@aiwerk/mcp-bridge 1.9.0 → 2.1.0

package/dist/bin/mcp-bridge.js

@@ -267,7 +267,7 @@ async function cmdServe(args, logger) {
         process.exit(1);
     }
     // HTTP modes: require auth
-    if ((args.sse || args.http) && !config.http?.auth?.token) {
+    if ((args.sse || args.http) && !config.http?.auth) {
         logger.error("HTTP auth not configured. Set http.auth in config or use stdio mode.");
         process.exit(1);
     }

package/dist/src/index.d.ts

@@ -1,7 +1,9 @@
-export { BaseTransport, resolveEnvVars, resolveEnvRecord, resolveArgs, warnIfNonTlsRemoteUrl } from "./transport-base.js";
+export { BaseTransport, resolveEnvVars, resolveEnvRecord, resolveArgs, resolveAuthHeaders, resolveAuthHeadersAsync, resolveOAuth2Config, resolveServerHeaders, resolveServerHeadersAsync, warnIfNonTlsRemoteUrl, } from "./transport-base.js";
 export { StdioTransport } from "./transport-stdio.js";
 export { SseTransport } from "./transport-sse.js";
 export { StreamableHttpTransport } from "./transport-streamable-http.js";
+export { OAuth2TokenManager } from "./oauth2-token-manager.js";
+export type { OAuth2Config } from "./oauth2-token-manager.js";
 export { McpRouter } from "./mcp-router.js";
 export type { RouterToolHint, RouterServerStatus, RouterDispatchResponse, RouterTransportRefs } from "./mcp-router.js";
 export { ResultCache, createResultCacheKey, stableStringify } from "./result-cache.js";
@@ -11,7 +13,7 @@ export type { ToolResolutionResult, ToolResolutionCandidate } from "./tool-resol
 export { convertJsonSchemaToTypeBox, createToolParameters, setTypeBoxLoader, setSchemaLogger } from "./schema-convert.js";
 export { initializeProtocol, fetchToolsList, PACKAGE_VERSION } from "./protocol.js";
 export { loadConfig, parseEnvFile, initConfigDir, getConfigDir } from "./config.js";
-export type { Logger, McpServerConfig, McpClientConfig, McpTool, McpRequest, McpCallRequest, McpResponse, JsonRpcMessage, McpTransport, McpServerConnection, BridgeConfig, } from "./types.js";
+export type { Logger, McpServerConfig, McpClientConfig, HttpAuthConfig, RetryConfig, McpTool, McpRequest, McpCallRequest, McpResponse, JsonRpcMessage, McpTransport, McpServerConnection, BridgeConfig, } from "./types.js";
 export { nextRequestId } from "./types.js";
 export { pickRegisteredToolName } from "./tool-naming.js";
 export { StandaloneServer } from "./standalone-server.js";

package/dist/src/index.js

@@ -1,9 +1,10 @@
 // Core exports for @aiwerk/mcp-bridge
 // Transport classes
-export { BaseTransport, resolveEnvVars, resolveEnvRecord, resolveArgs, warnIfNonTlsRemoteUrl } from "./transport-base.js";
+export { BaseTransport, resolveEnvVars, resolveEnvRecord, resolveArgs, resolveAuthHeaders, resolveAuthHeadersAsync, resolveOAuth2Config, resolveServerHeaders, resolveServerHeadersAsync, warnIfNonTlsRemoteUrl, } from "./transport-base.js";
 export { StdioTransport } from "./transport-stdio.js";
 export { SseTransport } from "./transport-sse.js";
 export { StreamableHttpTransport } from "./transport-streamable-http.js";
+export { OAuth2TokenManager } from "./oauth2-token-manager.js";
 // Router
 export { McpRouter } from "./mcp-router.js";
 // Result cache

package/dist/src/mcp-router.d.ts

@@ -1,4 +1,5 @@
 import { McpClientConfig, McpServerConfig, McpTransport, Logger } from "./types.js";
+import { OAuth2TokenManager } from "./oauth2-token-manager.js";
 type RouterErrorCode = "unknown_server" | "unknown_tool" | "connection_failed" | "mcp_error" | "invalid_params";
 interface RouterBatchResult {
     server: string;
@@ -37,6 +38,7 @@ export type RouterDispatchResponse = {
     action: "call";
     tool: string;
     result: any;
+    retries?: number;
 } | {
     server: string;
     action: "schema";
@@ -91,9 +93,9 @@ export type RouterDispatchResponse = {
     code?: number;
 };
 export interface RouterTransportRefs {
-    sse: new (config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>) => McpTransport;
+    sse: new (config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>, tokenManager?: OAuth2TokenManager) => McpTransport;
     stdio: new (config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>) => McpTransport;
-    streamableHttp: new (config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>) => McpTransport;
+    streamableHttp: new (config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>, tokenManager?: OAuth2TokenManager) => McpTransport;
 }
 export declare class McpRouter {
     private readonly servers;
@@ -106,6 +108,7 @@ export declare class McpRouter {
     private readonly maxBatchSize;
     private readonly states;
     private readonly toolResolver;
+    private readonly tokenManager;
     private intentRouter;
     private promotion;
     constructor(servers: Record<string, McpServerConfig>, clientConfig: McpClientConfig, logger: Logger, transportRefs?: Partial<RouterTransportRefs>);
@@ -122,7 +125,11 @@ export declare class McpRouter {
         inputSchema: any;
     }>;
     private getPromotionStats;
+    private getRetryPolicy;
+    private classifyTransientError;
+    private callToolWithRetry;
     disconnectAll(): Promise<void>;
+    shutdown(timeoutMs?: number): Promise<void>;
     private ensureConnected;
     private enforceMaxConcurrent;
     private disconnectServer;

