@agent-native/core 0.104.0 → 0.106.0

package/corpus/core/src/mcp-client/oauth-routes.ts

@@ -0,0 +1,307 @@
+import crypto from "node:crypto";
+
+import type { OAuthClientInformationMixed } from "@modelcontextprotocol/sdk/shared/auth.js";
+import {
+  deleteCookie,
+  defineEventHandler,
+  getCookie,
+  getMethod,
+  getQuery,
+  setCookie,
+  setResponseStatus,
+  type H3Event,
+} from "h3";
+
+import { getOrgContext } from "../org/context.js";
+import { decryptSecretValue, encryptSecretValue } from "../secrets/crypto.js";
+import { getSession, safeReturnPath } from "../server/auth.js";
+import { getH3App } from "../server/framework-request-handler.js";
+import { getAppUrl, resolveOAuthRedirectUri } from "../server/google-oauth.js";
+import { runWithRequestContext } from "../server/request-context.js";
+import {
+  finishMcpOAuthAuthorization,
+  startMcpOAuthAuthorization,
+  type McpOAuthDiscoveryState,
+} from "./oauth-client.js";
+import {
+  addOAuthRemoteServer,
+  normalizeServerName,
+  validateRemoteUrl,
+  type RemoteMcpScope,
+} from "./remote-store.js";
+
+const FLOW_COOKIE = "an_mcp_oauth_flow";
+const FLOW_TTL_SECONDS = 10 * 60;
+
+export interface McpOAuthFlow {
+  name: string;
+  url: string;
+  description?: string;
+  scope: RemoteMcpScope;
+  scopeId: string;
+  owner: string;
+  orgId?: string;
+  redirectUri: string;
+  state: string;
+  codeVerifier: string;
+  clientInformation: OAuthClientInformationMixed;
+  discoveryState?: McpOAuthDiscoveryState;
+  returnUrl?: string;
+  expiresAt: number;
+}
+
+export interface McpOAuthRoutesOptions {
+  reconfigure: () => Promise<void>;
+}
+
+export function mountMcpOAuthRoutes(
+  nitroApp: any,
+  options: McpOAuthRoutesOptions,
+): void {
+  const mountedApps: WeakSet<object> = ((
+    globalThis as any
+  ).__agentNativeMcpOAuthMountedApps ??= new WeakSet<object>());
+  if (mountedApps.has(nitroApp)) return;
+  mountedApps.add(nitroApp);
+
+  getH3App(nitroApp).use(
+    "/_agent-native/mcp/servers/oauth",
+    defineEventHandler(async (event: H3Event) => {
+      const method = getMethod(event);
+      const pathname = (event.url?.pathname || "")
+        .replace(/^\/+/, "")
+        .replace(/\/+$/, "");
+      const parts = pathname ? pathname.split("/") : [];
+      if (method !== "GET") {
+        setResponseStatus(event, 405);
+        return { error: "Method not allowed" };
+      }
+      if (parts.length === 1 && parts[0] === "start") {
+        return handleMcpOAuthStart(event);
+      }
+      if (parts.length === 1 && parts[0] === "callback") {
+        return handleMcpOAuthCallback(event, options);
+      }
+      setResponseStatus(event, 404);
+      return { error: "Not found" };
+    }),
+  );
+}
+
+async function handleMcpOAuthStart(
+  event: H3Event,
+): Promise<Response | Record<string, unknown>> {
+  const session = await getSession(event).catch(() => null);
+  if (!session?.email) return unauthorized(event);
+
+  const query = getQuery(event);
+  const rawUrl = text(query.url);
+  const rawName = text(query.name);
+  const returnUrl = text(query.return);
+  if (!rawUrl || !rawName) {
+    setResponseStatus(event, 400);
+    return { error: "MCP OAuth requires a server name and URL." };
+  }
+  const urlCheck = validateRemoteUrl(rawUrl);
