@ai-sdk/mcp 1.0.47 → 1.0.49

package/dist/mcp-stdio/index.d.mts

@@ -66,6 +66,10 @@ interface MCPTransport {
      * The protocol version negotiated during initialization.
      */
     protocolVersion?: string;
+    /**
+     * Set the protocol version negotiated during initialization.
+     */
+    setProtocolVersion?(version: string): void;
 }
 
 interface StdioConfig {

package/dist/mcp-stdio/index.d.ts

@@ -66,6 +66,10 @@ interface MCPTransport {
      * The protocol version negotiated during initialization.
      */
     protocolVersion?: string;
+    /**
+     * Set the protocol version negotiated during initialization.
+     */
+    setProtocolVersion?(version: string): void;
 }
 
 interface StdioConfig {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/mcp",
-  "version": "1.0.47",
+  "version": "1.0.49",
   "license": "Apache-2.0",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -34,7 +34,7 @@
   "dependencies": {
     "pkce-challenge": "^5.0.0",
     "@ai-sdk/provider": "3.0.10",
-    "@ai-sdk/provider-utils": "4.0.27"
+    "@ai-sdk/provider-utils": "4.0.29"
   },
   "devDependencies": {
     "@types/node": "20.17.24",

package/src/tool/mcp-client.ts

@@ -312,8 +312,12 @@ class DefaultMCPClient implements MCPClient {
 
       this.serverCapabilities = result.capabilities;
       this._serverInfo = result.serverInfo;
+      if (this.transport.setProtocolVersion) {
+        this.transport.setProtocolVersion(result.protocolVersion);
+      } else {
+        this.transport.protocolVersion = result.protocolVersion;
+      }
       this._serverInstructions = result.instructions;
-      this.transport.protocolVersion = result.protocolVersion;
 
       // Complete initialization handshake:
       await this.notification({
@@ -606,7 +610,10 @@ class DefaultMCPClient implements MCPClient {
       _meta,
     } of definitions.tools) {
       const resolvedTitle = title ?? annotations?.title;
-      if (schemas !== 'automatic' && !(name in schemas)) {
+      if (
+        schemas !== 'automatic' &&
+        !Object.prototype.hasOwnProperty.call(schemas, name)
+      ) {
         continue;
       }
 

package/src/tool/mcp-http-transport.ts

@@ -75,6 +75,10 @@ export class HttpMCPTransport implements MCPTransport {
     this.fetchFn = fetchFn ?? globalThis.fetch;
   }
 
+  setProtocolVersion(version: string): void {
+    this.protocolVersion = version;
+  }
+
   private async commonHeaders(
     base: Record<string, string>,
   ): Promise<Record<string, string>> {

package/src/tool/mcp-sse-transport.ts

@@ -55,6 +55,10 @@ export class SseMCPTransport implements MCPTransport {
     this.fetchFn = fetchFn ?? globalThis.fetch;
   }
 
+  setProtocolVersion(version: string): void {
+    this.protocolVersion = version;
+  }
+
   private async commonHeaders(
     base: Record<string, string>,
   ): Promise<Record<string, string>> {
@@ -157,14 +161,23 @@ export class SseMCPTransport implements MCPTransport {
                 const { event, data } = value;
 
                 if (event === 'endpoint') {
-                  this.endpoint = new URL(data, this.url);
+                  if (this.endpoint) {
+                    continue;
+                  }
 
-                  if (this.endpoint.origin !== this.url.origin) {
+                  const endpoint = new URL(data, this.url);
+
+                  if (endpoint.origin !== this.url.origin) {
+                    this.connected = false;
+                    this.endpoint = undefined;
+                    this.sseConnection?.close();
+                    this.abortController?.abort();
                     throw new MCPClientError({
-                      message: `MCP SSE Transport Error: Endpoint origin does not match connection origin: ${this.endpoint.origin}`,
+                      message: `MCP SSE Transport Error: Endpoint origin does not match connection origin: ${endpoint.origin}`,
                     });
                   }
 
+                  this.endpoint = endpoint;
                   this.connected = true;
                   resolve();
                 } else if (event === 'message') {
@@ -213,6 +226,7 @@ export class SseMCPTransport implements MCPTransport {
 
   async close(): Promise<void> {
     this.connected = false;
+    this.endpoint = undefined;
     this.sseConnection?.close();
     this.abortController?.abort();
     this.onclose?.();

package/src/tool/mcp-transport.ts

@@ -45,6 +45,11 @@ export interface MCPTransport {
    * The protocol version negotiated during initialization.
    */
   protocolVersion?: string;
+
+  /**
+   * Set the protocol version negotiated during initialization.
+   */
+  setProtocolVersion?(version: string): void;
 }
 
 export type MCPTransportConfig = {

package/src/tool/oauth.ts

@@ -95,6 +95,14 @@ export interface OAuthClientProvider {
   saveAuthorizationServerInformation?(
     authorizationServerInformation: OAuthAuthorizationServerInformation,
   ): void | Promise<void>;
+  /**
+   * Validates an authorization server URL discovered from MCP protected resource
+   * metadata before the client fetches its OAuth metadata.
+   */
+  validateAuthorizationServerURL?(
+    serverUrl: string | URL,
+    authorizationServerUrl: string | URL,
+  ): void | Promise<void>;
   state?(): string | Promise<string>;
   saveState?(state: string): void | Promise<void>;
   storedState?(): string | undefined | Promise<string | undefined>;
@@ -1115,6 +1123,12 @@ async function authInternal(
     resourceMetadata,
   );
 
+  /** Let applications constrain discovered AS URLs before metadata fetches. */
+  await provider.validateAuthorizationServerURL?.(
+    serverUrl,
+    authorizationServerUrl,
+  );
+
   /** Discover AS metadata and derive the credential pin for this flow */
   const metadata = await discoverAuthorizationServerMetadata(
     authorizationServerUrl,