@ai-sdk/mcp 2.0.0-beta.1 → 2.0.0-beta.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ai-sdk/mcp
 
+## 2.0.0-beta.3
+
+### Patch Changes
+
+- b9b3899: changeset for #13384
+
+## 2.0.0-beta.2
+
+### Patch Changes
+
+- 9ecd8ae: fix(mcp): add MCP protocol version 2025-11-25 to supported versions
+
 ## 2.0.0-beta.1
 
 ### Patch Changes

package/dist/index.d.mts

@@ -182,6 +182,8 @@ interface OAuthClientProvider {
     clientInformation(): OAuthClientInformation | undefined | Promise<OAuthClientInformation | undefined>;
     saveClientInformation?(clientInformation: OAuthClientInformation): void | Promise<void>;
     state?(): string | Promise<string>;
+    saveState?(state: string): void | Promise<void>;
+    storedState?(): string | undefined | Promise<string | undefined>;
     validateResourceURL?(serverUrl: string | URL, resource?: string): Promise<URL | undefined>;
 }
 declare class UnauthorizedError extends Error {
@@ -190,6 +192,7 @@ declare class UnauthorizedError extends Error {
 declare function auth(provider: OAuthClientProvider, options: {
     serverUrl: string | URL;
     authorizationCode?: string;
+    callbackState?: string;
     scope?: string;
     resourceMetadataUrl?: URL;
     fetchFn?: FetchFunction;

package/dist/index.d.ts

@@ -182,6 +182,8 @@ interface OAuthClientProvider {
     clientInformation(): OAuthClientInformation | undefined | Promise<OAuthClientInformation | undefined>;
     saveClientInformation?(clientInformation: OAuthClientInformation): void | Promise<void>;
     state?(): string | Promise<string>;
+    saveState?(state: string): void | Promise<void>;
+    storedState?(): string | undefined | Promise<string | undefined>;
     validateResourceURL?(serverUrl: string | URL, resource?: string): Promise<URL | undefined>;
 }
 declare class UnauthorizedError extends Error {
@@ -190,6 +192,7 @@ declare class UnauthorizedError extends Error {
 declare function auth(provider: OAuthClientProvider, options: {
     serverUrl: string | URL;
     authorizationCode?: string;
+    callbackState?: string;
     scope?: string;
     resourceMetadataUrl?: URL;
     fetchFn?: FetchFunction;

package/dist/index.js

@@ -74,9 +74,10 @@ var import_v42 = require("zod/v4");
 
 // src/tool/types.ts
 var import_v4 = require("zod/v4");
-var LATEST_PROTOCOL_VERSION = "2025-06-18";
+var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
+  "2025-06-18",
   "2025-03-26",
   "2024-11-05"
 ];
@@ -948,6 +949,7 @@ async function selectResourceURL(serverUrl, provider, resourceMetadata) {
 async function authInternal(provider, {
   serverUrl,
   authorizationCode,
+  callbackState,
   scope,
   resourceMetadataUrl,
   fetchFn
@@ -1000,6 +1002,14 @@ async function authInternal(provider, {
     clientInformation = fullInformation;
   }
   if (authorizationCode !== void 0) {
+    if (provider.storedState) {
+      const expectedState = await provider.storedState();
+      if (expectedState !== void 0 && expectedState !== callbackState) {
+        throw new Error(
+          "OAuth state parameter mismatch - possible CSRF attack"
+        );
+      }
+    }
     const codeVerifier2 = await provider.codeVerifier();
     const tokens2 = await exchangeAuthorization(authorizationServerUrl, {
       metadata,
@@ -1038,6 +1048,9 @@ async function authInternal(provider, {
     }
   }
   const state = provider.state ? await provider.state() : void 0;
+  if (state && provider.saveState) {
+    await provider.saveState(state);
+  }
   const { authorizationUrl, codeVerifier } = await startAuthorization(
     authorizationServerUrl,
     {