+  if (!urlCheck.ok) {
+    setResponseStatus(event, 400);
+    return { error: urlCheck.error ?? "MCP server URL is not allowed." };
+  }
+  const name = normalizeServerName(rawName);
+  if (!name) {
+    setResponseStatus(event, 400);
+    return { error: "MCP server name is invalid." };
+  }
+
+  const requestedScope = query.scope === "org" ? "org" : "user";
+  const requestedOrgId = text(query.orgId);
+  const org =
+    requestedScope === "org"
+      ? await getOrgContext(event).catch(() => null)
+      : null;
+  const scope: RemoteMcpScope = requestedScope;
+  const scopeId = scope === "user" ? session.email : (org?.orgId ?? "");
+  if (scope === "org" && requestedOrgId && requestedOrgId !== scopeId) {
+    setResponseStatus(event, 403);
+    return {
+      error: "The selected organization is not the active organization.",
+    };
+  }
+  if (scope === "org" && (!scopeId || !isOrgAdmin(org?.role))) {
+    setResponseStatus(event, scopeId ? 403 : 400);
+    return {
+      error: scopeId
+        ? "Only organization owners and admins can connect an org MCP server."
+        : "Join an organization before connecting an org MCP server.",
+    };
+  }
+
+  const redirectUri = resolveOAuthRedirectUri(
+    event,
+    "/_agent-native/mcp/servers/oauth/callback",
+  );
+  if (!redirectUri) {
+    setResponseStatus(event, 400);
+    return { error: "Invalid MCP OAuth redirect URI." };
+  }
+
+  const state = crypto.randomUUID();
+  const safeReturnUrl = returnUrl ? safeReturnPath(returnUrl) : undefined;
+  try {
+    const started = await runWithRequestContext(
+      { userEmail: session.email, orgId: org?.orgId ?? undefined },
+      () =>
+        startMcpOAuthAuthorization({
+          serverUrl: urlCheck.url!.toString(),
+          redirectUrl: redirectUri,
+          state,
+        }),
+    );
+    const flow: McpOAuthFlow = {
+      name,
+      url: urlCheck.url!.toString(),
+      description: text(query.description),
+      scope,
+      scopeId,
+      owner: session.email,
+      ...(org?.orgId ? { orgId: org.orgId } : {}),
+      redirectUri,
+      state: started.state,
+      codeVerifier: started.codeVerifier,
+      clientInformation: started.clientInformation,
+      ...(started.discoveryState
+        ? { discoveryState: started.discoveryState }
+        : {}),
+      ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),
+      expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
+    };
+    setCookie(event, FLOW_COOKIE, encryptSecretValue(JSON.stringify(flow)), {
+      httpOnly: true,
+      secure: redirectUri.startsWith("https://"),
+      sameSite: "lax",
+      path: "/",
+      maxAge: FLOW_TTL_SECONDS,
+    });
+    return Response.redirect(started.authorizationUrl.href, 302);
+  } catch {
+    setResponseStatus(event, 400);
+    return {
+      error:
+        "This MCP server could not start OAuth. It may not support standard MCP OAuth discovery or dynamic client registration.",
+    };
+  }
+}
+
+async function handleMcpOAuthCallback(
+  event: H3Event,
+  options: McpOAuthRoutesOptions,
+): Promise<Response | Record<string, unknown>> {
+  const session = await getSession(event).catch(() => null);
+  if (!session?.email) return unauthorized(event);
+
