@ai-sdk/mcp 2.0.0-beta.2 → 2.0.0-beta.21

package/dist/mcp-stdio/index.js

@@ -18,11 +18,11 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/tool/mcp-stdio/index.ts
-var mcp_stdio_exports = {};
-__export(mcp_stdio_exports, {
+var index_exports = {};
+__export(index_exports, {
   Experimental_StdioMCPTransport: () => StdioMCPTransport
 });
-module.exports = __toCommonJS(mcp_stdio_exports);
+module.exports = __toCommonJS(index_exports);
 
 // src/tool/json-rpc-message.ts
 var import_v42 = require("zod/v4");

package/dist/mcp-stdio/index.mjs

@@ -257,7 +257,7 @@ var MCPClientError = class extends (_b = AISDKError, _a = symbol, _b) {
 };
 
 // src/tool/mcp-stdio/create-child-process.ts
-import { spawn } from "node:child_process";
+import { spawn } from "child_process";
 
 // src/tool/mcp-stdio/get-environment.ts
 function getEnvironment(customEnv) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/mcp",
-  "version": "2.0.0-beta.2",
+  "version": "2.0.0-beta.21",
   "license": "Apache-2.0",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -33,17 +33,17 @@
   },
   "dependencies": {
     "pkce-challenge": "^5.0.0",
-    "@ai-sdk/provider-utils": "5.0.0-beta.1",
-    "@ai-sdk/provider": "4.0.0-beta.0"
+    "@ai-sdk/provider": "4.0.0-beta.9",
+    "@ai-sdk/provider-utils": "5.0.0-beta.15"
   },
   "devDependencies": {
     "@types/node": "20.17.24",
     "tsup": "^8",
     "typescript": "5.8.3",
-    "vitest": "2.1.4",
+    "vitest": "^4.1.0",
     "zod": "3.25.76",
-    "@vercel/ai-tsconfig": "0.0.0",
-    "@ai-sdk/test-server": "2.0.0-beta.0"
+    "@ai-sdk/test-server": "2.0.0-beta.0",
+    "@vercel/ai-tsconfig": "0.0.0"
   },
   "peerDependencies": {
     "zod": "^3.25.76 || ^4.1.8"
@@ -70,9 +70,7 @@
     "build": "pnpm clean && tsup --tsconfig tsconfig.build.json",
     "build:watch": "pnpm clean && tsup --watch",
     "clean": "rm -rf dist *.tsbuildinfo",
-    "lint": "eslint \"./**/*.ts*\"",
     "type-check": "tsc --build",
-    "prettier-check": "prettier --check \"./**/*.ts*\"",
     "test": "pnpm test:node && pnpm test:edge",
     "test:update": "pnpm test:node -u",
     "test:watch": "vitest --config vitest.node.config.js",

package/src/tool/mcp-client.ts

@@ -420,7 +420,7 @@ class DefaultMCPClient implements MCPClient {
   }: {
     name: string;
     args: Record<string, unknown>;
-    options?: ToolExecutionOptions;
+    options?: ToolExecutionOptions<{}>;
   }): Promise<CallToolResult> {
     try {
       return this.request({
@@ -579,11 +579,15 @@ class DefaultMCPClient implements MCPClient {
 
       const execute = async (
         args: any,
-        options: ToolExecutionOptions,
+        options: ToolExecutionOptions<{}>,
       ): Promise<unknown> => {
         options?.abortSignal?.throwIfAborted();
         const result = await self.callTool({ name, args, options });
 
+        if (result.isError) {
+          return result;
+        }
+
         if (outputSchema != null) {
           return self.extractStructuredContent(result, outputSchema, name);
         }

package/src/tool/mcp-http-transport.ts

@@ -1,5 +1,6 @@
 import {
   EventSourceParserStream,
+  FetchFunction,
   withUserAgentSuffix,
   getRuntimeEnvironmentUserAgent,
 } from '@ai-sdk/provider-utils';
@@ -30,6 +31,8 @@ export class HttpMCPTransport implements MCPTransport {
   private resourceMetadataUrl?: URL;
   private sessionId?: string;
   private inboundSseConnection?: { close: () => void };
+  private redirectMode: RequestRedirect;
+  private fetchFn: FetchFunction;
 
   // Inbound SSE resumption and reconnection state
   private lastInboundEventId?: string;
@@ -49,14 +52,20 @@ export class HttpMCPTransport implements MCPTransport {
     url,
     headers,
     authProvider,
+    redirect = 'error',
+    fetch: fetchFn,
   }: {
     url: string;
     headers?: Record<string, string>;
     authProvider?: OAuthClientProvider;
+    redirect?: 'follow' | 'error';
+    fetch?: FetchFunction;
   }) {
     this.url = new URL(url);
     this.headers = headers;
     this.authProvider = authProvider;
+    this.redirectMode = redirect;
+    this.fetchFn = fetchFn ?? globalThis.fetch;
   }
 
   private async commonHeaders(
@@ -107,10 +116,11 @@ export class HttpMCPTransport implements MCPTransport {
         !this.abortController.signal.aborted
       ) {
         const headers = await this.commonHeaders({});
-        await fetch(this.url, {
+        await this.fetchFn(this.url.href, {
           method: 'DELETE',
           headers,
           signal: this.abortController.signal,
+          redirect: this.redirectMode,
         }).catch(() => undefined);
       }
     } catch {}
@@ -132,9 +142,10 @@ export class HttpMCPTransport implements MCPTransport {
           headers,
           body: JSON.stringify(message),
           signal: this.abortController?.signal,
+          redirect: this.redirectMode,
         } satisfies RequestInit;
 
