool search: patterns longer than 1,000 characters are rejected, and a search stops after about one second. The feature lets clients find tools by pattern rather than listing every available tool.

The release also restores discovery of skill folders represented by links, including links to folders outside the skills root. FastMCP says that files belonging to a skill must still resolve inside the folder targeted by that link. Other fixes cover an unparsable proxy setting during update checks and the JWKS refresh lock.

FastMCP recommends that all 4.x users upgrade. The release notes do not identify a CVE, describe a demonstrated exploit, or provide measurements of the limits' security effect. Source: https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.1

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- topic hub: [Sandbox](https://newruntime.com/topics/sandbox.md): Explore the sandbox topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)