+  const query = getQuery(event);
+  const code = text(query.code);
+  const state = text(query.state);
+  const providerError = text(query.error);
+  const flow = readFlow(event);
+  deleteCookie(event, FLOW_COOKIE, { path: "/" });
+  if (providerError || !code || !state) {
+    setResponseStatus(event, 400);
+    return { error: "MCP OAuth authorization was not completed." };
+  }
+  const org =
+    flow?.scope === "org" ? await getOrgContext(event).catch(() => null) : null;
+  if (
+    !flow ||
+    !isValidMcpOAuthFlow(flow, session.email, org?.orgId ?? undefined, state)
+  ) {
+    setResponseStatus(event, 400);
+    return { error: "MCP OAuth state is invalid or expired." };
+  }
+  if (flow.scope === "org" && !isOrgAdmin(org?.role)) {
+    setResponseStatus(event, 403);
+    return {
+      error:
+        "Only organization owners and admins can connect an org MCP server.",
+    };
+  }
+
+  try {
+    const finished = await runWithRequestContext(
+      { userEmail: session.email, orgId: org?.orgId ?? undefined },
+      () =>
+        finishMcpOAuthAuthorization({
+          serverUrl: flow.url,
+          redirectUrl: flow.redirectUri,
+          state: flow.state,
+          clientInformation: flow.clientInformation,
+          codeVerifier: flow.codeVerifier,
+          discoveryState: flow.discoveryState,
+          authorizationCode: code,
+        }),
+    );
+    const result = await addOAuthRemoteServer(flow.scope, flow.scopeId, {
+      name: flow.name,
+      url: flow.url,
+      description: flow.description,
+      credentials: finished.credentials,
+    });
+    if (!result.ok) {
+      setResponseStatus(event, 400);
+      return { error: result.error };
+    }
+    await options.reconfigure();
+    const returnPath =
+      flow.returnUrl ??
+      `/settings/connections?connected=mcp-${encodeURIComponent(flow.name)}`;
+    return Response.redirect(getAppUrl(event, returnPath), 302);
+  } catch {
+    setResponseStatus(event, 400);
+    return { error: "MCP OAuth authorization could not be completed." };
+  }
+}
+
+function readFlow(event: H3Event): McpOAuthFlow | null {
+  const encrypted = getCookie(event, FLOW_COOKIE);
+  if (!encrypted) return null;
+  try {
+    const parsed = JSON.parse(decryptSecretValue(encrypted)) as McpOAuthFlow;
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+export function isValidMcpOAuthFlow(
+  flow: McpOAuthFlow,
+  email: string,
+  orgId: string | undefined,
+  state: string,
+): boolean {
+  const scopeMatches =
+    flow.scope === "user"
+      ? flow.scopeId === email && !flow.orgId
+      : flow.scope === "org" && flow.scopeId === orgId && flow.orgId === orgId;
+  return (
+    flow.expiresAt >= Date.now() &&
+    flow.owner === email &&
+    flow.state === state &&
+    scopeMatches &&
+    typeof flow.scopeId === "string" &&
+    typeof flow.redirectUri === "string" &&
+    flow.redirectUri.includes("/_agent-native/mcp/servers/oauth/callback")
+  );
+}
+
+function isOrgAdmin(role: unknown): boolean {
+  return role === "owner" || role === "admin";
+}
+
+function text(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+
+function unauthorized(event: H3Event) {
+  setResponseStatus(event, 401);
+  return { error: "Authentication required" };
+}

package/corpus/core/src/mcp-client/remote-store.ts

@@ -39,6 +39,15 @@ import {
   deleteUserSetting,
 } from "../settings/user-settings.js";
 import type { McpHttpServerConfig } from "./config.js";
+import {
+  deleteMcpOAuthCredentials,
+  getMcpOAuthAccessToken,
+  saveMcpOAuthCredentials,
+  type McpOAuthCredentialBundle,
+} from "./oauth-client.js";
+import { validateRemoteUrl } from "./remote-url.js";
+
+export { validateRemoteUrl } from "./remote-url.js";
 
 const SETTINGS_KEY = "mcp-servers-remote";
 
@@ -70,6 +79,8 @@ export interface StoredRemoteMcpServer {
    * supplied (or for legacy cleartext rows).
    */
   headerSecretKey?: string;
+  /** Reference to the encrypted OAuth credential bundle for this server. */
+  oauthSecretKey?: string;
   /**
    * Trusted first-party Agent-Native app. Only framework-controlled
    * registrations should set this; management routes intentionally do not
@@ -167,123 +178,6 @@ function sanitiseOrgId(orgId: string): string {
   return orgId.toLowerCase().replace(/[^a-z0-9-]/g, "-");
 }
 
-/**
- * Hostname patterns that are always rejected to prevent SSRF via DNS rebinding
- * or well-known internal service names.
- */
-const BLOCKED_HOSTNAME_PATTERNS: RegExp[] = [
-  /^localhost$/i,
-  /\.localhost$/i,
-  /\.local$/i,
-  /\.internal$/i,
-  // DNS rebind services
-  /\.nip\.io$/i,
-  /\.sslip\.io$/i,
-  /\.xip\.io$/i,
-  /\.localtest\.me$/i,
-  /\.lvh\.me$/i,
-  // Cloud metadata hosts
-  /^metadata\.google\.internal$/i,
-  /^instance-data$/i,
-];
-
-/** Literal IPs that are always rejected (cloud metadata endpoints). */
-const BLOCKED_IPS = new Set([
-  "169.254.169.254", // AWS/GCP/Azure IMDS
-  "100.100.100.200", // Alibaba Cloud metadata
-  "::1",
-]);
-
-/** Parse a dotted-decimal IPv4 string to a 32-bit integer for range checks. */
-function ipv4ToInt(ip: string): number | null {
-  const parts = ip.split(".");
-  if (parts.length !== 4) return null;
-  let n = 0;
-  for (const part of parts) {
-    const byte = parseInt(part, 10);
-    if (isNaN(byte) || byte < 0 || byte > 255) return null;
-    n = (n << 8) | byte;
-  }
-  return n >>> 0;
-}
-
-function isPrivateIpv4(hostname: string): boolean {
-  const n = ipv4ToInt(hostname);
-  if (n === null) return false;
-  // 10.0.0.0/8
-  if ((n & 0xff000000) >>> 0 === 0x0a000000) return true;
-  // 172.16.0.0/12
-  if ((n & 0xfff00000) >>> 0 === 0xac100000) return true;
-  // 192.168.0.0/16
-  if ((n & 0xffff0000) >>> 0 === 0xc0a80000) return true;
-  // 169.254.0.0/16 (link-local, includes AWS/GCP metadata)
-  if ((n & 0xffff0000) >>> 0 === 0xa9fe0000) return true;
-  // 127.0.0.0/8 (loopback)
-  if ((n & 0xff000000) >>> 0 === 0x7f000000) return true;
-  return false;
-}
-
-function isBlockedHostname(hostname: string): boolean {
-  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (BLOCKED_IPS.has(normalized)) return true;
-  if (isPrivateIpv4(normalized)) return true;
-  // IPv6 ULA (fc00::/7) and link-local (fe80::/10)
-  if (normalized === "::1") return true;
-  if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
-  if (normalized.startsWith("fe80")) return true;
-  if (normalized.startsWith("::ffff:")) {
-    const mapped = normalized.slice("::ffff:".length);
-    if (isPrivateIpv4(mapped)) return true;
-    const hexMatch = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(mapped);
-    if (hexMatch) {
-      const value =
-        (parseInt(hexMatch[1], 16) << 16) | parseInt(hexMatch[2], 16);
-      const dotted = [
-        (value >>> 24) & 0xff,
-        (value >>> 16) & 0xff,
-        (value >>> 8) & 0xff,
-        value & 0xff,
-      ].join(".");
-      if (isPrivateIpv4(dotted)) return true;
-    }
-  }
-  for (const pattern of BLOCKED_HOSTNAME_PATTERNS) {
-    if (pattern.test(normalized)) return true;
-  }
-  return false;
-}
-
-/** Reject obviously-wrong URLs. Allows http only for localhost. */
-export function validateRemoteUrl(raw: string): {
-  ok: boolean;
-  url?: URL;
-  error?: string;
-} {
-  let url: URL;
-  try {
-    url = new URL(raw);
-  } catch {
-    return { ok: false, error: "Not a valid URL" };
-  }
-  if (url.protocol === "https:") {
-    if (isBlockedHostname(url.hostname)) {
-      return {
-        ok: false,
-        error: `Host "${url.hostname}" is not allowed (private/internal address)`,
-      };
-    }
-    return { ok: true, url };
-  }
-  if (url.protocol === "http:") {
-    const host = url.hostname;
-    if (host === "localhost" || host === "127.0.0.1") {
-      return { ok: true, url };
-    }
-    return { ok: false, error: "Plain http is only allowed for localhost" };
-  }
-  return { ok: false, error: `Unsupported protocol: ${url.protocol}` };
-}
-
 async function readList(
   scope: RemoteMcpScope,
   scopeId: string,
@@ -340,6 +234,58 @@ export async function addRemoteServer(
   return addRemoteServerInternal(scope, scopeId, input);
 }
 
