@ai-sdk/mcp 0.0.38 → 0.0.40

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @ai-sdk/mcp
 
+## 0.0.40
+
+### Patch Changes
+
+- c87913e: fix(mcp): allow MCP tools to execute without options
+
+## 0.0.39
+
+### Patch Changes
+
+- 2b1c2df: fix(mcp): reject private OAuth endpoints before sending credentials
+- 2b1c2df: Keep default Node.js downloads protected by DNS validation and connection pinning when frameworks or instrumentation wrap global fetch before or after the SDK loads.
+- 2b1c2df: fix(mcp): prevent SSRF in OAuth metadata discovery
+- Updated dependencies [2b1c2df]
+- Updated dependencies [2b1c2df]
+- Updated dependencies [2b1c2df]
+  - @ai-sdk/provider-utils@3.0.41
+
 ## 0.0.38
 
 ### Patch Changes

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { z } from 'zod/v4';
-import { FetchFunction, FlexibleSchema, Tool } from '@ai-sdk/provider-utils';
+import { FetchFunction, FlexibleSchema, Tool, ToolCallOptions } from '@ai-sdk/provider-utils';
 import { JSONObject } from '@ai-sdk/provider';
 
 declare const JSONRPCRequestSchema: z.ZodObject<{
@@ -245,12 +245,16 @@ type MCPTransportConfig = {
 type ToolSchemas = Record<string, {
     inputSchema: FlexibleSchema<JSONObject | unknown>;
 }> | 'automatic' | undefined;
+/** Base MCP tool type with execute */
+type McpToolBase<INPUT = unknown, OUTPUT = CallToolResult> = Tool<INPUT, OUTPUT> & {
+    execute: (input: INPUT, options?: ToolCallOptions) => ReturnType<NonNullable<Tool<INPUT, OUTPUT>['execute']>>;
+};
 type McpToolSet<TOOL_SCHEMAS extends ToolSchemas = 'automatic'> = TOOL_SCHEMAS extends Record<string, {
     inputSchema: FlexibleSchema<any>;
 }> ? {
     [K in keyof TOOL_SCHEMAS]: TOOL_SCHEMAS[K] extends {
         inputSchema: FlexibleSchema<infer INPUT>;
-    } ? Tool<INPUT, CallToolResult> & Required<Pick<Tool<INPUT, CallToolResult>, 'execute'>> : never;
+    } ? McpToolBase<INPUT, CallToolResult> : never;
 } : McpToolSet<Record<string, {
     inputSchema: FlexibleSchema<unknown>;
 }>>;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod/v4';
-import { FetchFunction, FlexibleSchema, Tool } from '@ai-sdk/provider-utils';
+import { FetchFunction, FlexibleSchema, Tool, ToolCallOptions } from '@ai-sdk/provider-utils';
 import { JSONObject } from '@ai-sdk/provider';
 
 declare const JSONRPCRequestSchema: z.ZodObject<{
@@ -245,12 +245,16 @@ type MCPTransportConfig = {
 type ToolSchemas = Record<string, {
     inputSchema: FlexibleSchema<JSONObject | unknown>;
 }> | 'automatic' | undefined;
+/** Base MCP tool type with execute */
+type McpToolBase<INPUT = unknown, OUTPUT = CallToolResult> = Tool<INPUT, OUTPUT> & {
+    execute: (input: INPUT, options?: ToolCallOptions) => ReturnType<NonNullable<Tool<INPUT, OUTPUT>['execute']>>;
+};
 type McpToolSet<TOOL_SCHEMAS extends ToolSchemas = 'automatic'> = TOOL_SCHEMAS extends Record<string, {
     inputSchema: FlexibleSchema<any>;
 }> ? {
     [K in keyof TOOL_SCHEMAS]: TOOL_SCHEMAS[K] extends {
         inputSchema: FlexibleSchema<infer INPUT>;
-    } ? Tool<INPUT, CallToolResult> & Required<Pick<Tool<INPUT, CallToolResult>, 'execute'>> : never;
+    } ? McpToolBase<INPUT, CallToolResult> : never;
 } : McpToolSet<Record<string, {
     inputSchema: FlexibleSchema<unknown>;
 }>>;