package/dist/src/mcp-router.js

@@ -9,9 +9,11 @@ import { isToolAllowed, processResult } from "./security.js";
 import { AdaptivePromotion } from "./adaptive-promotion.js";
 import { ResultCache, createResultCacheKey } from "./result-cache.js";
 import { ToolResolver } from "./tool-resolution.js";
+import { OAuth2TokenManager } from "./oauth2-token-manager.js";
 const DEFAULT_IDLE_TIMEOUT_MS = 10 * 60 * 1000;
 const DEFAULT_MAX_CONCURRENT = 5;
 const DEFAULT_MAX_BATCH_SIZE = 10;
+const DEFAULT_SHUTDOWN_TIMEOUT_MS = 5000;
 export class McpRouter {
     servers;
     clientConfig;
@@ -23,6 +25,7 @@ export class McpRouter {
     maxBatchSize;
     states = new Map();
     toolResolver;
+    tokenManager;
     intentRouter = null;
     promotion = null;
     constructor(servers, clientConfig, logger, transportRefs) {
@@ -45,6 +48,7 @@ export class McpRouter {
             : null;
         this.maxBatchSize = clientConfig.maxBatchSize ?? DEFAULT_MAX_BATCH_SIZE;
         this.toolResolver = new ToolResolver(Object.keys(servers));
+        this.tokenManager = new OAuth2TokenManager(logger);
         if (clientConfig.adaptivePromotion?.enabled) {
             this.promotion = new AdaptivePromotion(clientConfig.adaptivePromotion, logger);
         }
@@ -227,14 +231,8 @@ export class McpRouter {
                 }
             }
             this.markUsed(server);
-            const response = await state.transport.sendRequest({
-                jsonrpc: "2.0",
-                method: "tools/call",
-                params: {
-                    name: tool,
-                    arguments: params ?? {}
-                }
-            });
+            const callOutcome = await this.callToolWithRetry(server, tool, params ?? {}, state.transport);
+            const response = callOutcome.response;
             if (response.error) {
                 return this.error("mcp_error", response.error.message, undefined, response.error.code);
             }
@@ -248,7 +246,13 @@ export class McpRouter {
             if (this.resultCache && cacheKey) {
                 this.resultCache.set(cacheKey, result);
             }
-            return { server, action: "call", tool, result };
+            return {
+                server,
+                action: "call",
+                tool,
+                result,
+                ...(callOutcome.retries > 0 ? { retries: callOutcome.retries } : {})
+            };
         }
         catch (error) {
             return this.error("mcp_error", error instanceof Error ? error.message : String(error));
@@ -390,11 +394,104 @@ export class McpRouter {
         }));
         return { action: "promotions", promoted, stats };
     }
+    getRetryPolicy(server) {
+        const globalRetry = this.clientConfig.retry ?? {};
+        const serverRetry = this.servers[server].retry ?? {};
+        const maxAttemptsRaw = serverRetry.maxAttempts ?? globalRetry.maxAttempts ?? 1;
+        const delayMsRaw = serverRetry.delayMs ?? globalRetry.delayMs ?? 1000;
+        const backoffMultiplierRaw = serverRetry.backoffMultiplier ?? globalRetry.backoffMultiplier ?? 2;
+        const retryOn = serverRetry.retryOn ?? globalRetry.retryOn ?? ["timeout", "connection_error"];
+        return {
+            maxAttempts: Math.max(1, Math.floor(maxAttemptsRaw)),
+            delayMs: Math.max(0, Math.floor(delayMsRaw)),
+            backoffMultiplier: Math.max(1, backoffMultiplierRaw),
+            retryOn: new Set(retryOn)
+        };
+    }
+    classifyTransientError(error) {
+        const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+        if (message.includes("timeout") ||
+            message.includes("timed out") ||
+            message.includes("abort")) {
+            return "timeout";
+        }
+        if (message.includes("connection") ||
+            message.includes("econnreset") ||
+            message.includes("socket hang up") ||
+            message.includes("network") ||
+            message.includes("fetch failed") ||
+            message.includes("econnrefused") ||
+            message.includes("enotfound")) {
+            return "connection_error";
+        }
+        return null;
+    }
+    async callToolWithRetry(server, tool, args, transport) {
+        const retryPolicy = this.getRetryPolicy(server);
+        let retries = 0;
+        let lastError;
+        for (let attempt = 0; attempt < retryPolicy.maxAttempts; attempt++) {
+            try {
+                const response = await transport.sendRequest({
+                    jsonrpc: "2.0",
+                    method: "tools/call",
+                    params: {
+                        name: tool,
+                        arguments: args
+                    }
+                });
+                return { response, retries };
+            }
+            catch (error) {
+                lastError = error;
+                const category = this.classifyTransientError(error);
+                const shouldRetry = category !== null &&
+                    retryPolicy.retryOn.has(category) &&
+                    attempt < retryPolicy.maxAttempts - 1;
+                if (!shouldRetry) {
+                    throw error;
+                }
+                retries += 1;
+                const delay = retryPolicy.delayMs * Math.pow(retryPolicy.backoffMultiplier, attempt);
+                if (delay > 0) {
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+                }
+            }
+        }
+        throw lastError instanceof Error ? lastError : new Error(String(lastError));
+    }
     async disconnectAll() {
         for (const serverName of Object.keys(this.servers)) {
             await this.disconnectServer(serverName);
         }
     }
+    async shutdown(timeoutMs = this.clientConfig.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS) {
+        const effectiveTimeout = Math.max(0, timeoutMs);
+        for (const [serverName, state] of this.states) {
+            if (state.idleTimer) {
+                clearTimeout(state.idleTimer);
+                state.idleTimer = null;
+            }
+            try {
+                if (state.transport.shutdown) {
+                    await state.transport.shutdown(effectiveTimeout);
+                }
+                else {
+                    await state.transport.disconnect();
+                }
+            }
+            catch (error) {
+                this.logger.warn(`[mcp-bridge] Router shutdown: failed to close ${serverName}:`, error);
+            }
+        }
+        this.states.clear();
+        this.toolResolver.clear();
+        if (this.intentRouter) {
+            this.intentRouter.clearIndex();
+        }
+        this.resultCache?.invalidate();
+        this.tokenManager.clear();
+    }
     async ensureConnected(server) {
         let state = this.states.get(server);
         if (!state) {
@@ -497,13 +594,13 @@ export class McpRouter {
             this.resultCache?.invalidate(`${serverName}:`);
         };
         if (serverConfig.transport === "sse") {
-            return new this.transportRefs.sse(serverConfig, this.clientConfig, this.logger, onReconnected);
+            return new this.transportRefs.sse(serverConfig, this.clientConfig, this.logger, onReconnected, this.tokenManager);
         }
         if (serverConfig.transport === "stdio") {
             return new this.transportRefs.stdio(serverConfig, this.clientConfig, this.logger, onReconnected);
         }
         if (serverConfig.transport === "streamable-http") {
-            return new this.transportRefs.streamableHttp(serverConfig, this.clientConfig, this.logger, onReconnected);
+            return new this.transportRefs.streamableHttp(serverConfig, this.clientConfig, this.logger, onReconnected, this.tokenManager);
         }
         throw new Error(`Unsupported transport: ${serverConfig.transport}`);
     }

package/dist/src/oauth2-token-manager.d.ts

@@ -0,0 +1,20 @@
+import type { Logger } from "./types.js";
+export interface OAuth2Config {
+    clientId: string;
+    clientSecret: string;
+    tokenUrl: string;
+    scopes?: string[];
+    audience?: string;
+}
+export declare class OAuth2TokenManager {
+    private readonly logger;
+    private readonly tokenCache;
+    private readonly inflight;
+    constructor(logger: Logger);
+    getToken(config: OAuth2Config): Promise<string>;
+    invalidate(tokenUrl: string, clientId: string): void;
+    clear(): void;
+    private makeKey;
+    private fetchToken;
+    private exchangeToken;
+}

