@ai-sdk/mcp 1.0.91 → 1.0.93

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/dist/index.d.mts +3 -2
  3. package/dist/index.d.ts +3 -2
  4. package/dist/index.js +9 -1
  5. package/dist/index.js.map +1 -1
  6. package/dist/index.mjs +9 -1
  7. package/dist/index.mjs.map +1 -1
  8. package/dist/mcp-stdio/index.js.map +1 -1
  9. package/dist/mcp-stdio/index.mjs.map +1 -1
  10. package/package.json +1 -1
  11. package/src/tool/mcp-client.ts +1 -1
  12. package/src/tool/oauth.ts +14 -1
  13. package/src/tool/types.ts +12 -5
package/CHANGELOG.md CHANGED
@@ -1,5 +1,17 @@
1
1
  # @ai-sdk/mcp
2
2
 
3
+ ## 1.0.93
4
+
5
+ ### Patch Changes
6
+
7
+ - d07f0d5: fix(mcp): allow MCP tools to execute without options
8
+
9
+ ## 1.0.92
10
+
11
+ ### Patch Changes
12
+
13
+ - ff05827: fix(mcp): authorization server paths beginning with repeated slashes should not bypass authorization server validation
14
+
3
15
  ## 1.0.91
4
16
 
5
17
  ### Patch Changes
package/dist/index.d.mts CHANGED
@@ -1,5 +1,5 @@
1
1
  import { z } from 'zod/v4';
2
- import { FetchFunction, FlexibleSchema, Tool } from '@ai-sdk/provider-utils';
2
+ import { FetchFunction, FlexibleSchema, Tool, ToolExecutionOptions } from '@ai-sdk/provider-utils';
3
3
  import { JSONObject } from '@ai-sdk/provider';
4
4
 
5
5
  declare const JSONRPCRequestSchema: z.ZodObject<{
@@ -354,7 +354,8 @@ type ToolSchemas = Record<string, {
354
354
  outputSchema?: FlexibleSchema<JSONObject | unknown>;
355
355
  }> | 'automatic' | undefined;
356
356
  /** Base MCP tool type with execute and _meta */
357
- type McpToolBase<INPUT = unknown, OUTPUT = CallToolResult> = Tool<INPUT, OUTPUT> & Required<Pick<Tool<INPUT, OUTPUT>, 'execute'>> & {
357
+ type McpToolBase<INPUT = unknown, OUTPUT = CallToolResult> = Tool<INPUT, OUTPUT> & {
358
+ execute: (input: INPUT, options?: ToolExecutionOptions) => ReturnType<NonNullable<Tool<INPUT, OUTPUT>['execute']>>;
358
359
  _meta?: ToolMeta;
359
360
  };
360
361
  type McpToolSet<TOOL_SCHEMAS extends ToolSchemas = 'automatic'> = TOOL_SCHEMAS extends Record<string, {
package/dist/index.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  import { z } from 'zod/v4';
2
- import { FetchFunction, FlexibleSchema, Tool } from '@ai-sdk/provider-utils';
2
+ import { FetchFunction, FlexibleSchema, Tool, ToolExecutionOptions } from '@ai-sdk/provider-utils';
3
3
  import { JSONObject } from '@ai-sdk/provider';
4
4
 
5
5
  declare const JSONRPCRequestSchema: z.ZodObject<{
@@ -354,7 +354,8 @@ type ToolSchemas = Record<string, {
354
354
  outputSchema?: FlexibleSchema<JSONObject | unknown>;
355
355
  }> | 'automatic' | undefined;
356
356
  /** Base MCP tool type with execute and _meta */
357
- type McpToolBase<INPUT = unknown, OUTPUT = CallToolResult> = Tool<INPUT, OUTPUT> & Required<Pick<Tool<INPUT, OUTPUT>, 'execute'>> & {
357
+ type McpToolBase<INPUT = unknown, OUTPUT = CallToolResult> = Tool<INPUT, OUTPUT> & {
358
+ execute: (input: INPUT, options?: ToolExecutionOptions) => ReturnType<NonNullable<Tool<INPUT, OUTPUT>['execute']>>;
358
359
  _meta?: ToolMeta;
359
360
  };
360
361
  type McpToolSet<TOOL_SCHEMAS extends ToolSchemas = 'automatic'> = TOOL_SCHEMAS extends Record<string, {
package/dist/index.js CHANGED
@@ -860,8 +860,10 @@ function buildDiscoveryUrls(authorizationServerUrl) {
860
860
  type: "oidc",
861
861
  expectedIssuer: pathIssuer
862
862
  });
863
+ const oidcDiscoveryUrl = new URL(url.origin);
864
+ oidcDiscoveryUrl.pathname = `${pathname}/.well-known/openid-configuration`;
863
865
  urlsToTry.push({
864
- url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
866
+ url: oidcDiscoveryUrl,
865
867
  type: "oidc",
866
868
  expectedIssuer: pathIssuer
867
869
  });
@@ -882,7 +884,13 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
882
884
  } = {}) {
883
885
  var _a3;
884
886
  const headers = { "MCP-Protocol-Version": protocolVersion };
887
+ const authorizationServerOrigin = new URL(authorizationServerUrl).origin;
885
888
  const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
889
+ if (urlsToTry.some(({ url }) => url.origin !== authorizationServerOrigin)) {
890
+ throw new MCPClientOAuthError({
891
+ message: "OAuth discovery URL changed authorization-server origin"
892
+ });
893
+ }
886
894
  for (const { url: endpointUrl, type, expectedIssuer } of urlsToTry) {
887
895
  const response = await fetchWithCorsRetry(
888
896
  endpointUrl,