package/dist/index.js

@@ -503,13 +503,48 @@ function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
   }
   return options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
 }
-async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
+function isOAuthLoopbackHost(hostname) {
+  const normalized = hostname.toLowerCase().replace(/\.+$/, "");
+  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "127.0.0.1" || normalized === "[::1]" || normalized === "::1";
+}
+function assertSafeOAuthEndpoint(endpointUrl, { allowLoopback = false } = {}) {
+  if (allowLoopback && (endpointUrl.protocol === "http:" || endpointUrl.protocol === "https:") && isOAuthLoopbackHost(endpointUrl.hostname)) {
+    return;
+  }
+  try {
+    (0, import_provider_utils2.validateDownloadUrl)(endpointUrl.href);
+  } catch (error) {
+    throw new MCPClientOAuthError({
+      message: `OAuth endpoint URL is not allowed: ${endpointUrl.href}`,
+      cause: error
+    });
+  }
+}
+function getTrustedLoopbackOrigin(authorizationServerUrl) {
+  const url = new URL(authorizationServerUrl);
+  return isOAuthLoopbackHost(url.hostname) ? url.origin : void 0;
+}
+async function fetchWithCorsRetry(url, headers, fetchFn = fetch, trustedOrigin) {
   try {
-    return await fetchFn(url, { headers });
+    return await (0, import_provider_utils2.fetchWithValidatedRedirects)({
+      url: url.href,
+      fetch: async (input, init) => (0, import_provider_utils2.fetchWithValidatedEndpoint)({
+        url: input,
+        init: {
+          ...init,
+          headers: new Headers(init == null ? void 0 : init.headers).has("MCP-Protocol-Version") ? headers : void 0
+        },
+        fetch: fetchFn,
+        trustedOrigin,
+        redirect: "manual"
+      }),
+      headers,
+      trustedOrigin
+    });
   } catch (error) {
     if (error instanceof TypeError) {
       if (headers) {
-        return fetchWithCorsRetry(url, void 0, fetchFn);
+        return fetchWithCorsRetry(url, void 0, fetchFn, trustedOrigin);
       } else {
         return void 0;
       }
@@ -517,11 +552,11 @@ async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
     throw error;
   }
 }
-async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
+async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch, trustedOrigin) {
   const headers = {
     "MCP-Protocol-Version": protocolVersion
   };
-  return await fetchWithCorsRetry(url, headers, fetchFn);
+  return await fetchWithCorsRetry(url, headers, fetchFn, trustedOrigin);
 }
 function shouldAttemptFallback(response, pathname) {
   return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
@@ -538,10 +573,20 @@ async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, o
     url = new URL(wellKnownPath, (_b3 = opts == null ? void 0 : opts.metadataServerUrl) != null ? _b3 : issuer);
     url.search = issuer.search;
   }
-  let response = await tryMetadataDiscovery(url, protocolVersion, fetchFn);
+  let response = await tryMetadataDiscovery(
+    url,
+    protocolVersion,
+    fetchFn,
+    opts == null ? void 0 : opts.trustedOrigin
+  );
   if (!(opts == null ? void 0 : opts.metadataUrl) && shouldAttemptFallback(response, issuer.pathname)) {
     const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
-    response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
+    response = await tryMetadataDiscovery(
+      rootUrl,
+      protocolVersion,
+      fetchFn,
+      opts == null ? void 0 : opts.trustedOrigin
+    );
   }
   return response;
 }
@@ -552,7 +597,10 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
     fetchFn,
     {
       protocolVersion: opts == null ? void 0 : opts.protocolVersion,
-      metadataUrl: opts == null ? void 0 : opts.resourceMetadataUrl
+      metadataUrl: opts == null ? void 0 : opts.resourceMetadataUrl,
+      // The configured MCP server is trusted as a request target. Redirects
+      // crossing its origin are still validated before they are followed.
+      trustedOrigin: new URL(serverUrl).origin
     }
   );
   if (!response || response.status === 404) {
@@ -609,13 +657,19 @@ function buildDiscoveryUrls(authorizationServerUrl) {
 }
 async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
   fetchFn = fetch,
-  protocolVersion = LATEST_PROTOCOL_VERSION
+  protocolVersion = LATEST_PROTOCOL_VERSION,
+  trustedOrigin
 } = {}) {
   var _a3;
   const headers = { "MCP-Protocol-Version": protocolVersion };
   const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
   for (const { url: endpointUrl, type } of urlsToTry) {
