@ai-sdk/mcp 1.0.47 → 1.0.48

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @ai-sdk/mcp
 
+## 1.0.48
+
+### Patch Changes
+
+- 26d93a4: fix(mcp): add optional hook to validate authorization servers
+- 3c9ad04: fix(mcp): support official sdk protocol version negotiation
+- Updated dependencies [942f2f8]
+  - @ai-sdk/provider-utils@4.0.28
+
 ## 1.0.47
 
 ### Patch Changes

package/dist/index.d.mts

@@ -191,6 +191,11 @@ interface OAuthClientProvider {
     saveClientInformation?(clientInformation: OAuthClientInformation): void | Promise<void>;
     authorizationServerInformation?(): OAuthAuthorizationServerInformation | undefined | Promise<OAuthAuthorizationServerInformation | undefined>;
     saveAuthorizationServerInformation?(authorizationServerInformation: OAuthAuthorizationServerInformation): void | Promise<void>;
+    /**
+     * Validates an authorization server URL discovered from MCP protected resource
+     * metadata before the client fetches its OAuth metadata.
+     */
+    validateAuthorizationServerURL?(serverUrl: string | URL, authorizationServerUrl: string | URL): void | Promise<void>;
     state?(): string | Promise<string>;
     saveState?(state: string): void | Promise<void>;
     storedState?(): string | undefined | Promise<string | undefined>;
@@ -242,6 +247,10 @@ interface MCPTransport {
      * The protocol version negotiated during initialization.
      */
     protocolVersion?: string;
+    /**
+     * Set the protocol version negotiated during initialization.
+     */
+    setProtocolVersion?(version: string): void;
 }
 type MCPTransportConfig = {
     type: 'sse' | 'http';

package/dist/index.d.ts

@@ -191,6 +191,11 @@ interface OAuthClientProvider {
     saveClientInformation?(clientInformation: OAuthClientInformation): void | Promise<void>;
     authorizationServerInformation?(): OAuthAuthorizationServerInformation | undefined | Promise<OAuthAuthorizationServerInformation | undefined>;
     saveAuthorizationServerInformation?(authorizationServerInformation: OAuthAuthorizationServerInformation): void | Promise<void>;
+    /**
+     * Validates an authorization server URL discovered from MCP protected resource
+     * metadata before the client fetches its OAuth metadata.
+     */
+    validateAuthorizationServerURL?(serverUrl: string | URL, authorizationServerUrl: string | URL): void | Promise<void>;
     state?(): string | Promise<string>;
     saveState?(state: string): void | Promise<void>;
     storedState?(): string | undefined | Promise<string | undefined>;
@@ -242,6 +247,10 @@ interface MCPTransport {
      * The protocol version negotiated during initialization.
      */
     protocolVersion?: string;
+    /**
+     * Set the protocol version negotiated during initialization.
+     */
+    setProtocolVersion?(version: string): void;
 }
 type MCPTransportConfig = {
     type: 'sse' | 'http';

package/dist/index.js

@@ -1105,7 +1105,7 @@ async function authInternal(provider, {
   resourceMetadataUrl,
   fetchFn
 }) {
-  var _a3;
+  var _a3, _b3;
   let resourceMetadata;
   let authorizationServerUrl;
   assertResourceMetadataUrlSameOrigin(serverUrl, resourceMetadataUrl);
@@ -1128,6 +1128,11 @@ async function authInternal(provider, {
     provider,
     resourceMetadata
   );
+  await ((_a3 = provider.validateAuthorizationServerURL) == null ? void 0 : _a3.call(
+    provider,
+    serverUrl,
+    authorizationServerUrl
+  ));
   const metadata = await discoverAuthorizationServerMetadata(
     authorizationServerUrl,
     {
@@ -1212,7 +1217,7 @@ async function authInternal(provider, {
         currentAuthorizationServerInformation
       });
     } else {
-      await ((_a3 = provider.invalidateCredentials) == null ? void 0 : _a3.call(provider, "tokens"));
+      await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "tokens"));
     }
     try {
       if (storedAuthorizationServerInformation) {
@@ -1288,6 +1293,9 @@ var SseMCPTransport = class {
     this.redirectMode = redirect;
     this.fetchFn = fetchFn != null ? fetchFn : globalThis.fetch;
   }
+  setProtocolVersion(version) {
+    this.protocolVersion = version;
+  }
   async commonHeaders(base) {
     var _a3;
     const headers = {
@@ -1503,6 +1511,9 @@ var HttpMCPTransport = class {
     this.redirectMode = redirect;
     this.fetchFn = fetchFn != null ? fetchFn : globalThis.fetch;
   }
+  setProtocolVersion(version) {
+    this.protocolVersion = version;
+  }
   async commonHeaders(base) {
     var _a3;
     const headers = {
@@ -1946,8 +1957,12 @@ var DefaultMCPClient = class {
       }
       this.serverCapabilities = result.capabilities;
       this._serverInfo = result.serverInfo;
+      if (this.transport.setProtocolVersion) {
+        this.transport.setProtocolVersion(result.protocolVersion);
+      } else {
+        this.transport.protocolVersion = result.protocolVersion;
+      }
       this._serverInstructions = result.instructions;
-      this.transport.protocolVersion = result.protocolVersion;
       await this.notification({
         method: "notifications/initialized"
       });