package/dist/src/oauth2-token-manager.js

@@ -0,0 +1,98 @@
+const DEFAULT_EXPIRES_IN_SECONDS = 3600;
+const EXPIRY_BUFFER_SECONDS = 60;
+export class OAuth2TokenManager {
+    logger;
+    tokenCache = new Map();
+    inflight = new Map();
+    constructor(logger) {
+        this.logger = logger;
+    }
+    async getToken(config) {
+        const key = this.makeKey(config.tokenUrl, config.clientId);
+        const now = Date.now();
+        const cached = this.tokenCache.get(key);
+        if (cached && cached.expiresAt > now) {
+            return cached.accessToken;
+        }
+        const existingInflight = this.inflight.get(key);
+        if (existingInflight) {
+            return existingInflight;
+        }
+        const requestPromise = this.fetchToken(config, cached)
+            .then((token) => {
+            this.tokenCache.set(key, token);
+            return token.accessToken;
+        })
+            .finally(() => {
+            this.inflight.delete(key);
+        });
+        this.inflight.set(key, requestPromise);
+        return requestPromise;
+    }
+    invalidate(tokenUrl, clientId) {
+        const key = this.makeKey(tokenUrl, clientId);
+        this.tokenCache.delete(key);
+        this.inflight.delete(key);
+    }
+    clear() {
+        this.tokenCache.clear();
+        this.inflight.clear();
+    }
+    makeKey(tokenUrl, clientId) {
+        return `${tokenUrl}::${clientId}`;
+    }
+    async fetchToken(config, cached) {
+        if (cached?.refreshToken) {
+            try {
+                return await this.exchangeToken(config, {
+                    grant_type: "refresh_token",
+                    refresh_token: cached.refreshToken,
+                });
+            }
+            catch (error) {
+                this.logger.warn("[mcp-bridge] OAuth2 refresh token exchange failed, falling back to client_credentials:", error);
+            }
+        }
+        return this.exchangeToken(config, {
+            grant_type: "client_credentials",
+        });
+    }
+    async exchangeToken(config, grant) {
+        const formData = new URLSearchParams();
+        formData.set("grant_type", grant.grant_type);
+        formData.set("client_id", config.clientId);
+        formData.set("client_secret", config.clientSecret);
+        if (grant.grant_type === "refresh_token") {
+            formData.set("refresh_token", grant.refresh_token);
+        }
+        if (config.scopes?.length) {
+            formData.set("scope", config.scopes.join(" "));
+        }
+        if (config.audience) {
+            formData.set("audience", config.audience);
+        }
+        const response = await fetch(config.tokenUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body: formData.toString(),
+        });
+        if (!response.ok) {
+            throw new Error(`OAuth2 token exchange failed: HTTP ${response.status}`);
+        }
+        const payload = (await response.json());
+        if (!payload.access_token) {
+            throw new Error("OAuth2 token exchange response missing access_token");
+        }
+        const expiresIn = Number.isFinite(payload.expires_in)
+            ? Number(payload.expires_in)
+            : DEFAULT_EXPIRES_IN_SECONDS;
+        const expiresAt = Date.now() + Math.max(0, expiresIn - EXPIRY_BUFFER_SECONDS) * 1000;
+        return {
+            accessToken: payload.access_token,
+            expiresAt,
+            refreshToken: payload.refresh_token,
+        };
+    }
+}

package/dist/src/standalone-server.d.ts

@@ -10,6 +10,7 @@ export declare class StandaloneServer {
     private router;
     private initialized;
     private lspMode;
+    private readonly tokenManager;
     private directTools;
     private directConnections;
     constructor(config: BridgeConfig, logger: Logger);

package/dist/src/standalone-server.js

@@ -4,6 +4,7 @@ import { pickRegisteredToolName } from "./tool-naming.js";
 import { SseTransport } from "./transport-sse.js";
 import { StdioTransport } from "./transport-stdio.js";
 import { StreamableHttpTransport } from "./transport-streamable-http.js";
+import { OAuth2TokenManager } from "./oauth2-token-manager.js";
 /**
  * Standalone MCP server that wraps the router.
  * Implements the MCP protocol (initialize, tools/list, tools/call)
@@ -15,12 +16,14 @@ export class StandaloneServer {
     router = null;
     initialized = false;
     lspMode = false;
+    tokenManager;
     // Direct mode state
     directTools = [];
     directConnections = new Map();
     constructor(config, logger) {
         this.config = config;
         this.logger = logger;
+        this.tokenManager = new OAuth2TokenManager(logger);
         if (this.isRouterMode()) {
             this.router = new McpRouter(config.servers || {}, config, logger);
         }
@@ -400,11 +403,11 @@ export class StandaloneServer {
         };
         switch (serverConfig.transport) {
             case "sse":
-                return new SseTransport(serverConfig, this.config, this.logger, onReconnected);
+                return new SseTransport(serverConfig, this.config, this.logger, onReconnected, this.tokenManager);
             case "stdio":
                 return new StdioTransport(serverConfig, this.config, this.logger, onReconnected);
             case "streamable-http":
-                return new StreamableHttpTransport(serverConfig, this.config, this.logger, onReconnected);
+                return new StreamableHttpTransport(serverConfig, this.config, this.logger, onReconnected, this.tokenManager);
             default:
                 throw new Error(`Unsupported transport: ${serverConfig.transport}`);
         }
@@ -413,7 +416,7 @@ export class StandaloneServer {
     async shutdown() {
         this.logger.info("[mcp-bridge] Shutting down...");
         if (this.router) {
-            await this.router.disconnectAll();
+            await this.router.shutdown(this.config.shutdownTimeoutMs);
         }
         for (const [name, conn] of this.directConnections) {
             try {
@@ -424,6 +427,7 @@ export class StandaloneServer {
             }
         }
         this.directConnections.clear();
+        this.tokenManager.clear();
         this.logger.info("[mcp-bridge] Shutdown complete");
     }
 }

package/dist/src/tool-resolution.d.ts

@@ -26,6 +26,7 @@ export declare class ToolResolver {
     resolve(toolName: string, params?: Record<string, unknown>, serverHint?: string): ToolResolutionResult;
     recordCall(server: string, tool: string): void;
     getKnownToolNames(): string[];
+    clear(): void;
     private scoreCandidate;
     private wasUsedRecently;
     private computeParamMatch;

package/dist/src/tool-resolution.js

@@ -99,6 +99,11 @@ export class ToolResolver {
     getKnownToolNames() {
         return [...this.toolsByName.keys()];
     }
+    clear() {
+        this.toolsByName.clear();
+        this.toolNamesByServer.clear();
+        this.recentCalls.length = 0;
+    }
     scoreCandidate(server, inputSchema, params) {
         const base = this.basePriority.get(server) ?? BASE_PRIORITY_MIN;
         const recency = this.wasUsedRecently(server) ? RECENCY_BOOST : 0;

