@ai-sdk/mcp 2.0.31 → 2.0.33

package/src/tool/oauth.ts

@@ -31,6 +31,7 @@ import { parseJSON, type FetchFunction } from '@ai-sdk/provider-utils';
 export type AuthResult = 'AUTHORIZED' | 'REDIRECT';
 
 export interface OAuthAuthorizationServerInformation {
+  issuer?: string;
   authorizationServerUrl: string;
   tokenEndpoint: string;
 }
@@ -122,11 +123,26 @@ function normalizeUrl(url: string | URL): string {
   return new URL(url).href;
 }
 
+function validateAuthorizationResponseIssuer({
+  callbackIssuer,
+  expectedIssuer,
+}: {
+  callbackIssuer: string | undefined;
+  expectedIssuer: string;
+}): void {
+  if (callbackIssuer != null && callbackIssuer !== expectedIssuer) {
+    throw new MCPClientOAuthError({
+      message: `OAuth authorization response issuer ${callbackIssuer} does not match expected issuer ${expectedIssuer}`,
+    });
+  }
+}
+
 function createAuthorizationServerInformation(
   authorizationServerUrl: string | URL,
   metadata?: AuthorizationServerMetadata,
 ): OAuthAuthorizationServerInformation {
   return {
+    issuer: metadata?.issuer ?? String(authorizationServerUrl),
     authorizationServerUrl: normalizeUrl(authorizationServerUrl),
     tokenEndpoint: normalizeUrl(
       metadata?.token_endpoint
@@ -142,6 +158,7 @@ function addAuthorizationServerInformationToTokens(
 ): OAuthTokens {
   return {
     ...tokens,
+    issuer: authorizationServerInformation.issuer,
     authorization_server: authorizationServerInformation.authorizationServerUrl,
     token_endpoint: authorizationServerInformation.tokenEndpoint,
   };
@@ -155,12 +172,14 @@ function addAuthorizationServerInformationToClientInformation<
 ): CLIENT_INFORMATION {
   return {
     ...clientInformation,
+    issuer: authorizationServerInformation.issuer,
     authorization_server: authorizationServerInformation.authorizationServerUrl,
     token_endpoint: authorizationServerInformation.tokenEndpoint,
   };
 }
 
 function getAuthorizationServerInformationFromCredentials(credentials?: {
+  issuer?: string;
   authorization_server?: string;
   token_endpoint?: string;
 }): OAuthAuthorizationServerInformation | undefined {
@@ -169,6 +188,7 @@ function getAuthorizationServerInformationFromCredentials(credentials?: {
   }
 
   return {
+    issuer: credentials.issuer,
     authorizationServerUrl: normalizeUrl(credentials.authorization_server),
     tokenEndpoint: normalizeUrl(credentials.token_endpoint),
   };
@@ -193,6 +213,7 @@ async function getStoredAuthorizationServerInformation({
     await provider.authorizationServerInformation?.();
   if (providerAuthorizationServerInformation) {
     return {
+      issuer: providerAuthorizationServerInformation.issuer,
       authorizationServerUrl: normalizeUrl(
         providerAuthorizationServerInformation.authorizationServerUrl,
       ),
@@ -258,6 +279,10 @@ function assertAuthorizationServerInformationMatches({
   currentAuthorizationServerInformation: OAuthAuthorizationServerInformation;
 }): void {
   if (
+    (storedAuthorizationServerInformation.issuer != null &&
+      currentAuthorizationServerInformation.issuer != null &&
+      storedAuthorizationServerInformation.issuer !==
+        currentAuthorizationServerInformation.issuer) ||
     storedAuthorizationServerInformation.authorizationServerUrl !==
       currentAuthorizationServerInformation.authorizationServerUrl ||
     storedAuthorizationServerInformation.tokenEndpoint !==
@@ -270,37 +295,65 @@ function assertAuthorizationServerInformationMatches({
   }
 }
 
