@ai-sdk/mcp 1.0.91 → 1.0.92

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/CHANGELOG.md +6 -0
  2. package/dist/index.js +9 -1
  3. package/dist/index.js.map +1 -1
  4. package/dist/index.mjs +9 -1
  5. package/dist/index.mjs.map +1 -1
  6. package/package.json +1 -1
  7. package/src/tool/oauth.ts +14 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,11 @@
1
1
  # @ai-sdk/mcp
2
2
 
3
+ ## 1.0.92
4
+
5
+ ### Patch Changes
6
+
7
+ - ff05827: fix(mcp): authorization server paths beginning with repeated slashes should not bypass authorization server validation
8
+
3
9
  ## 1.0.91
4
10
 
5
11
  ### Patch Changes
package/dist/index.js CHANGED
@@ -860,8 +860,10 @@ function buildDiscoveryUrls(authorizationServerUrl) {
860
860
  type: "oidc",
861
861
  expectedIssuer: pathIssuer
862
862
  });
863
+ const oidcDiscoveryUrl = new URL(url.origin);
864
+ oidcDiscoveryUrl.pathname = `${pathname}/.well-known/openid-configuration`;
863
865
  urlsToTry.push({
864
- url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
866
+ url: oidcDiscoveryUrl,
865
867
  type: "oidc",
866
868
  expectedIssuer: pathIssuer
867
869
  });
@@ -882,7 +884,13 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
882
884
  } = {}) {
883
885
  var _a3;
884
886
  const headers = { "MCP-Protocol-Version": protocolVersion };
887
+ const authorizationServerOrigin = new URL(authorizationServerUrl).origin;
885
888
  const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
889
+ if (urlsToTry.some(({ url }) => url.origin !== authorizationServerOrigin)) {
890
+ throw new MCPClientOAuthError({
891
+ message: "OAuth discovery URL changed authorization-server origin"
892
+ });
893
+ }
886
894
  for (const { url: endpointUrl, type, expectedIssuer } of urlsToTry) {
887
895
  const response = await fetchWithCorsRetry(
888
896
  endpointUrl,