package/dist/src/transport-base.d.ts

@@ -1,4 +1,5 @@
 import { McpTransport, McpRequest, McpResponse, McpServerConfig, McpClientConfig, Logger, JsonRpcMessage } from "./types.js";
+import type { OAuth2Config, OAuth2TokenManager } from "./oauth2-token-manager.js";
 export type PendingRequest = {
     resolve: (value: McpResponse) => void;
     reject: (reason: Error) => void;
@@ -70,6 +71,17 @@ export declare function resolveEnvRecord(record: Record<string, string>, context
  * @param extraEnv - Additional env vars to check before process.env
  */
 export declare function resolveArgs(args: string[], extraEnv?: Record<string, string | undefined>, envFallback?: () => Record<string, string>): string[];
+/**
+ * Resolve auth config into HTTP headers.
+ */
+export declare function resolveAuthHeaders(config: McpServerConfig, extraEnv?: Record<string, string | undefined>, envFallback?: () => Record<string, string>): Record<string, string>;
+export declare function resolveOAuth2Config(config: McpServerConfig, extraEnv?: Record<string, string | undefined>, envFallback?: () => Record<string, string>): OAuth2Config;
+export declare function resolveAuthHeadersAsync(config: McpServerConfig, tokenManager: OAuth2TokenManager, extraEnv?: Record<string, string | undefined>, envFallback?: () => Record<string, string>): Promise<Record<string, string>>;
+/**
+ * Resolve server headers and merge auth headers (auth takes precedence).
+ */
+export declare function resolveServerHeaders(config: McpServerConfig, extraEnv?: Record<string, string | undefined>, envFallback?: () => Record<string, string>): Record<string, string>;
+export declare function resolveServerHeadersAsync(config: McpServerConfig, tokenManager: OAuth2TokenManager, extraEnv?: Record<string, string | undefined>, envFallback?: () => Record<string, string>): Promise<Record<string, string>>;
 /**
  * Warn if a URL uses non-TLS HTTP to a remote (non-localhost) host.
  */

package/dist/src/transport-base.js

@@ -159,6 +159,59 @@ export function resolveEnvRecord(record, contextPrefix, extraEnv, envFallback) {
 export function resolveArgs(args, extraEnv, envFallback) {
     return args.map(arg => resolveEnvVars(arg, `arg "${arg}"`, extraEnv, envFallback));
 }
+/**
+ * Resolve auth config into HTTP headers.
+ */
+export function resolveAuthHeaders(config, extraEnv, envFallback) {
+    if (!config.auth)
+        return {};
+    if (config.auth.type === "bearer") {
+        const token = resolveEnvVars(config.auth.token, "auth token", extraEnv, envFallback);
+        return { Authorization: `Bearer ${token}` };
+    }
+    if (config.auth.type === "header") {
+        return resolveEnvRecord(config.auth.headers, "auth header", extraEnv, envFallback);
+    }
+    throw new Error("[mcp-bridge] OAuth2 auth requires async header resolution via resolveAuthHeadersAsync");
+}
+export function resolveOAuth2Config(config, extraEnv, envFallback) {
+    if (!config.auth || config.auth.type !== "oauth2") {
+        throw new Error("[mcp-bridge] resolveOAuth2Config called for non-oauth2 auth config");
+    }
+    const scopes = config.auth.scopes?.map((scope, index) => resolveEnvVars(scope, `oauth2 scope[${index}]`, extraEnv, envFallback));
+    return {
+        clientId: resolveEnvVars(config.auth.clientId, "oauth2 clientId", extraEnv, envFallback),
+        clientSecret: resolveEnvVars(config.auth.clientSecret, "oauth2 clientSecret", extraEnv, envFallback),
+        tokenUrl: resolveEnvVars(config.auth.tokenUrl, "oauth2 tokenUrl", extraEnv, envFallback),
+        ...(scopes && scopes.length > 0 ? { scopes } : {}),
+        ...(config.auth.audience
+            ? { audience: resolveEnvVars(config.auth.audience, "oauth2 audience", extraEnv, envFallback) }
+            : {}),
+    };
+}
+export async function resolveAuthHeadersAsync(config, tokenManager, extraEnv, envFallback) {
+    if (!config.auth)
+        return {};
+    if (config.auth.type === "oauth2") {
+        const oauth2Config = resolveOAuth2Config(config, extraEnv, envFallback);
+        const token = await tokenManager.getToken(oauth2Config);
+        return { Authorization: `Bearer ${token}` };
+    }
+    return resolveAuthHeaders(config, extraEnv, envFallback);
+}
+/**
+ * Resolve server headers and merge auth headers (auth takes precedence).
+ */
+export function resolveServerHeaders(config, extraEnv, envFallback) {
+    const base = resolveEnvRecord(config.headers || {}, "header", extraEnv, envFallback);
+    const auth = resolveAuthHeaders(config, extraEnv, envFallback);
+    return { ...base, ...auth };
+}
+export async function resolveServerHeadersAsync(config, tokenManager, extraEnv, envFallback) {
+    const base = resolveEnvRecord(config.headers || {}, "header", extraEnv, envFallback);
+    const auth = await resolveAuthHeadersAsync(config, tokenManager, extraEnv, envFallback);
+    return { ...base, ...auth };
+}
 /**
  * Warn if a URL uses non-TLS HTTP to a remote (non-localhost) host.
  */

package/dist/src/transport-sse.d.ts

@@ -1,16 +1,25 @@
-import { McpRequest, McpResponse } from "./types.js";
+import { Logger, McpClientConfig, McpRequest, McpResponse, McpServerConfig } from "./types.js";
+import { OAuth2TokenManager } from "./oauth2-token-manager.js";
 import { BaseTransport } from "./transport-base.js";
 export declare class SseTransport extends BaseTransport {
     private endpointUrl;
     private sseAbortController;
     private resolvedHeaders;
+    private pendingRequestControllers;
+    private readonly tokenManager;
     protected get transportName(): string;
+    constructor(config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>, tokenManager?: OAuth2TokenManager);
     connect(): Promise<void>;
     private _onEndpointReceived;
+    private getBaseHeaders;
+    private refreshResolvedHeaders;
+    private invalidateOAuth2Token;
+    private fetchWithOAuthRetry;
     private startEventStream;
     private processEventLine;
     sendNotification(notification: any): Promise<void>;
     sendRequest(request: McpRequest): Promise<McpResponse>;
     private isSameOrigin;
     disconnect(): Promise<void>;
+    shutdown(): Promise<void>;
 }