+/**
+ * Persist a remote MCP server whose authorization is managed by the MCP
+ * server's OAuth 2.1 metadata and token endpoints. OAuth credentials are
+ * stored separately from the settings row and never returned to clients.
+ */
+export async function addOAuthRemoteServer(
+  scope: RemoteMcpScope,
+  scopeId: string,
+  input: {
+    name: string;
+    url: string;
+    description?: string;
+    credentials: McpOAuthCredentialBundle;
+  },
+): Promise<
+  { ok: true; server: StoredRemoteMcpServer } | { ok: false; error: string }
+> {
+  const oauthSecretKey = `mcp_oauth:${shortId()}`;
+  try {
+    await saveMcpOAuthCredentials({
+      key: oauthSecretKey,
+      scope,
+      scopeId,
+      credentials: input.credentials,
+    });
+    const result = await addRemoteServerInternal(scope, scopeId, {
+      name: input.name,
+      url: input.url,
+      description: input.description,
+      oauthSecretKey,
+    });
+    if (!result.ok) {
+      await deleteMcpOAuthCredentials({
+        key: oauthSecretKey,
+        scope,
+        scopeId,
+      });
+    }
+    return result;
+  } catch (err: any) {
+    await deleteMcpOAuthCredentials({
+      key: oauthSecretKey,
+      scope,
+      scopeId,
+    }).catch(() => {});
+    return {
+      ok: false,
+      error: `Failed to save MCP OAuth credentials: ${err?.message ?? err}`,
+    };
+  }
+}
+
 export async function addFirstPartyRemoteServer(
   orgId: string,
   input: {
@@ -376,6 +322,7 @@ async function addRemoteServerInternal(
     description?: string;
     firstParty?: boolean;
     firstPartyAppId?: string;
+    oauthSecretKey?: string;
   },
 ): Promise<
   { ok: true; server: StoredRemoteMcpServer } | { ok: false; error: string }
@@ -427,6 +374,7 @@ async function addRemoteServerInternal(
     ...(input.firstPartyAppId
       ? { firstPartyAppId: input.firstPartyAppId }
       : {}),
+    ...(input.oauthSecretKey ? { oauthSecretKey: input.oauthSecretKey } : {}),
     description: input.description?.trim() || undefined,
     createdAt: Date.now(),
   };
@@ -546,6 +494,20 @@ export async function removeRemoteServer(
       );
     }
   }
+  if (removed?.oauthSecretKey) {
+    try {
+      await deleteMcpOAuthCredentials({
+        key: removed.oauthSecretKey,
+        scope,
+        scopeId,
+      });
+    } catch (err: any) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[mcp-client] Failed to delete MCP OAuth credentials ${removed.oauthSecretKey}: ${err?.message ?? err}`,
+      );
+    }
+  }
   return true;
 }
 
@@ -628,10 +590,23 @@ export async function toHttpServerConfigAsync(
   scopeId: string,
   stored: StoredRemoteMcpServer,
 ): Promise<McpHttpServerConfig> {
+  let headers = await materializeHeaders(scope, scopeId, stored);
+  if (stored.oauthSecretKey) {
+    const accessToken = await getMcpOAuthAccessToken({
+      key: stored.oauthSecretKey,
+      scope,
+      scopeId,
+      serverUrl: stored.url,
+    });
+    if (accessToken) {
+      headers ??= {};
+      headers.Authorization = `Bearer ${accessToken}`;
+    }
+  }
   return {
     type: "http",
     url: stored.url,
-    headers: await materializeHeaders(scope, scopeId, stored),
+    headers,
     ...(stored.firstParty ? { firstParty: true } : {}),
     ...(stored.firstPartyAppId
       ? { firstPartyAppId: stored.firstPartyAppId }

