@ai-sdk/mcp 2.0.51 → 2.0.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/mcp",
-  "version": "2.0.51",
+  "version": "2.0.53",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -31,8 +31,8 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/provider": "4.0.16",
-    "@ai-sdk/provider-utils": "5.0.42",
+    "@ai-sdk/provider": "4.0.17",
+    "@ai-sdk/provider-utils": "5.0.44",
     "cross-spawn": "^7.0.6",
     "pkce-challenge": "^5.0.1"
   },

package/src/tool/mcp-sse-transport.ts

@@ -12,6 +12,7 @@ import {
   extractWWWAuthenticateParams,
   UnauthorizedError,
   auth,
+  type AuthResult,
   type OAuthClientProvider,
 } from './oauth';
 import { LATEST_LEGACY_PROTOCOL_VERSION } from './types';
@@ -33,6 +34,7 @@ export class SseMCPTransport implements MCPTransport {
   private resourceMetadataUrl?: URL;
   private redirectMode: RequestRedirect;
   private fetchFn: FetchFunction;
+  private authPromise?: Promise<AuthResult>;
 
   onclose?: () => void;
   onerror?: (error: unknown) => void;
@@ -87,6 +89,40 @@ export class SseMCPTransport implements MCPTransport {
     );
   }
 
+  /**
+   * Runs a single OAuth recovery flow for concurrent 401 responses.
+   */
+  private authorizeOnce(
+    resourceMetadataUrl?: URL,
+    scope?: string,
+  ): Promise<AuthResult> {
+    if (!this.authProvider) {
+      return Promise.resolve('REDIRECT');
+    }
+
+    if (!this.authPromise) {
+      this.authPromise = auth(this.authProvider, {
+        serverUrl: this.url,
+        resourceMetadataUrl,
+        scope,
+        fetchFn: this.fetchFn,
+      }).finally(() => {
+        this.authPromise = undefined;
+      });
+    }
+
+    return this.authPromise;
+  }
+
+  private async accessTokenChanged(
+    requestAuthorization: string | undefined,
+  ): Promise<boolean> {
+    const accessToken = (await this.authProvider?.tokens())?.access_token;
+    return (
+      accessToken != null && requestAuthorization !== `Bearer ${accessToken}`
+    );
+  }
+
   async start(): Promise<void> {
     return new Promise<void>((resolve, reject) => {
       if (this.connected) {
@@ -111,12 +147,10 @@ export class SseMCPTransport implements MCPTransport {
               extractWWWAuthenticateParams(response);
             this.resourceMetadataUrl = resourceMetadataUrl;
             try {
-              const result = await auth(this.authProvider, {
-                serverUrl: this.url,
-                resourceMetadataUrl: this.resourceMetadataUrl,
+              const result = await this.authorizeOnce(
+                this.resourceMetadataUrl,
                 scope,
-                fetchFn: this.fetchFn,
-              });
+              );
               if (result !== 'AUTHORIZED') {
                 const error = new UnauthorizedError();
                 this.onerror?.(error);
@@ -277,15 +311,21 @@ export class SseMCPTransport implements MCPTransport {
         const response = await this.fetchFn(endpoint.href, init);
 
         if (response.status === 401 && this.authProvider && !triedAuth) {
+          if (
+            await this.accessTokenChanged(
+              new Headers(headers).get('authorization') ?? undefined,
+            )
+          ) {
+            return attempt(true);
+          }
+
           const { resourceMetadataUrl, scope } =
             extractWWWAuthenticateParams(response);
           this.resourceMetadataUrl = resourceMetadataUrl;
-          const result = await auth(this.authProvider, {
-            serverUrl: this.url,
-            resourceMetadataUrl: this.resourceMetadataUrl,
+          const result = await this.authorizeOnce(
+            this.resourceMetadataUrl,
             scope,
-            fetchFn: this.fetchFn,
-          });
+          );
           if (result !== 'AUTHORIZED') {
             throw new UnauthorizedError();
           }