-        const response = await fetch(this.url, init);
+        const response = await this.fetchFn(this.url.href, init);
 
         const sessionId = response.headers.get('mcp-session-id');
         if (sessionId) {
@@ -147,6 +158,7 @@ export class HttpMCPTransport implements MCPTransport {
             const result = await auth(this.authProvider, {
               serverUrl: this.url,
               resourceMetadataUrl: this.resourceMetadataUrl,
+              fetchFn: this.fetchFn,
             });
             if (result !== 'AUTHORIZED') {
               const error = new UnauthorizedError();
@@ -308,10 +320,11 @@ export class HttpMCPTransport implements MCPTransport {
         headers['last-event-id'] = resumeToken;
       }
 
-      const response = await fetch(this.url.href, {
+      const response = await this.fetchFn(this.url.href, {
         method: 'GET',
         headers,
         signal: this.abortController?.signal,
+        redirect: this.redirectMode,
       });
 
       const sessionId = response.headers.get('mcp-session-id');
@@ -325,6 +338,7 @@ export class HttpMCPTransport implements MCPTransport {
           const result = await auth(this.authProvider, {
             serverUrl: this.url,
             resourceMetadataUrl: this.resourceMetadataUrl,
+            fetchFn: this.fetchFn,
           });
           if (result !== 'AUTHORIZED') {
             const error = new UnauthorizedError();

package/src/tool/mcp-sse-transport.ts

@@ -1,5 +1,6 @@
 import {
   EventSourceParserStream,
+  FetchFunction,
   withUserAgentSuffix,
   getRuntimeEnvironmentUserAgent,
 } from '@ai-sdk/provider-utils';
@@ -26,6 +27,8 @@ export class SseMCPTransport implements MCPTransport {
   private headers?: Record<string, string>;
   private authProvider?: OAuthClientProvider;
   private resourceMetadataUrl?: URL;
+  private redirectMode: RequestRedirect;
+  private fetchFn: FetchFunction;
 
   onclose?: () => void;
   onerror?: (error: unknown) => void;
@@ -35,14 +38,20 @@ export class SseMCPTransport implements MCPTransport {
     url,
     headers,
     authProvider,
+    redirect = 'error',
+    fetch: fetchFn,
   }: {
     url: string;
     headers?: Record<string, string>;
     authProvider?: OAuthClientProvider;
+    redirect?: 'follow' | 'error';
+    fetch?: FetchFunction;
   }) {
     this.url = new URL(url);
     this.headers = headers;
     this.authProvider = authProvider;
+    this.redirectMode = redirect;
+    this.fetchFn = fetchFn ?? globalThis.fetch;
   }
 
   private async commonHeaders(
@@ -81,9 +90,10 @@ export class SseMCPTransport implements MCPTransport {
           const headers = await this.commonHeaders({
             Accept: 'text/event-stream',
           });
-          const response = await fetch(this.url.href, {
+          const response = await this.fetchFn(this.url.href, {
             headers,
             signal: this.abortController?.signal,
+            redirect: this.redirectMode,
           });
 
           if (response.status === 401 && this.authProvider && !triedAuth) {
@@ -92,6 +102,7 @@ export class SseMCPTransport implements MCPTransport {
               const result = await auth(this.authProvider, {
                 serverUrl: this.url,
                 resourceMetadataUrl: this.resourceMetadataUrl,
+                fetchFn: this.fetchFn,
               });
               if (result !== 'AUTHORIZED') {
                 const error = new UnauthorizedError();
@@ -227,9 +238,10 @@ export class SseMCPTransport implements MCPTransport {
           headers,
           body: JSON.stringify(message),
           signal: this.abortController?.signal,
+          redirect: this.redirectMode,
         };
 
