@corbits/mcp 0.1.0 → 0.2.0

package/dist/oauth-discovery.js

@@ -0,0 +1,322 @@
+import { type } from "arktype";
+import { OAuthDiscoveryError, } from "@corbits/oauth-core";
+// Generic MCP-OAuth discovery (RFC 9728 protected-resource metadata, RFC 8414
+// authorization-server metadata) plus RFC 7591 dynamic client registration.
+// Nothing here names a provider: the caller supplies the MCP server's resource
+// URL and gets back the endpoints plus a registered client id it can feed to
+// buildAuthorizeUrl/exchangeCode. Hosts persist the client id alongside the
+// tokens so refresh keeps working after the login completes.
+//
+// Grant types, scopes, and the PKCE code-challenge method are negotiated from
+// server metadata rather than hard-coded, per the MCP authorization spec
+// (https://modelcontextprotocol.io/specification/latest/basic/authorization)
+// and its "Client Registration" and "Security Considerations" sub-pages.
+// RFC 9728 §2 — protected-resource metadata. Only the fields discovery needs
+// are validated; anything else the server sends is ignored.
+const ProtectedResourceMetadata = type({
+    resource: "string",
+    "authorization_servers?": "string[]",
+    "scopes_supported?": "string[]",
+});
+// RFC 8414 §2 — authorization-server metadata, narrowed to the endpoints and
+// capabilities a loopback PKCE login needs. `registration_endpoint` is
+// optional: its absence means the server does not support dynamic
+// registration.
+const AuthorizationServerMetadata = type({
+    issuer: "string",
+    authorization_endpoint: "string",
+    token_endpoint: "string",
+    "registration_endpoint?": "string",
+    "grant_types_supported?": "string[]",
+    "scopes_supported?": "string[]",
+    "token_endpoint_auth_methods_supported?": "string[]",
+    "code_challenge_methods_supported?": "string[]",
+});
+// RFC 7591 §3.2.1 — registration response, narrowed to the assigned client id
+// plus what the server echoes back as actually granted. A server MAY narrow
+// the request (e.g. drop refresh_token, trim scope); callers that need to
+// persist what was granted read these instead of assuming the request stuck.
+const ClientRegistrationResponse = type({
+    client_id: "string",
+    "grant_types?": "string[]",
+    "scope?": "string",
+});
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_TOKEN_TIMEOUT_MS = 30_000;
+// Build a well-known URI by inserting `/.well-known/<suffix>` before the
+// URL's path (RFC 8414 §3.1, RFC 9728 §3.1): for a bare origin the well-known
+// path stands alone, for `https://host/mcp` it becomes
+// `https://host/.well-known/<suffix>/mcp`.
+function wellKnownUrl(raw, suffix) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new OAuthDiscoveryError(`not a valid URL: ${raw}`);
+    }
+    const path = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/$/, "");
+    parsed.pathname = `/.well-known/${suffix}${path}`;
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+}
+// RFC 8414 §3: the issuer a well-known URL was derived from, with the same
+// trailing-slash normalization `wellKnownUrl` applies.
+function normalizedIssuer(raw) {
+    const parsed = new URL(raw);
+    const path = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/$/, "");
+    return `${parsed.origin}${path}`;
+}
+async function getJson(url, fetchImpl, timeoutMs) {
+    let res;
+    try {
+        res = await fetchImpl(url, {
+            headers: { accept: "application/json" },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (error) {
+        throw new OAuthDiscoveryError(`request to ${url} failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return res;
+}
+async function readJson(res, url) {
+    try {
+        return await res.json();
+    }
+    catch {
+        throw new OAuthDiscoveryError(`endpoint ${url} returned invalid JSON.`);
+    }
+}
+function badStatus(url, status) {
+    return new OAuthDiscoveryError(`endpoint ${url} returned status ${String(status)}.`);
+}
+// MCP authorization spec, "Security Considerations" → "Authorization Code
+// Protection": if `code_challenge_methods_supported` is absent, or present
+// without S256, the client MUST refuse to proceed rather than fall back to a
+// weaker challenge method.
+function assertSupportsS256(asMetadataUrl, codeChallengeMethodsSupported) {
+    if (codeChallengeMethodsSupported === undefined ||
+        !codeChallengeMethodsSupported.includes("S256"))
+        throw new OAuthDiscoveryError(`authorization server at ${asMetadataUrl} does not advertise PKCE S256 support (code_challenge_methods_supported).`);
+}
+// This package only ever registers a public loopback client
+// (token_endpoint_auth_method: "none"). If the server advertises auth
+// methods but excludes "none", it cannot accept this client at all.