package/dist/src/transport-sse.js

@@ -1,17 +1,23 @@
 import { nextRequestId } from "./types.js";
-import { BaseTransport, resolveEnvRecord, warnIfNonTlsRemoteUrl } from "./transport-base.js";
+import { OAuth2TokenManager } from "./oauth2-token-manager.js";
+import { BaseTransport, resolveOAuth2Config, resolveServerHeaders, resolveServerHeadersAsync, warnIfNonTlsRemoteUrl, } from "./transport-base.js";
 export class SseTransport extends BaseTransport {
     endpointUrl = null;
     sseAbortController = null;
     resolvedHeaders = null;
+    pendingRequestControllers = new Map();
+    tokenManager;
     get transportName() { return "SSE"; }
+    constructor(config, clientConfig, logger, onReconnected, tokenManager) {
+        super(config, clientConfig, logger, onReconnected);
+        this.tokenManager = tokenManager ?? new OAuth2TokenManager(logger);
+    }
     async connect() {
         if (!this.config.url) {
             throw new Error("SSE transport requires URL");
         }
         warnIfNonTlsRemoteUrl(this.config.url, this.logger);
-        // Resolve headers once and cache for all subsequent requests
-        this.resolvedHeaders = resolveEnvRecord(this.config.headers || {}, "header");
+        await this.refreshResolvedHeaders();
         if (this.sseAbortController) {
             this.sseAbortController.abort();
         }
@@ -23,7 +29,7 @@ export class SseTransport extends BaseTransport {
         });
         // Fire and forget the stream reader
         this.startEventStream().catch((error) => {
-            if (error instanceof Error && error.name !== 'AbortError') {
+            if (error instanceof Error && error.name !== "AbortError") {
                 this.logger.error("[mcp-bridge] SSE stream error:", error.message);
                 this.scheduleReconnect();
             }
@@ -33,16 +39,58 @@ export class SseTransport extends BaseTransport {
         this.backoffDelay = this.clientConfig.reconnectIntervalMs || 30000;
     }
     _onEndpointReceived = null;
+    async getBaseHeaders(forceRefresh = false) {
+        if (this.config.auth?.type === "oauth2") {
+            if (forceRefresh) {
+                this.invalidateOAuth2Token();
+            }
+            return this.refreshResolvedHeaders();
+        }
+        if (!this.resolvedHeaders) {
+            this.resolvedHeaders = resolveServerHeaders(this.config, undefined, this.clientConfig.envFallback);
+        }
+        return this.resolvedHeaders;
+    }
+    async refreshResolvedHeaders() {
+        if (this.config.auth?.type === "oauth2") {
+            this.resolvedHeaders = await resolveServerHeadersAsync(this.config, this.tokenManager, undefined, this.clientConfig.envFallback);
+        }
+        else {
+            this.resolvedHeaders = resolveServerHeaders(this.config, undefined, this.clientConfig.envFallback);
+        }
+        return this.resolvedHeaders;
+    }
+    invalidateOAuth2Token() {
+        if (this.config.auth?.type !== "oauth2") {
+            return;
+        }
+        const oauth2Config = resolveOAuth2Config(this.config, undefined, this.clientConfig.envFallback);
+        this.tokenManager.invalidate(oauth2Config.tokenUrl, oauth2Config.clientId);
+    }
+    async fetchWithOAuthRetry(url, init) {
+        const response = await fetch(url, init);
+        if (response.status !== 401 || this.config.auth?.type !== "oauth2") {
+            return response;
+        }
+        this.logger.warn("[mcp-bridge] SSE request returned 401, invalidating OAuth2 token and retrying once");
+        const refreshedBase = await this.getBaseHeaders(true);
+        const retryHeaders = {
+            ...refreshedBase,
+            ...Object.fromEntries(Array.from(new Headers(init.headers).entries()).filter(([key]) => key.toLowerCase() !== "authorization")),
+            Authorization: refreshedBase.Authorization,
+        };
+        return fetch(url, { ...init, headers: retryHeaders });
+    }
     async startEventStream() {
         if (!this.config.url)
             return;
-        const base = this.resolvedHeaders ?? resolveEnvRecord(this.config.headers || {}, "header");
-        const headers = { ...base, "Accept": "text/event-stream" };
+        const base = await this.getBaseHeaders();
+        const headers = { ...base, Accept: "text/event-stream" };
         try {
-            const response = await fetch(this.config.url, {
+            const response = await this.fetchWithOAuthRetry(this.config.url, {
                 method: "GET",
                 headers,
-                signal: this.sseAbortController?.signal
+                signal: this.sseAbortController?.signal,
             });
             if (!response.ok) {
                 throw new Error(`SSE connection failed: HTTP ${response.status}`);
@@ -59,7 +107,7 @@ export class SseTransport extends BaseTransport {
                 if (done)
                     break;
                 buffer += decoder.decode(value, { stream: true });
-                const lines = buffer.split('\n');
+                const lines = buffer.split("\n");
                 buffer = lines.pop() || "";
                 for (const line of lines) {
                     this.processEventLine(line, state);
@@ -70,7 +118,7 @@ export class SseTransport extends BaseTransport {
             this.scheduleReconnect();
         }
         catch (error) {
-            if (error instanceof Error && error.name === 'AbortError')
+            if (error instanceof Error && error.name === "AbortError")
                 return;
             this.logger.error("SSE stream error:", error);
             this.scheduleReconnect();
@@ -130,12 +178,12 @@ export class SseTransport extends BaseTransport {
         if (!this.connected || !this.endpointUrl) {
             throw new Error("SSE transport not connected or no endpoint URL");
         }
-        const base = this.resolvedHeaders ?? resolveEnvRecord(this.config.headers || {}, "header");
+        const base = await this.getBaseHeaders();
         const headers = { ...base, "Content-Type": "application/json" };
-        const response = await fetch(this.endpointUrl, {
+        const response = await this.fetchWithOAuthRetry(this.endpointUrl, {
             method: "POST",
             headers,
-            body: JSON.stringify(notification)
+            body: JSON.stringify(notification),
         });
         if (!response.ok) {
             this.logger.warn(`[mcp-bridge] SSE notification got HTTP ${response.status}`);
@@ -150,32 +198,41 @@ export class SseTransport extends BaseTransport {
         return new Promise((resolve, reject) => {
             const requestTimeout = this.clientConfig.requestTimeoutMs || 60000;
             const timeout = setTimeout(() => {
+                this.pendingRequestControllers.get(id)?.abort();
+                this.pendingRequestControllers.delete(id);
                 this.pendingRequests.delete(id);
                 reject(new Error(`Request timeout after ${requestTimeout}ms`));
             }, requestTimeout);
             this.pendingRequests.set(id, { resolve, reject, timeout });
-            const base = this.resolvedHeaders ?? resolveEnvRecord(this.config.headers || {}, "header");
-            const headers = { ...base, "Content-Type": "application/json" };
+            const abortController = new AbortController();
+            this.pendingRequestControllers.set(id, abortController);
             // The response arrives via the SSE stream (handleMessage), not from this fetch.
             // The fetch only confirms the server accepted the request (HTTP 200).
             // If the fetch fails, we reject immediately; otherwise we wait for the SSE stream.
-            fetch(this.endpointUrl, {
-                method: "POST",
-                headers,
-                body: JSON.stringify(requestWithId)
-            })
-                .then((response) => {
-                if (!response.ok) {
+            (async () => {
+                try {
+                    const base = await this.getBaseHeaders();
+                    const headers = { ...base, "Content-Type": "application/json" };
+                    const response = await this.fetchWithOAuthRetry(this.endpointUrl, {
+                        method: "POST",
+                        headers,
+                        body: JSON.stringify(requestWithId),
+                        signal: abortController.signal,
+                    });
+                    this.pendingRequestControllers.delete(id);
+                    if (!response.ok) {
+                        clearTimeout(timeout);
+                        this.pendingRequests.delete(id);
+                        reject(new Error(`HTTP ${response.status}`));
+                    }
+                }
+                catch (error) {
+                    this.pendingRequestControllers.delete(id);
                     clearTimeout(timeout);
                     this.pendingRequests.delete(id);
-                    reject(new Error(`HTTP ${response.status}`));
+                    reject(error);
                 }
-            })
-                .catch((error) => {
-                clearTimeout(timeout);
-                this.pendingRequests.delete(id);
-                reject(error);
-            });
+            })();
         });
     }
     isSameOrigin(url) {
@@ -197,6 +254,13 @@ export class SseTransport extends BaseTransport {
             this.sseAbortController.abort();
             this.sseAbortController = null;
         }
+        for (const [, controller] of this.pendingRequestControllers) {
+            controller.abort();
+        }
+        this.pendingRequestControllers.clear();
         this.rejectAllPending("Connection closed");
     }
+    async shutdown() {
+        await this.disconnect();
+    }
 }