-        const response = await fetch(endpoint, init);
+        const response = await this.fetchFn(endpoint.href, init);
 
         if (response.status === 401 && this.authProvider && !triedAuth) {
           this.resourceMetadataUrl = extractResourceMetadataUrl(response);
@@ -237,6 +249,7 @@ export class SseMCPTransport implements MCPTransport {
             const result = await auth(this.authProvider, {
               serverUrl: this.url,
               resourceMetadataUrl: this.resourceMetadataUrl,
+              fetchFn: this.fetchFn,
             });
             if (result !== 'AUTHORIZED') {
               const error = new UnauthorizedError();

package/src/tool/mcp-transport.ts

@@ -1,3 +1,4 @@
+import { FetchFunction } from '@ai-sdk/provider-utils';
 import { MCPClientError } from '../error/mcp-client-error';
 import { JSONRPCMessage } from './json-rpc-message';
 import { SseMCPTransport } from './mcp-sse-transport';
@@ -58,6 +59,21 @@ export type MCPTransportConfig = {
    * An optional OAuth client provider to use for authentication for MCP servers.
    */
   authProvider?: OAuthClientProvider;
+
+  /**
+   * Controls how HTTP redirects are handled for transport requests.
+   * - `'follow'`: Follow redirects automatically (standard fetch behavior).
+   * - `'error'`: Reject any redirect response with an error.
+   * @default 'error'
+   */
+  redirect?: 'follow' | 'error';
+
+  /**
+   * Optional custom fetch implementation to use for HTTP requests.
+   * Useful for runtimes that need a request-local fetch.
+   * @default globalThis.fetch
+   */
+  fetch?: FetchFunction;
 };
 
 export function createMcpTransport(config: MCPTransportConfig): MCPTransport {

package/src/tool/oauth.ts

@@ -24,6 +24,7 @@ import {
 import {
   resourceUrlFromServerUrl,
   checkResourceAllowed,
+  resourceUrlStripSlash,
 } from '../util/oauth-util';
 import { LATEST_PROTOCOL_VERSION } from './types';
 import { FetchFunction } from '@ai-sdk/provider-utils';
@@ -83,6 +84,8 @@ export interface OAuthClientProvider {
     clientInformation: OAuthClientInformation,
   ): void | Promise<void>;
   state?(): string | Promise<string>;
+  saveState?(state: string): void | Promise<void>;
+  storedState?(): string | undefined | Promise<string | undefined>;
   validateResourceURL?(
     serverUrl: string | URL,
     resource?: string,
@@ -449,7 +452,10 @@ export async function startAuthorization(
   }
 
   if (resource) {
-    authorizationUrl.searchParams.set('resource', resource.href);
+    authorizationUrl.searchParams.set(
+      'resource',
+      resourceUrlStripSlash(resource),
+    );
   }
 
   return { authorizationUrl, codeVerifier };
@@ -673,7 +679,7 @@ export async function exchangeAuthorization(
   }
 
   if (resource) {
-    params.set('resource', resource.href);
+    params.set('resource', resourceUrlStripSlash(resource));
   }
 
   const response = await (fetchFn ?? fetch)(tokenUrl, {
@@ -760,7 +766,7 @@ export async function refreshAuthorization(
   }
 
   if (resource) {
-    params.set('resource', resource.href);
+    params.set('resource', resourceUrlStripSlash(resource));
   }
 
   const response = await (fetchFn ?? fetch)(tokenUrl, {
@@ -827,6 +833,7 @@ export async function auth(
   options: {
     serverUrl: string | URL;
     authorizationCode?: string;
+    callbackState?: string;
     scope?: string;
     resourceMetadataUrl?: URL;
     fetchFn?: FetchFunction;
@@ -886,12 +893,14 @@ async function authInternal(
   {
     serverUrl,
     authorizationCode,
+    callbackState,
     scope,
     resourceMetadataUrl,
     fetchFn,
   }: {
     serverUrl: string | URL;
     authorizationCode?: string;
+    callbackState?: string;
     scope?: string;
     resourceMetadataUrl?: URL;
     fetchFn?: FetchFunction;
@@ -960,6 +969,15 @@ async function authInternal(
 
   // Exchange authorization code for tokens
   if (authorizationCode !== undefined) {
+    if (provider.storedState) {
+      const expectedState = await provider.storedState();
+      if (expectedState !== undefined && expectedState !== callbackState) {
+        throw new Error(
+          'OAuth state parameter mismatch - possible CSRF attack',
+        );
+      }
+    }
+
     const codeVerifier = await provider.codeVerifier();
     const tokens = await exchangeAuthorization(authorizationServerUrl, {
       metadata,
@@ -1008,6 +1026,9 @@ async function authInternal(
   }
 
   const state = provider.state ? await provider.state() : undefined;
+  if (state && provider.saveState) {
+    await provider.saveState(state);
+  }
 
   // Start new authorization flow
   const { authorizationUrl, codeVerifier } = await startAuthorization(

package/src/util/oauth-util.ts

@@ -14,6 +14,19 @@ export function resourceUrlFromServerUrl(url: URL | string): URL {
   return resourceURL;
 }
 
+/**
+ * Serializes a resource URL to a string, removing the trailing slash that
+ * URL.href adds to pathless URLs. Per the MCP spec, implementations SHOULD
+ * use the form without the trailing slash for better interoperability.
+ */
+export function resourceUrlStripSlash(resource: URL): string {
+  const href = resource.href;
+  if (resource.pathname === '/' && href.endsWith('/')) {
+    return href.slice(0, -1);
+  }
+  return href;
+}
+
 /**
  * Checks if a requested resource URL matches a configured resource URL.
  * A requested resource matches if it has the same scheme, domain, port,