AuthlibDeprecationWarning from fastmcp dependency

AuthlibDeprecationWarning from fastmcp dependency

Environment

• Kimi CLI version: 1.37.0
• Python version: 3.13
• OS: Linux
• Installation method: uv tool install kimi-cli

Problem

When running Kimi CLI, the following deprecation warning appears on every invocation:

/home/nenglab/.local/share/uv/tools/kimi-cli/lib/python3.13/site-packages/fastmcp/server/auth/providers/jwt.py:10: AuthlibDeprecationWarning: authlib.jose module is deprecated, please use joserfc instead.
It will be compatible before version 2.0.0.
  from authlib.jose import JsonWebKey, JsonWebToken

Root Cause

The warning originates from fastmcp (a dependency of kimi-cli), which still imports from the deprecated authlib.jose module. This affects:

• fastmcp versions tested: 2.12.5, 2.14.7, and 3.2.4 (latest)
• All versions still use from authlib.jose import JsonWebKey, JsonWebToken

Impact

• Cosmetic issue: warning clutters terminal output
• No functional breakage yet, but authlib has announced removal before v2.0.0

Possible Solutions

1. Short-term: Suppress the warning in kimi-cli startup by setting PYTHONWARNINGS=ignore::AuthlibDeprecationWarning
2. Medium-term: Pin or patch fastmcp to migrate from authlib.jose to joserfc
3. Long-term: Wait for upstream fastmcp to fix (issue should also be reported to github.com/jlowin/fastmcp)

Steps to Reproduce

1. Install kimi-cli via uv: uv tool install kimi-cli
2. Run any kimi command: kimi --version or start an interactive session
3. Warning appears immediately during module import

Related

• authlib upgrade guide: https://docs.authlib.org/en/v1.7.0/upgrades/jose.html
• fastmcp repository: https://github.com/jlowin/fastmcp

Reproduce the warning with uv tool install kimi-cli and kimi --version, then inspect the dependency metadata and the fastmcp JWT provider mentioned in the traceback. Determine whether an upstream fix is available; done means the warning no longer appears during normal Kimi CLI invocation without hiding unrelated warnings.