@ai-sdk/mcp 1.0.80 → 1.0.82

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/mcp",
-  "version": "1.0.80",
+  "version": "1.0.82",
   "license": "Apache-2.0",
   "sideEffects": false,
   "main": "./dist/index.js",

package/src/tool/mcp-sse-transport.ts

@@ -12,6 +12,7 @@ import {
   extractWWWAuthenticateParams,
   UnauthorizedError,
   auth,
+  type AuthResult,
   type OAuthClientProvider,
 } from './oauth';
 import { LATEST_PROTOCOL_VERSION } from './types';
@@ -33,6 +34,7 @@ export class SseMCPTransport implements MCPTransport {
   private resourceMetadataUrl?: URL;
   private redirectMode: RequestRedirect;
   private fetchFn: FetchFunction;
+  private authPromise?: Promise<AuthResult>;
 
   onclose?: () => void;
   onerror?: (error: unknown) => void;
@@ -86,6 +88,40 @@ export class SseMCPTransport implements MCPTransport {
     );
   }
 
+  /**
+   * Runs a single OAuth recovery flow for concurrent 401 responses.
+   */
+  private authorizeOnce(
+    resourceMetadataUrl?: URL,
+    scope?: string,
+  ): Promise<AuthResult> {
+    if (!this.authProvider) {
+      return Promise.resolve('REDIRECT');
+    }
+
+    if (!this.authPromise) {
+      this.authPromise = auth(this.authProvider, {
+        serverUrl: this.url,
+        resourceMetadataUrl,
+        scope,
+        fetchFn: this.fetchFn,
+      }).finally(() => {
+        this.authPromise = undefined;
+      });
+    }
+
+    return this.authPromise;
+  }
+
+  private async accessTokenChanged(
+    requestAuthorization: string | undefined,
+  ): Promise<boolean> {
+    const accessToken = (await this.authProvider?.tokens())?.access_token;
+    return (
+      accessToken != null && requestAuthorization !== `Bearer ${accessToken}`
+    );
+  }
+
   async start(): Promise<void> {
     return new Promise<void>((resolve, reject) => {
       if (this.connected) {
@@ -110,12 +146,10 @@ export class SseMCPTransport implements MCPTransport {
               extractWWWAuthenticateParams(response);
             this.resourceMetadataUrl = resourceMetadataUrl;
             try {
-              const result = await auth(this.authProvider, {
-                serverUrl: this.url,
-                resourceMetadataUrl: this.resourceMetadataUrl,
+              const result = await this.authorizeOnce(
+                this.resourceMetadataUrl,
                 scope,
-                fetchFn: this.fetchFn,
-              });
+              );
               if (result !== 'AUTHORIZED') {
                 const error = new UnauthorizedError();
                 this.onerror?.(error);
@@ -276,15 +310,21 @@ export class SseMCPTransport implements MCPTransport {
         const response = await this.fetchFn(endpoint.href, init);
 
         if (response.status === 401 && this.authProvider && !triedAuth) {
+          if (
+            await this.accessTokenChanged(
+              new Headers(headers).get('authorization') ?? undefined,
+            )
+          ) {
+            return attempt(true);
+          }
+
           const { resourceMetadataUrl, scope } =
             extractWWWAuthenticateParams(response);
           this.resourceMetadataUrl = resourceMetadataUrl;
-          const result = await auth(this.authProvider, {
-            serverUrl: this.url,
-            resourceMetadataUrl: this.resourceMetadataUrl,
+          const result = await this.authorizeOnce(
+            this.resourceMetadataUrl,
             scope,
-            fetchFn: this.fetchFn,
-          });
+          );
           if (result !== 'AUTHORIZED') {
             throw new UnauthorizedError();
           }

package/src/tool/oauth.ts

@@ -1199,6 +1199,10 @@ async function authInternal(
 ): Promise<AuthResult> {
   let resourceMetadata: OAuthProtectedResourceMetadata | undefined;
   let authorizationServerUrl: string | URL | undefined;
+  let clientInformation: OAuthClientInformation | undefined;
+  let callbackAuthorizationServerInformation:
+    | OAuthAuthorizationServerInformation
+    | undefined;
 
   /** Reject Protected Resource Metadata URLs outside the configured MCP server origin. */
   assertResourceMetadataUrlSameOrigin(serverUrl, resourceMetadataUrl);
@@ -1218,9 +1222,27 @@ async function authInternal(
     }
   } catch {}
 
-  /** Fall back to legacy MCP behavior where the MCP server is the Authorization Server */
+  /**
+   * A callback may not have the original PRM URL from the authentication
+   * challenge. Use the authorization server pinned before redirecting when
+   * rediscovery does not select one.
+   */
+  if (authorizationCode !== undefined) {
+    clientInformation = await Promise.resolve(provider.clientInformation());
+    if (clientInformation) {
+      callbackAuthorizationServerInformation =
+        await getStoredAuthorizationServerInformation({
+          provider,
+          clientInformation,
+        });
+    }
+  }
+
+  /** Reuse the callback pin, then fall back to the legacy MCP-as-AS behavior. */
   if (!authorizationServerUrl) {
-    authorizationServerUrl = serverUrl;
+    authorizationServerUrl =
+      callbackAuthorizationServerInformation?.authorizationServerUrl ??
+      serverUrl;
   }
 
   /** Validate and select the resource value sent to the AS */
@@ -1253,7 +1275,9 @@ async function authInternal(
   });
 
   /** Load or register client credentials with the AS pin attached. */
-  let clientInformation = await Promise.resolve(provider.clientInformation());
+  if (authorizationCode === undefined) {
+    clientInformation = await Promise.resolve(provider.clientInformation());
+  }
   if (!clientInformation) {
     if (authorizationCode !== undefined) {
       throw new Error(
@@ -1295,10 +1319,11 @@ async function authInternal(
     }
 
     const storedAuthorizationServerInformation =
-      await getStoredAuthorizationServerInformation({
+      callbackAuthorizationServerInformation ??
+      (await getStoredAuthorizationServerInformation({
         provider,
         clientInformation,
-      });
+      }));
     if (!storedAuthorizationServerInformation) {
       throw new MCPClientOAuthError({
         message: