@ai-sdk/mcp 1.0.31 → 1.0.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/mcp",
-  "version": "1.0.31",
+  "version": "1.0.32",
   "license": "Apache-2.0",
   "sideEffects": false,
   "main": "./dist/index.js",

package/src/tool/oauth.ts

@@ -24,6 +24,7 @@ import {
 import {
   resourceUrlFromServerUrl,
   checkResourceAllowed,
+  resourceUrlStripSlash,
 } from '../util/oauth-util';
 import { LATEST_PROTOCOL_VERSION } from './types';
 import { FetchFunction } from '@ai-sdk/provider-utils';
@@ -451,7 +452,10 @@ export async function startAuthorization(
   }
 
   if (resource) {
-    authorizationUrl.searchParams.set('resource', resource.href);
+    authorizationUrl.searchParams.set(
+      'resource',
+      resourceUrlStripSlash(resource),
+    );
   }
 
   return { authorizationUrl, codeVerifier };
@@ -675,7 +679,7 @@ export async function exchangeAuthorization(
   }
 
   if (resource) {
-    params.set('resource', resource.href);
+    params.set('resource', resourceUrlStripSlash(resource));
   }
 
   const response = await (fetchFn ?? fetch)(tokenUrl, {
@@ -762,7 +766,7 @@ export async function refreshAuthorization(
   }
 
   if (resource) {
-    params.set('resource', resource.href);
+    params.set('resource', resourceUrlStripSlash(resource));
   }
 
   const response = await (fetchFn ?? fetch)(tokenUrl, {

package/src/util/oauth-util.ts

@@ -14,6 +14,19 @@ export function resourceUrlFromServerUrl(url: URL | string): URL {
   return resourceURL;
 }
 
+/**
+ * Serializes a resource URL to a string, removing the trailing slash that
+ * URL.href adds to pathless URLs. Per the MCP spec, implementations SHOULD
+ * use the form without the trailing slash for better interoperability.
+ */
+export function resourceUrlStripSlash(resource: URL): string {
+  const href = resource.href;
+  if (resource.pathname === '/' && href.endsWith('/')) {
+    return href.slice(0, -1);
+  }
+  return href;
+}
+
 /**
  * Checks if a requested resource URL matches a configured resource URL.
  * A requested resource matches if it has the same scheme, domain, port,