package/corpus/core/src/mcp-client/remote-url.ts

@@ -0,0 +1,97 @@
+/** URL validation shared by remote MCP storage and OAuth discovery. */
+
+const BLOCKED_HOSTNAME_PATTERNS: RegExp[] = [
+  /^localhost$/i,
+  /\.localhost$/i,
+  /\.local$/i,
+  /\.internal$/i,
+  /\.nip\.io$/i,
+  /\.sslip\.io$/i,
+  /\.xip\.io$/i,
+  /\.localtest\.me$/i,
+  /\.lvh\.me$/i,
+  /^metadata\.google\.internal$/i,
+  /^instance-data$/i,
+];
+
+const BLOCKED_IPS = new Set(["169.254.169.254", "100.100.100.200", "::1"]);
+
+function ipv4ToInt(ip: string): number | null {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let n = 0;
+  for (const part of parts) {
+    const byte = parseInt(part, 10);
+    if (isNaN(byte) || byte < 0 || byte > 255) return null;
+    n = (n << 8) | byte;
+  }
+  return n >>> 0;
+}
+
+function isPrivateIpv4(hostname: string): boolean {
+  const n = ipv4ToInt(hostname);
+  if (n === null) return false;
+  if ((n & 0xff000000) >>> 0 === 0x0a000000) return true;
+  if ((n & 0xfff00000) >>> 0 === 0xac100000) return true;
+  if ((n & 0xffff0000) >>> 0 === 0xc0a80000) return true;
+  if ((n & 0xffff0000) >>> 0 === 0xa9fe0000) return true;
+  if ((n & 0xff000000) >>> 0 === 0x7f000000) return true;
+  return false;
+}
+
+function isBlockedHostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (BLOCKED_IPS.has(normalized)) return true;
+  if (isPrivateIpv4(normalized)) return true;
+  if (normalized === "::1") return true;
+  if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
+  if (normalized.startsWith("fe80")) return true;
+  if (normalized.startsWith("::ffff:")) {
+    const mapped = normalized.slice("::ffff:".length);
+    if (isPrivateIpv4(mapped)) return true;
+    const hexMatch = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(mapped);
+    if (hexMatch) {
+      const value =
+        (parseInt(hexMatch[1], 16) << 16) | parseInt(hexMatch[2], 16);
+      const dotted = [
+        (value >>> 24) & 0xff,
+        (value >>> 16) & 0xff,
+        (value >>> 8) & 0xff,
+        value & 0xff,
+      ].join(".");
+      if (isPrivateIpv4(dotted)) return true;
+    }
+  }
+  return BLOCKED_HOSTNAME_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+
+/** Reject public-resource URLs that could target an internal network. */
+export function validateRemoteUrl(raw: string): {
+  ok: boolean;
+  url?: URL;
+  error?: string;
+} {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return { ok: false, error: "Not a valid URL" };
+  }
+  if (url.protocol === "https:") {
+    if (isBlockedHostname(url.hostname)) {
+      return {
+        ok: false,
+        error: `Host "${url.hostname}" is not allowed (private/internal address)`,
+      };
+    }
+    return { ok: true, url };
+  }
+  if (url.protocol === "http:") {
+    const host = url.hostname;
+    if (host === "localhost" || host === "127.0.0.1") {
+      return { ok: true, url };
+    }
+    return { ok: false, error: "Plain http is only allowed for localhost" };
+  }
+  return { ok: false, error: `Unsupported protocol: ${url.protocol}` };
+}

package/corpus/core/src/mcp-client/routes.ts

@@ -60,6 +60,7 @@ import {
   type McpClientManager,
   type McpTool,
 } from "./manager.js";
+import { mountMcpOAuthRoutes } from "./oauth-routes.js";
 import {
   addRemoteServer,
   listRemoteServers,
@@ -97,6 +98,11 @@ function projectForClient(
     name: stored.name,
     url: stored.url,
     headers: redactHeaders(stored.headers),
+    authMode: stored.oauthSecretKey
+      ? "oauth"
+      : stored.headerSecretKey || stored.headers
+        ? "headers"
+        : "none",
     description: stored.description,
     firstParty: stored.firstParty === true,
     createdAt: stored.createdAt,
@@ -111,6 +117,7 @@ export interface ClientServer {
   name: string;
   url: string;
   headers?: Record<string, { set: true }>;
+  authMode: "none" | "headers" | "oauth";
   description?: string;
   firstParty?: boolean;
   createdAt: number;
@@ -367,6 +374,10 @@ export function mountMcpServersRoutes(
   if (mountedApps.has(nitroApp)) return;
   mountedApps.add(nitroApp);
 
+  mountMcpOAuthRoutes(nitroApp, {
+    reconfigure: () => reconfigureManager(manager),
+  });
+
   try {
     getH3App(nitroApp).use(
       "/_agent-native/mcp/servers",