-    const response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
+    const response = await fetchWithCorsRetry(
+      endpointUrl,
+      headers,
+      fetchFn,
+      trustedOrigin
+    );
     if (!response) {
       continue;
     }
@@ -775,6 +829,10 @@ async function exchangeAuthorization(authorizationServerUrl, {
   var _a3;
   const grantType = "authorization_code";
   const tokenUrl = (metadata == null ? void 0 : metadata.token_endpoint) ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl);
+  const trustedOrigin = getTrustedLoopbackOrigin(authorizationServerUrl);
+  assertSafeOAuthEndpoint(tokenUrl, {
+    allowLoopback: tokenUrl.origin === trustedOrigin
+  });
   if ((metadata == null ? void 0 : metadata.grant_types_supported) && !metadata.grant_types_supported.includes(grantType)) {
     throw new Error(
       `Incompatible auth server: does not support grant type ${grantType}`
@@ -803,10 +861,15 @@ async function exchangeAuthorization(authorizationServerUrl, {
   if (resource) {
     params.set("resource", resource.href);
   }
-  const response = await (fetchFn != null ? fetchFn : fetch)(tokenUrl, {
-    method: "POST",
-    headers,
-    body: params
+  const response = await (0, import_provider_utils2.fetchWithValidatedEndpoint)({
+    url: tokenUrl,
+    init: {
+      method: "POST",
+      headers,
+      body: params
+    },
+    fetch: fetchFn,
+    trustedOrigin
   });
   if (!response.ok) {
     throw await parseErrorResponse(response);
@@ -834,6 +897,10 @@ async function refreshAuthorization(authorizationServerUrl, {
   } else {
     tokenUrl = new URL("/token", authorizationServerUrl);
   }
+  const trustedOrigin = getTrustedLoopbackOrigin(authorizationServerUrl);
+  assertSafeOAuthEndpoint(tokenUrl, {
+    allowLoopback: tokenUrl.origin === trustedOrigin
+  });
   const headers = new Headers({
     "Content-Type": "application/x-www-form-urlencoded"
   });
@@ -854,10 +921,15 @@ async function refreshAuthorization(authorizationServerUrl, {
   if (resource) {
     params.set("resource", resource.href);
   }
-  const response = await (fetchFn != null ? fetchFn : fetch)(tokenUrl, {
-    method: "POST",
-    headers,
-    body: params
+  const response = await (0, import_provider_utils2.fetchWithValidatedEndpoint)({
+    url: tokenUrl,
+    init: {
+      method: "POST",
+      headers,
+      body: params
+    },
+    fetch: fetchFn,
+    trustedOrigin
   });
   if (!response.ok) {
     throw await parseErrorResponse(response);
@@ -883,12 +955,21 @@ async function registerClient(authorizationServerUrl, {
   } else {
     registrationUrl = new URL("/register", authorizationServerUrl);
   }
-  const response = await (fetchFn != null ? fetchFn : fetch)(registrationUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json"
+  const trustedOrigin = getTrustedLoopbackOrigin(authorizationServerUrl);
+  assertSafeOAuthEndpoint(registrationUrl, {
+    allowLoopback: registrationUrl.origin === trustedOrigin
+  });
+  const response = await (0, import_provider_utils2.fetchWithValidatedEndpoint)({
+    url: registrationUrl,
+    init: {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(clientMetadata)
     },
-    body: JSON.stringify(clientMetadata)
+    fetch: fetchFn,
+    trustedOrigin
   });
   if (!response.ok) {
     throw await parseErrorResponse(response);
@@ -954,6 +1035,14 @@ async function authInternal(provider, {
   if (!authorizationServerUrl) {
     authorizationServerUrl = serverUrl;
   }
+  const parsedServerUrl = new URL(serverUrl);
+  const parsedAuthorizationServerUrl = new URL(authorizationServerUrl);
+  const serverOrigin = parsedServerUrl.origin;
+  const authorizationServerOrigin = parsedAuthorizationServerUrl.origin;
+  const trustedAuthorizationServerOrigin = authorizationServerOrigin === serverOrigin || isOAuthLoopbackHost(parsedServerUrl.hostname) && isOAuthLoopbackHost(parsedAuthorizationServerUrl.hostname) ? authorizationServerOrigin : void 0;
+  if (!trustedAuthorizationServerOrigin) {
+    assertSafeOAuthEndpoint(new URL(authorizationServerUrl));
+  }
   const resource = await selectResourceURL(
     serverUrl,
     provider,
@@ -962,7 +1051,8 @@ async function authInternal(provider, {
   const metadata = await discoverAuthorizationServerMetadata(
     authorizationServerUrl,
     {
-      fetchFn
+      fetchFn,
+      trustedOrigin: trustedAuthorizationServerOrigin
     }
   );
   let clientInformation = await Promise.resolve(provider.clientInformation());