package/dist/src/transport-stdio.d.ts

@@ -15,6 +15,7 @@ export declare class StdioTransport extends BaseTransport {
     private parseNewlineMessageFromBuffer;
     private parseLspMessageFromBuffer;
     disconnect(): Promise<void>;
+    shutdown(timeoutMs?: number): Promise<void>;
     isConnected(): boolean;
     private terminateProcessGracefully;
 }

package/dist/src/transport-stdio.js

@@ -264,7 +264,20 @@ export class StdioTransport extends BaseTransport {
                     this.logger.debug("[mcp-bridge] Failed to send close notification during stdio disconnect");
                 }
             }
-            await this.terminateProcessGracefully(activeProcess);
+            await this.terminateProcessGracefully(activeProcess, this.clientConfig.shutdownTimeoutMs ?? 5000);
+            if (this.process === activeProcess) {
+                this.process = null;
+            }
+        }
+        this.rejectAllPending("Connection closed");
+    }
+    async shutdown(timeoutMs = this.clientConfig.shutdownTimeoutMs ?? 5000) {
+        this.isShuttingDown = true;
+        this.connected = false;
+        this.cleanupReconnectTimer();
+        const activeProcess = this.process;
+        if (activeProcess) {
+            await this.terminateProcessGracefully(activeProcess, timeoutMs);
             if (this.process === activeProcess) {
                 this.process = null;
             }
@@ -274,8 +287,8 @@ export class StdioTransport extends BaseTransport {
     isConnected() {
         return this.connected && this.process !== null;
     }
-    async terminateProcessGracefully(proc) {
-        if (proc.exitCode !== null || proc.killed)
+    async terminateProcessGracefully(proc, timeoutMs) {
+        if (proc.exitCode !== null)
             return;
         await new Promise((resolve) => {
             let done = false;
@@ -292,21 +305,20 @@ export class StdioTransport extends BaseTransport {
             const onExit = () => finish();
             proc.once("exit", onExit);
             try {
-                proc.kill("SIGINT");
+                proc.kill("SIGTERM");
             }
             catch {
                 finish();
                 return;
             }
             forceKillTimer = setTimeout(() => {
-                if (proc.exitCode === null && !proc.killed) {
+                if (proc.exitCode === null) {
                     try {
-                        proc.kill("SIGTERM");
+                        proc.kill("SIGKILL");
                     }
                     catch { /* ignore */ }
                 }
-                setTimeout(finish, 200);
-            }, 2000);
+            }, Math.max(0, timeoutMs));
         });
     }
 }

package/dist/src/transport-streamable-http.d.ts

@@ -1,11 +1,21 @@
-import { McpRequest, McpResponse } from "./types.js";
+import { Logger, McpClientConfig, McpRequest, McpResponse, McpServerConfig } from "./types.js";
+import { OAuth2TokenManager } from "./oauth2-token-manager.js";
 import { BaseTransport } from "./transport-base.js";
 export declare class StreamableHttpTransport extends BaseTransport {
     private sessionId?;
+    private resolvedHeaders;
+    private pendingRequestControllers;
+    private readonly tokenManager;
     protected get transportName(): string;
+    constructor(config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>, tokenManager?: OAuth2TokenManager);
     connect(): Promise<void>;
+    private getBaseHeaders;
+    private refreshResolvedHeaders;
+    private invalidateOAuth2Token;
+    private fetchWithOAuthRetry;
     sendRequest(request: McpRequest): Promise<McpResponse>;
     sendNotification(notification: any): Promise<void>;
     private probeServer;
     disconnect(): Promise<void>;
+    shutdown(): Promise<void>;
 }

