@ai-sdk/mcp 1.0.70 → 1.0.72

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @ai-sdk/mcp
 
+## 1.0.72
+
+### Patch Changes
+
+- 0075ed5: fix(mcp): reject SSE requests when POST responses are unsuccessful
+
+## 1.0.71
+
+### Patch Changes
+
+- b0e77c0: Select MCP OAuth authorization scopes from `WWW-Authenticate` challenges or Protected Resource Metadata.
+- Updated dependencies [31205a4]
+  - @ai-sdk/provider-utils@4.0.46
+
 ## 1.0.70
 
 ### Patch Changes

package/dist/index.js

@@ -661,26 +661,41 @@ function assertAuthorizationServerInformationMatches({
     });
   }
 }
-function extractResourceMetadataUrl(response) {
-  var _a3;
+function extractWWWAuthenticateParams(response) {
+  var _a3, _b3;
   const header = (_a3 = response.headers.get("www-authenticate")) != null ? _a3 : response.headers.get("WWW-Authenticate");
   if (!header) {
-    return void 0;
+    return {};
   }
   const [type, scheme] = header.split(" ");
-  if (type.toLowerCase() !== "bearer" || !scheme) {
-    return void 0;
-  }
-  const regex = /resource_metadata="([^"]*)"/;
-  const match = header.match(regex);
-  if (!match) {
-    return void 0;
+  if (type.replace(/,$/, "").toLowerCase() !== "bearer" || !scheme) {
+    return {};
   }
+  const resourceMetadataMatch = header.match(
+    /(?:^|[,\s])resource_metadata="([^"]*)"/i
+  );
+  const scope = (_b3 = header.match(/(?:^|[,\s])scope="([^"]*)"/i)) == null ? void 0 : _b3[1];
+  let resourceMetadataUrl;
   try {
-    return new URL(match[1]);
+    resourceMetadataUrl = resourceMetadataMatch ? new URL(resourceMetadataMatch[1]) : void 0;
   } catch (e) {
-    return void 0;
   }
+  return { resourceMetadataUrl, scope };
+}
+function selectScope({
+  scope,
+  resourceMetadata,
+  clientMetadata
+}) {
+  var _a3;
+  if (scope) {
+    return scope;
+  }
+  const resourceScopes = (_a3 = resourceMetadata == null ? void 0 : resourceMetadata.scopes_supported) == null ? void 0 : _a3.join(" ");
+  if (resourceScopes) {
+    return resourceScopes;
+  }
+  return clientMetadata.scope;
 }
 function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
   if (pathname.endsWith("/")) {
@@ -1309,7 +1324,11 @@ async function authInternal(provider, {
       clientInformation,
       state,
       redirectUrl: provider.redirectUrl,
-      scope: scope || provider.clientMetadata.scope,
+      scope: selectScope({
+        scope,
+        resourceMetadata,
+        clientMetadata: provider.clientMetadata
+      }),
       resource
     }
   );
@@ -1387,11 +1406,13 @@ var SseMCPTransport = class {
             redirect: this.redirectMode
           });
           if (response.status === 401 && this.authProvider && !triedAuth) {
-            this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+            const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+            this.resourceMetadataUrl = resourceMetadataUrl;
             try {
               const result = await auth(this.authProvider, {
                 serverUrl: this.url,
                 resourceMetadataUrl: this.resourceMetadataUrl,
+                scope,
                 fetchFn: this.fetchFn
               });
               if (result !== "AUTHORIZED") {
@@ -1506,7 +1527,7 @@ var SseMCPTransport = class {
     const transportSignal = (_b3 = this.abortController) == null ? void 0 : _b3.signal;
     const requestSignal = (options == null ? void 0 : options.signal) == null ? transportSignal : transportSignal == null ? options.signal : AbortSignal.any([transportSignal, options.signal]);
     const attempt = async (triedAuth = false) => {
-      var _a4, _b4, _c, _d, _e;
+      var _a4, _b4;
       try {
         const headers = await this.commonHeaders({
           "Content-Type": "application/json"
@@ -1520,38 +1541,35 @@ var SseMCPTransport = class {
         };
         const response = await this.fetchFn(endpoint.href, init);
         if (response.status === 401 && this.authProvider && !triedAuth) {
-          this.resourceMetadataUrl = extractResourceMetadataUrl(response);
-          try {
-            const result = await auth(this.authProvider, {
