@ai-sdk/mcp 2.0.37 → 2.0.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/mcp",
-  "version": "2.0.37",
+  "version": "2.0.40",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@ai-sdk/provider": "4.0.8",
-    "@ai-sdk/provider-utils": "5.0.30",
+    "@ai-sdk/provider-utils": "5.0.33",
     "cross-spawn": "^7.0.6",
     "pkce-challenge": "^5.0.1"
   },
@@ -72,7 +72,7 @@
   "scripts": {
     "build": "pnpm clean && tsup --tsconfig tsconfig.build.json",
     "build:watch": "pnpm clean && tsup --watch",
-    "clean": "rm -rf dist *.tsbuildinfo",
+    "clean": "del-cli dist *.tsbuildinfo",
     "type-check": "tsc --build",
     "test": "pnpm test:node && pnpm test:edge",
     "test:update": "pnpm test:node -u",

package/src/tool/oauth.ts

@@ -27,7 +27,11 @@ import {
   resourceUrlStripSlash,
 } from '../util/oauth-util';
 import { LATEST_PROTOCOL_VERSION } from './types';
-import { parseJSON, type FetchFunction } from '@ai-sdk/provider-utils';
+import {
+  parseJSON,
+  validateDownloadUrl,
+  type FetchFunction,
+} from '@ai-sdk/provider-utils';
 export type AuthResult = 'AUTHORIZED' | 'REDIRECT';
 
 export interface OAuthAuthorizationServerInformation {
@@ -123,6 +127,45 @@ function normalizeUrl(url: string | URL): string {
   return new URL(url).href;
 }
 
+/** Allow loopback HTTP(S) for local MCP OAuth (RFC 8252 §7.3, RFC 6761 §6.3). */
+function isOAuthLoopbackHost(hostname: string): boolean {
+  const normalized = hostname.toLowerCase().replace(/\.+$/, '');
+  return (
+    normalized === 'localhost' ||
+    normalized.endsWith('.localhost') ||
+    normalized === '127.0.0.1' ||
+    normalized === '[::1]' ||
+    normalized === '::1'
+  );
+}
+
+/**
+ * Guards metadata-derived token/registration URLs before credentials are sent.
+ * Loopback is allowed for local OAuth; every other target uses the shared
+ * download URL guard (http(s) only, no private/link-local IPs).
+ *
+ * Credential POSTs use `redirect: 'error'` instead of
+ * `fetchWithValidatedRedirects`, which is GET-only and would follow hops with
+ * the authorization code, PKCE verifier, and client secret still attached.
+ */
+function assertSafeOAuthEndpoint(endpointUrl: URL): void {
+  if (
+    (endpointUrl.protocol === 'http:' || endpointUrl.protocol === 'https:') &&
+    isOAuthLoopbackHost(endpointUrl.hostname)
+  ) {
+    return;
+  }
+
+  try {
+    validateDownloadUrl(endpointUrl.href);
+  } catch (error) {
+    throw new MCPClientOAuthError({
+      message: `OAuth endpoint URL is not allowed: ${endpointUrl.href}`,
+      cause: error,
+    });
+  }
+}
+
 function validateAuthorizationResponseIssuer({
   callbackIssuer,
   expectedIssuer,
@@ -896,6 +939,7 @@ export async function exchangeAuthorization(
   const tokenUrl = metadata?.token_endpoint
     ? new URL(metadata.token_endpoint)
     : new URL('/token', authorizationServerUrl);
+  assertSafeOAuthEndpoint(tokenUrl);
 
   if (
     metadata?.grant_types_supported &&
@@ -943,6 +987,7 @@ export async function exchangeAuthorization(
     method: 'POST',
     headers,
     body: params,
+    redirect: 'error',
   });
 
   if (!response.ok) {
@@ -999,6 +1044,7 @@ export async function refreshAuthorization(
   } else {
     tokenUrl = new URL('/token', authorizationServerUrl);
   }
+  assertSafeOAuthEndpoint(tokenUrl);
 
   const headers = new Headers({
     'Content-Type': 'application/x-www-form-urlencoded',
@@ -1035,6 +1081,7 @@ export async function refreshAuthorization(
     method: 'POST',
     headers,
     body: params,
+    redirect: 'error',
   });
   if (!response.ok) {
     throw await parseErrorResponse(response);
@@ -1074,6 +1121,7 @@ export async function registerClient(
   } else {
     registrationUrl = new URL('/register', authorizationServerUrl);
   }
+  assertSafeOAuthEndpoint(registrationUrl);
 
   const applicationType =
     clientMetadata.application_type ??
@@ -1087,6 +1135,7 @@ export async function registerClient(
       ...clientMetadata,
       application_type: applicationType,
     }),
+    redirect: 'error',
   });
 
   if (!response.ok) {
@@ -1101,10 +1150,7 @@ function inferOAuthApplicationType(redirectUris: string[]): 'native' | 'web' {
     const url = new URL(redirectUri);
     return (
       ((url.protocol === 'http:' || url.protocol === 'https:') &&
-        (url.hostname === 'localhost' ||
-          url.hostname.endsWith('.localhost') ||
-          url.hostname === '127.0.0.1' ||
-          url.hostname === '[::1]')) ||
+        isOAuthLoopbackHost(url.hostname)) ||
       (url.protocol !== 'http:' && url.protocol !== 'https:')
     );
   };
@@ -1244,6 +1290,12 @@ async function authInternal(
   );
   const currentAuthorizationServerInformation =
     createAuthorizationServerInformation(authorizationServerUrl, metadata);
+  const clientMetadata = provider.clientMetadata;
+  const selectedScope = selectScope({
+    scope,
+    resourceMetadata,
+    clientMetadata,
+  });
 
   /** Load or register client credentials with the AS pin attached. */
   let clientInformation = await Promise.resolve(provider.clientInformation());
@@ -1276,7 +1328,10 @@ async function authInternal(
 
     const fullInformation = await registerClient(authorizationServerUrl, {
       metadata,
-      clientMetadata: provider.clientMetadata,
+      clientMetadata: {
+        ...clientMetadata,
+        scope: selectedScope,
+      },
       fetchFn,
     });
 
@@ -1410,11 +1465,7 @@ async function authInternal(
       clientInformation,
       state,
       redirectUrl: provider.redirectUrl,
-      scope: selectScope({
-        scope,
-        resourceMetadata,
-        clientMetadata: provider.clientMetadata,
-      }),
+      scope: selectedScope,
       resource,
     },
   );