package/dist/src/transport-streamable-http.js

@@ -1,20 +1,69 @@
 import { nextRequestId } from "./types.js";
-import { BaseTransport, resolveEnvRecord, warnIfNonTlsRemoteUrl } from "./transport-base.js";
+import { OAuth2TokenManager } from "./oauth2-token-manager.js";
+import { BaseTransport, resolveOAuth2Config, resolveServerHeaders, resolveServerHeadersAsync, warnIfNonTlsRemoteUrl, } from "./transport-base.js";
 export class StreamableHttpTransport extends BaseTransport {
     sessionId;
+    resolvedHeaders = null;
+    pendingRequestControllers = new Map();
+    tokenManager;
     get transportName() { return "streamable-http"; }
+    constructor(config, clientConfig, logger, onReconnected, tokenManager) {
+        super(config, clientConfig, logger, onReconnected);
+        this.tokenManager = tokenManager ?? new OAuth2TokenManager(logger);
+    }
     async connect() {
         if (!this.config.url) {
             throw new Error("Streamable HTTP transport requires URL");
         }
         warnIfNonTlsRemoteUrl(this.config.url, this.logger);
-        // Validate that all header env vars resolve (fail fast)
-        resolveEnvRecord(this.config.headers || {}, "header");
+        await this.refreshResolvedHeaders();
         await this.probeServer();
         this.connected = true;
         this.backoffDelay = this.clientConfig.reconnectIntervalMs || 30000;
         this.logger.info(`[mcp-bridge] Streamable HTTP transport ready for ${this.config.url}`);
     }
+    async getBaseHeaders(forceRefresh = false) {
+        if (this.config.auth?.type === "oauth2") {
+            if (forceRefresh) {
+                this.invalidateOAuth2Token();
+            }
+            return this.refreshResolvedHeaders();
+        }
+        if (!this.resolvedHeaders) {
+            this.resolvedHeaders = resolveServerHeaders(this.config, undefined, this.clientConfig.envFallback);
+        }
+        return this.resolvedHeaders;
+    }
+    async refreshResolvedHeaders() {
+        if (this.config.auth?.type === "oauth2") {
+            this.resolvedHeaders = await resolveServerHeadersAsync(this.config, this.tokenManager, undefined, this.clientConfig.envFallback);
+        }
+        else {
+            this.resolvedHeaders = resolveServerHeaders(this.config, undefined, this.clientConfig.envFallback);
+        }
+        return this.resolvedHeaders;
+    }
+    invalidateOAuth2Token() {
+        if (this.config.auth?.type !== "oauth2") {
+            return;
+        }
+        const oauth2Config = resolveOAuth2Config(this.config, undefined, this.clientConfig.envFallback);
+        this.tokenManager.invalidate(oauth2Config.tokenUrl, oauth2Config.clientId);
+    }
+    async fetchWithOAuthRetry(url, init) {
+        const response = await fetch(url, init);
+        if (response.status !== 401 || this.config.auth?.type !== "oauth2") {
+            return response;
+        }
+        this.logger.warn("[mcp-bridge] Streamable HTTP request returned 401, invalidating OAuth2 token and retrying once");
+        const refreshedBase = await this.getBaseHeaders(true);
+        const retryHeaders = {
+            ...refreshedBase,
+            ...Object.fromEntries(Array.from(new Headers(init.headers).entries()).filter(([key]) => key.toLowerCase() !== "authorization")),
+            Authorization: refreshedBase.Authorization,
+        };
+        return fetch(url, { ...init, headers: retryHeaders });
+    }
     async sendRequest(request) {
         if (!this.connected || !this.config.url) {
             throw new Error("Streamable HTTP transport not connected");
@@ -23,108 +72,120 @@ export class StreamableHttpTransport extends BaseTransport {
         const requestWithId = { ...request, id };
         return new Promise((resolve, reject) => {
             const requestTimeout = this.clientConfig.requestTimeoutMs || 60000;
+            const abortController = new AbortController();
             const timeout = setTimeout(() => {
+                abortController.abort();
+                this.pendingRequestControllers.delete(id);
                 this.pendingRequests.delete(id);
                 reject(new Error(`Request timeout after ${requestTimeout}ms`));
             }, requestTimeout);
             this.pendingRequests.set(id, { resolve, reject, timeout });
-            const headers = resolveEnvRecord({
-                "Accept": "application/json, text/event-stream",
-                ...this.config.headers,
-                "Content-Type": "application/json"
-            }, "header");
-            if (this.sessionId) {
-                headers["mcp-session-id"] = this.sessionId;
-            }
-            fetch(this.config.url, {
-                method: "POST",
-                headers,
-                body: JSON.stringify(requestWithId)
-            })
-                .then(async (response) => {
-                const responseSessionId = response.headers.get("mcp-session-id");
-                if (responseSessionId) {
-                    this.sessionId = responseSessionId;
-                }
-                if (!response.ok) {
-                    clearTimeout(timeout);
-                    this.pendingRequests.delete(id);
-                    reject(new Error(`HTTP ${response.status}: ${response.statusText}`));
-                    return;
-                }
+            this.pendingRequestControllers.set(id, abortController);
+            (async () => {
                 try {
-                    const contentType = response.headers.get("content-type") || "";
-                    let jsonResponse;
-                    if (contentType.includes("text/event-stream")) {
-                        const text = await response.text();
-                        const lines = text.split('\n');
-                        // SSE event boundary parsing: collect data lines, dispatch on empty line
-                        let dataBuffer = [];
-                        const dispatch = () => {
-                            if (dataBuffer.length === 0)
-                                return;
-                            const data = dataBuffer.join("\n");
-                            dataBuffer = [];
-                            try {
-                                this.handleMessage(JSON.parse(data));
-                            }
-                            catch { /* skip malformed events */ }
-                        };
-                        let hasData = false;
-                        for (const line of lines) {
-                            const trimmed = line.trim();
-                            if (trimmed.startsWith("data:")) {
-                                dataBuffer.push(trimmed.substring(5).trimStart());
-                                hasData = true;
+                    const base = await this.getBaseHeaders();
+                    const headers = {
+                        ...base,
+                        Accept: "application/json, text/event-stream",
+                        "Content-Type": "application/json",
+                    };
+                    if (this.sessionId) {
+                        headers["mcp-session-id"] = this.sessionId;
+                    }
+                    const response = await this.fetchWithOAuthRetry(this.config.url, {
+                        method: "POST",
+                        headers,
+                        body: JSON.stringify(requestWithId),
+                        signal: abortController.signal,
+                    });
+                    this.pendingRequestControllers.delete(id);
+                    const responseSessionId = response.headers.get("mcp-session-id");
+                    if (responseSessionId) {
+                        this.sessionId = responseSessionId;
+                    }
+                    if (!response.ok) {
+                        clearTimeout(timeout);
+                        this.pendingRequests.delete(id);
+                        reject(new Error(`HTTP ${response.status}: ${response.statusText}`));
+                        return;
+                    }
+                    try {
+                        const contentType = response.headers.get("content-type") || "";
+                        if (contentType.includes("text/event-stream")) {
+                            const text = await response.text();
+                            const lines = text.split("\n");
+                            // SSE event boundary parsing: collect data lines, dispatch on empty line
+                            let dataBuffer = [];
+                            const dispatch = () => {
+                                if (dataBuffer.length === 0)
+                                    return;
+                                const data = dataBuffer.join("\n");
+                                dataBuffer = [];
+                                try {
+                                    this.handleMessage(JSON.parse(data));
+                                }
+                                catch {
+                                    // skip malformed events
+                                }
+                            };
+                            let hasData = false;
+                            for (const line of lines) {
+                                const trimmed = line.trim();
+                                if (trimmed.startsWith("data:")) {
+                                    dataBuffer.push(trimmed.substring(5).trimStart());
+                                    hasData = true;
+                                }
+                                else if (trimmed === "" && dataBuffer.length > 0) {
+                                    dispatch();
+                                }
                             }
-                            else if (trimmed === "" && dataBuffer.length > 0) {
-                                dispatch();
+                            // Dispatch any trailing data (server may omit final empty line)
+                            dispatch();
+                            if (!hasData) {
+                                throw new Error("No data lines in SSE response");
                             }
                         }
-                        // Dispatch any trailing data (server may omit final empty line)
-                        dispatch();
-                        if (!hasData) {
-                            throw new Error("No data lines in SSE response");
+                        else {
+                            this.handleMessage(await response.json());
                         }
                     }
-                    else {
-                        this.handleMessage(await response.json());
+                    catch (error) {
+                        clearTimeout(timeout);
+                        this.pendingRequests.delete(id);
+                        reject(new Error("Failed to parse response: " + (error instanceof Error ? error.message : String(error))));
                     }
                 }
                 catch (error) {
+                    this.pendingRequestControllers.delete(id);
                     clearTimeout(timeout);
                     this.pendingRequests.delete(id);
-                    reject(new Error("Failed to parse response: " + (error instanceof Error ? error.message : String(error))));
-                }
-            })
-                .catch(error => {
-                clearTimeout(timeout);
-                this.pendingRequests.delete(id);
-                if (error.name === 'TypeError' && error.message.includes('fetch')) {
-                    this.logger.error("Connection error, scheduling reconnect:", error.message);
-                    this.scheduleReconnect();
+                    if (error instanceof Error && error.name === "TypeError" && error.message.includes("fetch")) {
+                        this.logger.error("Connection error, scheduling reconnect:", error.message);
+                        this.scheduleReconnect();
+                    }
+                    reject(error);
                 }
-                reject(error);
-            });
+            })();
         });
     }
     async sendNotification(notification) {
         if (!this.connected || !this.config.url) {
             throw new Error("Streamable HTTP transport not connected");
         }
-        const headers = resolveEnvRecord({
-            "Accept": "application/json, text/event-stream",
-            ...this.config.headers,
-            "Content-Type": "application/json"
-        }, "header");
+        const base = await this.getBaseHeaders();
+        const headers = {
+            ...base,
+            Accept: "application/json, text/event-stream",
+            "Content-Type": "application/json",
+        };
         if (this.sessionId) {
             headers["mcp-session-id"] = this.sessionId;
         }
         try {
-            const response = await fetch(this.config.url, {
+            const response = await this.fetchWithOAuthRetry(this.config.url, {
                 method: "POST",
                 headers,
-                body: JSON.stringify(notification)
+                body: JSON.stringify(notification),
             });
             const responseSessionId = response.headers.get("mcp-session-id");
             if (responseSessionId) {
@@ -135,7 +196,7 @@ export class StreamableHttpTransport extends BaseTransport {
             }
         }
         catch (error) {
-            if (error instanceof Error && error.name === 'TypeError' && error.message.includes('fetch')) {
+            if (error instanceof Error && error.name === "TypeError" && error.message.includes("fetch")) {
                 this.logger.error("Connection error during notification, scheduling reconnect:", error.message);
                 this.scheduleReconnect();
             }
@@ -146,11 +207,11 @@ export class StreamableHttpTransport extends BaseTransport {
         if (!this.config.url)
             return;
         try {
-            const optionsResponse = await fetch(this.config.url, { method: "OPTIONS" });
+            const headers = await this.getBaseHeaders();
+            const optionsResponse = await this.fetchWithOAuthRetry(this.config.url, { method: "OPTIONS", headers });
             if (optionsResponse.ok)
                 return;
-            const headers = resolveEnvRecord(this.config.headers || {}, "header");
-            const headResponse = await fetch(this.config.url, { method: "HEAD", headers });
+            const headResponse = await this.fetchWithOAuthRetry(this.config.url, { method: "HEAD", headers });
             if (!headResponse.ok) {
                 this.logger.warn(`[mcp-bridge] Streamable HTTP server probe: OPTIONS ${optionsResponse.status}, HEAD ${headResponse.status} (non-blocking, connection continues)`);
             }
@@ -162,14 +223,18 @@ export class StreamableHttpTransport extends BaseTransport {
     async disconnect() {
         this.connected = false;
         this.cleanupReconnectTimer();
+        for (const [, controller] of this.pendingRequestControllers) {
+            controller.abort();
+        }
+        this.pendingRequestControllers.clear();
         // Send DELETE request if we have a session to clean up
         if (this.sessionId && this.config.url) {
             try {
-                const headers = resolveEnvRecord(this.config.headers || {}, "header");
-                headers["mcp-session-id"] = this.sessionId;
-                await fetch(this.config.url, {
+                const base = await this.getBaseHeaders();
+                const headers = { ...base, "mcp-session-id": this.sessionId };
+                await this.fetchWithOAuthRetry(this.config.url, {
                     method: "DELETE",
-                    headers
+                    headers,
                 });
                 this.sessionId = undefined;
                 this.logger.info("Streamable HTTP session cleaned up");
@@ -180,4 +245,7 @@ export class StreamableHttpTransport extends BaseTransport {
         }
         this.rejectAllPending("Connection closed");
     }
+    async shutdown() {
+        await this.disconnect();
+    }
 }