-/**
- * Extracts the OAuth 2.0 Protected Resource Metadata URL from a WWW-Authenticate header (RFC9728).
- * Looks for a resource="..." parameter.
- */
-export function extractResourceMetadataUrl(
-  response: Response,
-): URL | undefined {
+export function extractWWWAuthenticateParams(response: Response): {
+  resourceMetadataUrl?: URL;
+  scope?: string;
+} {
   const header =
     response.headers.get('www-authenticate') ??
     response.headers.get('WWW-Authenticate');
   if (!header) {
-    return undefined;
+    return {};
   }
 
   const [type, scheme] = header.split(' ');
   if (type.toLowerCase() !== 'bearer' || !scheme) {
-    return undefined;
+    return {};
   }
 
-  // regex taken from MCP spec
-  const regex = /resource_metadata="([^"]*)"/;
-  const match = header.match(regex);
-  if (!match) {
-    return undefined;
-  }
+  const resourceMetadataMatch = header.match(
+    /(?:^|[,\s])resource_metadata="([^"]*)"/i,
+  );
+  const scope = header.match(/(?:^|[,\s])scope="([^"]*)"/i)?.[1];
 
+  let resourceMetadataUrl: URL | undefined;
   try {
-    return new URL(match[1]);
-  } catch {
-    return undefined;
+    resourceMetadataUrl = resourceMetadataMatch
+      ? new URL(resourceMetadataMatch[1])
+      : undefined;
+  } catch {}
+
+  return { resourceMetadataUrl, scope };
+}
+
+/**
+ * Extracts the OAuth 2.0 Protected Resource Metadata URL from a WWW-Authenticate header (RFC9728).
+ */
+export function extractResourceMetadataUrl(
+  response: Response,
+): URL | undefined {
+  return extractWWWAuthenticateParams(response).resourceMetadataUrl;
+}
+
+function selectScope({
+  scope,
+  resourceMetadata,
+  clientMetadata,
+}: {
+  scope?: string;
+  resourceMetadata?: OAuthProtectedResourceMetadata;
+  clientMetadata: OAuthClientMetadata;
+}): string | undefined {
+  if (scope) {
+    return scope;
+  }
+
+  const resourceScopes = resourceMetadata?.scopes_supported?.join(' ');
+  if (resourceScopes) {
+    return resourceScopes;
   }
+
+  return clientMetadata.scope;
 }
 
 /**
@@ -1022,12 +1075,18 @@ export async function registerClient(
     registrationUrl = new URL('/register', authorizationServerUrl);
   }
 
+  const applicationType =
+    clientMetadata.application_type ??
+    inferOAuthApplicationType(clientMetadata.redirect_uris);
   const response = await (fetchFn ?? fetch)(registrationUrl, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
     },
-    body: JSON.stringify(clientMetadata),
+    body: JSON.stringify({
+      ...clientMetadata,
+      application_type: applicationType,
+    }),
   });
 
   if (!response.ok) {
@@ -1037,12 +1096,32 @@ export async function registerClient(
   return OAuthClientInformationFullSchema.parse(await response.json());
 }
 
+function inferOAuthApplicationType(redirectUris: string[]): 'native' | 'web' {
+  const isNativeRedirectUri = (redirectUri: string): boolean => {
+    const url = new URL(redirectUri);
+    return (
+      ((url.protocol === 'http:' || url.protocol === 'https:') &&
+        (url.hostname === 'localhost' ||
+          url.hostname.endsWith('.localhost') ||
+          url.hostname === '127.0.0.1' ||
+          url.hostname === '[::1]')) ||
+      (url.protocol !== 'http:' && url.protocol !== 'https:')
+    );
+  };
+
+  return redirectUris.every(isNativeRedirectUri) ? 'native' : 'web';
+}
+
 export async function auth(
   provider: OAuthClientProvider,
   options: {
     serverUrl: string | URL;
     authorizationCode?: string;
     callbackState?: string;
+    /**
+     * Value of the `iss` parameter from the authorization response.
+     */
+    callbackIssuer?: string;
     scope?: string;
     resourceMetadataUrl?: URL;
     fetchFn?: FetchFunction;
@@ -1103,6 +1182,7 @@ async function authInternal(
     serverUrl,
     authorizationCode,
     callbackState,
+    callbackIssuer,
     scope,
     resourceMetadataUrl,
     fetchFn,
@@ -1110,6 +1190,7 @@ async function authInternal(
     serverUrl: string | URL;
     authorizationCode?: string;
     callbackState?: string;
+    callbackIssuer?: string;
     scope?: string;
     resourceMetadataUrl?: URL;
     fetchFn?: FetchFunction;
@@ -1166,6 +1247,20 @@ async function authInternal(
 