-              serverUrl: this.url,
-              resourceMetadataUrl: this.resourceMetadataUrl,
-              fetchFn: this.fetchFn
-            });
-            if (result !== "AUTHORIZED") {
-              const error = new UnauthorizedError();
-              (_a4 = this.onerror) == null ? void 0 : _a4.call(this, error);
-              return;
-            }
-          } catch (error) {
-            (_b4 = this.onerror) == null ? void 0 : _b4.call(this, error);
-            return;
+          const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          this.resourceMetadataUrl = resourceMetadataUrl;
+          const result = await auth(this.authProvider, {
+            serverUrl: this.url,
+            resourceMetadataUrl: this.resourceMetadataUrl,
+            scope,
+            fetchFn: this.fetchFn
+          });
+          if (result !== "AUTHORIZED") {
+            throw new UnauthorizedError();
           }
           return attempt(true);
         }
         if (!response.ok) {
           const text = await response.text().catch(() => null);
           const error = new MCPClientError({
-            message: `MCP SSE Transport Error: POSTing to endpoint (HTTP ${response.status}): ${text}`
+            message: `MCP SSE Transport Error: POSTing to endpoint (HTTP ${response.status}): ${text}`,
+            statusCode: response.status,
+            url: endpoint.href,
+            responseBody: text != null ? text : void 0
           });
-          (_c = this.onerror) == null ? void 0 : _c.call(this, error);
-          return;
+          throw error;
         }
       } catch (error) {
-        if ((_d = options == null ? void 0 : options.signal) == null ? void 0 : _d.aborted) {
+        if ((_a4 = options == null ? void 0 : options.signal) == null ? void 0 : _a4.aborted) {
           throw error;
         }
-        (_e = this.onerror) == null ? void 0 : _e.call(this, error);
-        return;
+        (_b4 = this.onerror) == null ? void 0 : _b4.call(this, error);
+        throw error;
       }
     };
     await attempt();
@@ -1612,7 +1630,7 @@ var HttpMCPTransport = class {
   /**
    * Runs a single OAuth recovery flow for concurrent 401 responses.
    */
-  authorizeOnce(resourceMetadataUrl) {
+  authorizeOnce(resourceMetadataUrl, scope) {
     if (!this.authProvider) {
       return Promise.resolve("REDIRECT");
     }
@@ -1620,6 +1638,7 @@ var HttpMCPTransport = class {
       this.authPromise = auth(this.authProvider, {
         serverUrl: this.url,
         resourceMetadataUrl,
+        scope,
         fetchFn: this.fetchFn
       }).finally(() => {
         this.authPromise = void 0;
@@ -1681,9 +1700,13 @@ var HttpMCPTransport = class {
           this.sessionId = sessionId;
         }
         if (response.status === 401 && this.authProvider && !triedAuth) {
-          this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+          const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          this.resourceMetadataUrl = resourceMetadataUrl;
           try {
-            const result = await this.authorizeOnce(this.resourceMetadataUrl);
+            const result = await this.authorizeOnce(
+              this.resourceMetadataUrl,
+              scope
+            );
             if (result !== "AUTHORIZED") {
               const error2 = new UnauthorizedError();
               throw error2;
@@ -1854,9 +1877,13 @@ var HttpMCPTransport = class {
         this.sessionId = sessionId;
       }
       if (response.status === 401 && this.authProvider && !triedAuth) {
-        this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+        const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+        this.resourceMetadataUrl = resourceMetadataUrl;
         try {
-          const result = await this.authorizeOnce(this.resourceMetadataUrl);
+          const result = await this.authorizeOnce(
+            this.resourceMetadataUrl,
+            scope
+          );
           if (result !== "AUTHORIZED") {
             const error = new UnauthorizedError();
             (_b3 = this.onerror) == null ? void 0 : _b3.call(this, error);