package/dist/src/types.d.ts

@@ -4,12 +4,33 @@ export interface Logger {
     error: (...args: unknown[]) => void;
     debug: (...args: unknown[]) => void;
 }
+export type HttpAuthConfig = {
+    type: "bearer";
+    token: string;
+} | {
+    type: "header";
+    headers: Record<string, string>;
+} | {
+    type: "oauth2";
+    clientId: string;
+    clientSecret: string;
+    tokenUrl: string;
+    scopes?: string[];
+    audience?: string;
+};
+export interface RetryConfig {
+    maxAttempts?: number;
+    delayMs?: number;
+    backoffMultiplier?: number;
+    retryOn?: Array<"timeout" | "connection_error">;
+}
 export interface McpServerConfig {
     transport: "sse" | "stdio" | "streamable-http";
     /** Human-readable description for router tool description generation */
     description?: string;
     url?: string;
     headers?: Record<string, string>;
+    auth?: HttpAuthConfig;
     command?: string;
     args?: string[];
     env?: Record<string, string>;
@@ -20,6 +41,7 @@ export interface McpServerConfig {
         allow?: string[];
     };
     maxResultChars?: number;
+    retry?: RetryConfig;
 }
 export interface McpClientConfig {
     servers: Record<string, McpServerConfig>;
@@ -28,6 +50,7 @@ export interface McpClientConfig {
     reconnectIntervalMs?: number;
     connectionTimeoutMs?: number;
     requestTimeoutMs?: number;
+    shutdownTimeoutMs?: number;
     routerIdleTimeoutMs?: number;
     routerMaxConcurrent?: number;
     maxBatchSize?: number;
@@ -49,6 +72,7 @@ export interface McpClientConfig {
         minCalls?: number;
         decayMs?: number;
     };
+    retry?: RetryConfig;
     resultCache?: {
         enabled?: boolean;
         maxEntries?: number;
@@ -98,6 +122,7 @@ export interface McpResponse {
 export interface McpTransport {
     connect(): Promise<void>;
     disconnect(): Promise<void>;
+    shutdown?(timeoutMs?: number): Promise<void>;
     sendRequest(request: McpRequest): Promise<McpResponse>;
     sendNotification(notification: any): Promise<void>;
     isConnected(): boolean;
@@ -112,9 +137,6 @@ export interface McpServerConnection {
 /** Bridge-level config loaded from ~/.mcp-bridge/config.json */
 export interface BridgeConfig extends McpClientConfig {
     http?: {
-        auth?: {
-            type: "bearer";
-            token: string;
-        };
+        auth?: HttpAuthConfig;
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwerk/mcp-bridge",
-  "version": "1.9.0",
+  "version": "2.1.0",
   "description": "Standalone MCP server that multiplexes multiple MCP servers into one interface",
   "type": "module",
   "main": "./dist/src/index.js",