   /** Load or register client credentials with the AS pin attached. */
   let clientInformation = await Promise.resolve(provider.clientInformation());
+  if (clientInformation?.issuer != null) {
+    const storedAuthorizationServerInformation =
+      await getStoredAuthorizationServerInformation({
+        provider,
+        clientInformation,
+      });
+    if (storedAuthorizationServerInformation) {
+      assertAuthorizationServerInformationMatches({
+        storedAuthorizationServerInformation,
+        currentAuthorizationServerInformation,
+      });
+    }
+  }
+
   if (!clientInformation) {
     if (authorizationCode !== undefined) {
       throw new Error(
@@ -1214,6 +1309,13 @@ async function authInternal(
           'Stored OAuth authorization server metadata is required when exchanging an authorization code',
       });
     }
+    validateAuthorizationResponseIssuer({
+      callbackIssuer,
+      expectedIssuer:
+        storedAuthorizationServerInformation.issuer ??
+        metadata?.issuer ??
+        String(authorizationServerUrl),
+    });
     assertAuthorizationServerInformationMatches({
       storedAuthorizationServerInformation,
       currentAuthorizationServerInformation,
@@ -1308,7 +1410,11 @@ async function authInternal(
       clientInformation,
       state,
       redirectUrl: provider.redirectUrl,
-      scope: scope || provider.clientMetadata.scope,
+      scope: selectScope({
+        scope,
+        resourceMetadata,
+        clientMetadata: provider.clientMetadata,
+      }),
       resource,
     },
   );

package/src/tool/types.ts

@@ -2,9 +2,11 @@ import { z } from 'zod/v4';
 import type { JSONObject } from '@ai-sdk/provider';
 import type { FlexibleSchema, Tool } from '@ai-sdk/provider-utils';
 
-export const LATEST_PROTOCOL_VERSION = '2025-11-25';
+export const LATEST_PROTOCOL_VERSION = '2026-07-28';
+export const LATEST_LEGACY_PROTOCOL_VERSION = '2025-11-25';
 export const SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
+  LATEST_LEGACY_PROTOCOL_VERSION,
   '2025-06-18',
   '2025-03-26',
   '2024-11-05',
@@ -73,7 +75,9 @@ export const BaseParamsSchema = z.looseObject({
   _meta: z.optional(z.object({}).loose()),
 });
 type BaseParams = z.infer<typeof BaseParamsSchema>;
-export const ResultSchema = BaseParamsSchema;
+export const ResultSchema = BaseParamsSchema.extend({
+  resultType: z.optional(z.string()),
+});
 
 export const RequestSchema = z.object({
   method: z.string(),
@@ -128,6 +132,15 @@ export const ClientCapabilitiesSchema = z
 export type ClientCapabilities = z.infer<typeof ClientCapabilitiesSchema>;
 export type ElicitationCapability = z.infer<typeof ElicitationCapabilitySchema>;
 
+export const DiscoverResultSchema = ResultSchema.extend({
+  supportedVersions: z.array(z.string()),
+  capabilities: ServerCapabilitiesSchema,
+  instructions: z.optional(z.string()),
+  ttlMs: z.optional(z.number()),
+  cacheScope: z.optional(z.union([z.literal('public'), z.literal('private')])),
+});
+export type DiscoverResult = z.infer<typeof DiscoverResultSchema>;
+
 export const InitializeResultSchema = ResultSchema.extend({
   protocolVersion: z.string(),
   capabilities: ServerCapabilitiesSchema,
@@ -154,12 +167,10 @@ const ToolSchema = z
      */
     title: z.optional(z.string()),
     description: z.optional(z.string()),
-    inputSchema: z
-      .object({
-        type: z.literal('object'),
-        properties: z.optional(z.object({}).loose()),
-      })
-      .loose(),
+    inputSchema: z.looseObject({
+      type: z.optional(z.unknown()),
+      properties: z.optional(z.object({}).loose()),
+    }),
     /**
      * @see https://modelcontextprotocol.io/specification/2025-06-18/server/tools#output-schema
      */