@ai-sdk/mcp 2.0.79 → 2.0.80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/mcp",
-  "version": "2.0.79",
+  "version": "2.0.80",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -31,8 +31,8 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/provider": "4.0.30",
-    "@ai-sdk/provider-utils": "5.0.63",
+    "@ai-sdk/provider": "4.0.31",
+    "@ai-sdk/provider-utils": "5.0.64",
     "cross-spawn": "^7.0.6",
     "pkce-challenge": "^5.0.1"
   },
@@ -41,6 +41,7 @@
     "@types/cross-spawn": "^6.0.6",
     "@types/node": "22.19.19",
     "@vercel/ai-tsconfig": "0.0.0",
+    "@vercel/ai-tsdown-config": "0.0.0",
     "tsdown": "^0.23.0",
     "typescript": "6.0.3",
     "vitest": "^4.1.11",

package/src/tool/oauth.ts

@@ -94,6 +94,11 @@ export interface OAuthClientProvider {
   ): void | Promise<void>;
   get redirectUrl(): string | URL;
   get clientMetadata(): OAuthClientMetadata;
+  /**
+   * Returns client credentials. Pre-registered confidential clients must specify
+   * their authorization server's `issuer` or provide stored authorization server
+   * information. `validateAuthorizationServerURL` does not replace this binding.
+   */
   clientInformation():
     | OAuthClientInformation
     | undefined
@@ -121,6 +126,7 @@ export interface OAuthClientProvider {
   /**
    * Validates an authorization server URL discovered from MCP protected resource
    * metadata before the client fetches its OAuth metadata.
+   * This additional restriction does not bind client credentials to that server.
    */
   validateAuthorizationServerURL?(
     serverUrl: string | URL,
@@ -1299,11 +1305,20 @@ export async function auth(
       await provider.invalidateCredentials?.('all');
       return await authInternal(provider, options);
     } else if (error instanceof InvalidGrantError && refreshAttempt.tokens) {
+      // Keep the binding validated before the refresh, even when deleting the
+      // rejected tokens removes the provider's only copy of that binding.
+      const retryAuthorizationServerInformation =
+        getAuthorizationServerInformationFromCredentials(refreshAttempt.tokens);
       // Only invalidate the tokens used by a failed refresh.
       await provider.invalidateCredentials?.('tokens', {
         tokens: refreshAttempt.tokens,
       });
-      return await authInternal(provider, options);
+      return await authInternal(
+        provider,
+        options,
+        undefined,
+        retryAuthorizationServerInformation,
+      );
     }
 
     throw error;
@@ -1361,6 +1376,7 @@ async function authInternal(
     fetchFn?: FetchFunction;
   },
   refreshAttempt?: { tokens?: OAuthTokens },
+  retryAuthorizationServerInformation?: OAuthAuthorizationServerInformation,
 ): Promise<AuthResult> {
   let resourceMetadata: OAuthProtectedResourceMetadata | undefined;
   let authorizationServerUrl: string | URL | undefined;
@@ -1451,6 +1467,12 @@ async function authInternal(
   );
   const currentAuthorizationServerInformation =
     createAuthorizationServerInformation(authorizationServerUrl, metadata);
+  if (retryAuthorizationServerInformation) {
+    assertAuthorizationServerInformationMatches({
+      storedAuthorizationServerInformation: retryAuthorizationServerInformation,
+      currentAuthorizationServerInformation,
+    });
+  }
   const clientMetadata = provider.clientMetadata;
   const selectedScope = selectScope({
     scope,
@@ -1462,19 +1484,58 @@ async function authInternal(
   if (authorizationCode === undefined) {
     clientInformation = await Promise.resolve(provider.clientInformation());
   }
-  if (clientInformation?.issuer != null) {
+  const tokens =
+    authorizationCode === undefined ? await provider.tokens() : undefined;
+  if (clientInformation) {
+    // A flow pin must never override the issuer attached to the credentials.
+    if (
+      clientInformation.issuer != null &&
+      clientInformation.issuer !== currentAuthorizationServerInformation.issuer
+    ) {
+      throw new AuthorizationServerMismatchError({
+        message:
+          'OAuth authorization server does not match the issuer of the client credentials',
+      });
+    }
+
+    const clientAuthorizationServerInformation =
+      getAuthorizationServerInformationFromCredentials(clientInformation);
+    if (clientAuthorizationServerInformation) {
+      assertAuthorizationServerInformationMatches({
+        storedAuthorizationServerInformation:
+          clientAuthorizationServerInformation,
+        currentAuthorizationServerInformation,
+      });
+    }
+
     const storedAuthorizationServerInformation =
       callbackAuthorizationServerInformation ??
       (await getStoredAuthorizationServerInformation({
         provider,
         clientInformation,
-      }));
+        tokens,
+      })) ??
+      retryAuthorizationServerInformation;
     if (storedAuthorizationServerInformation) {
       assertAuthorizationServerInformationMatches({
         storedAuthorizationServerInformation,
         currentAuthorizationServerInformation,
       });
     }
+
+    // Do not turn an MCP server's choice of AS into a trust binding for an
+    // existing secret. Dynamic registration below binds newly issued credentials.
+    if (
+      (clientInformation.client_secret != null ||
+        provider.addClientAuthentication) &&
+      clientInformation.issuer == null &&
+      !storedAuthorizationServerInformation
+    ) {
+      throw new AuthorizationServerMismatchError({
+        message:
+          'OAuth client credentials must be bound to an authorization server: configure their issuer or store authorization server information',
+      });
+    }
   }
 
   if (!clientInformation) {
@@ -1562,8 +1623,6 @@ async function authInternal(
     return 'AUTHORIZED';
   }
 
-  const tokens = await provider.tokens();
-
   /** Refresh only when stored credentials match the current AS pin */
   if (tokens?.refresh_token) {
     const storedAuthorizationServerInformation =