+function assertSupportsPublicClients(asMetadataUrl, tokenEndpointAuthMethodsSupported) {
+    if (tokenEndpointAuthMethodsSupported !== undefined &&
+        !tokenEndpointAuthMethodsSupported.includes("none"))
+        throw new OAuthDiscoveryError(`authorization server at ${asMetadataUrl} does not accept public clients (token_endpoint_auth_methods_supported omits "none").`);
+}
+// Resolve the authorization server for a resource URL: protected-resource
+// metadata first (RFC 9728), falling back to authorization-server metadata
+// served directly at the resource (RFC 8414 §3.1) for servers that skip the
+// protected-resource document.
+export async function discoverMcpLoginEntry(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const resourceUrl = opts.resourceUrl;
+    try {
+        new URL(resourceUrl);
+    }
+    catch {
+        throw new OAuthDiscoveryError(`not a valid URL: ${resourceUrl}`);
+    }
+    let issuer;
+    let resourceScopesSupported;
+    const resourceMetadataUrl = wellKnownUrl(resourceUrl, "oauth-protected-resource");
+    const resourceRes = await getJson(resourceMetadataUrl, fetchImpl, timeoutMs);
+    if (resourceRes.ok) {
+        const payload = ProtectedResourceMetadata(await readJson(resourceRes, resourceMetadataUrl));
+        if (payload instanceof type.errors)
+            throw new OAuthDiscoveryError(`protected-resource metadata at ${resourceMetadataUrl} is malformed: ${payload.summary}`);
+        if (payload.resource !== resourceUrl)
+            throw new OAuthDiscoveryError(`protected-resource metadata resource mismatch: expected ${resourceUrl}, got ${payload.resource}.`);
+        issuer = payload.authorization_servers?.[0];
+        if (issuer === undefined)
+            throw new OAuthDiscoveryError(`protected-resource metadata at ${resourceMetadataUrl} names no authorization server.`);
+        resourceScopesSupported = payload.scopes_supported;
+    }
+    else if (resourceRes.status !== 404) {
+        throw badStatus(resourceMetadataUrl, resourceRes.status);
+    }
+    // No protected-resource document: the resource itself may serve
+    // authorization-server metadata (some MCP servers do).
+    const asMetadataUrl = issuer === undefined
+        ? wellKnownUrl(resourceUrl, "oauth-authorization-server")
+        : wellKnownUrl(issuer, "oauth-authorization-server");
+    const asRes = await getJson(asMetadataUrl, fetchImpl, timeoutMs);
+    if (!asRes.ok)
+        throw badStatus(asMetadataUrl, asRes.status);
+    const metadata = AuthorizationServerMetadata(await readJson(asRes, asMetadataUrl));
+    if (metadata instanceof type.errors)
+        throw new OAuthDiscoveryError(`authorization-server metadata at ${asMetadataUrl} is malformed: ${metadata.summary}`);
+    // RFC 8414 §3.3: metadata must name the issuer it was fetched for. In the
+    // fallback that issuer is the one the resource URL itself identifies.
+    const expectedIssuer = issuer ?? normalizedIssuer(resourceUrl);
+    if (!URL.canParse(metadata.issuer) ||
+        normalizedIssuer(metadata.issuer) !== normalizedIssuer(expectedIssuer))
+        throw new OAuthDiscoveryError(`authorization-server metadata issuer mismatch: expected ${expectedIssuer}, got ${metadata.issuer}.`);
+    assertSupportsS256(asMetadataUrl, metadata.code_challenge_methods_supported);
+    assertSupportsPublicClients(asMetadataUrl, metadata.token_endpoint_auth_methods_supported);
+    const authorizationServer = {
+        issuer: metadata.issuer,
+        authorizationEndpoint: metadata.authorization_endpoint,
+        tokenEndpoint: metadata.token_endpoint,
+    };
+    if (metadata.registration_endpoint !== undefined)
+        authorizationServer.registrationEndpoint = metadata.registration_endpoint;
+    if (metadata.grant_types_supported !== undefined)
+        authorizationServer.grantTypesSupported = metadata.grant_types_supported;
+    if (metadata.scopes_supported !== undefined)
+        authorizationServer.scopesSupported = metadata.scopes_supported;
+    if (metadata.token_endpoint_auth_methods_supported !== undefined)
+        authorizationServer.tokenEndpointAuthMethodsSupported =
+            metadata.token_endpoint_auth_methods_supported;
+    if (metadata.code_challenge_methods_supported !== undefined)
+        authorizationServer.codeChallengeMethodsSupported =
+            metadata.code_challenge_methods_supported;
+    const entry = { resourceUrl, authorizationServer };
+    if (resourceScopesSupported !== undefined)
+        entry.resourceScopesSupported = resourceScopesSupported;
+    return entry;
+}
+// RFC 7591 §3.2.1: request refresh_token only when the server's advertised
+// grant_types_supported includes it, or the server didn't advertise grant
+// types at all (nothing to negotiate against, so ask for what we want).
+function grantTypesToRequest(grantTypesSupported) {
+    const wantsRefresh = grantTypesSupported === undefined ||
+        grantTypesSupported.includes("refresh_token");
+    return wantsRefresh
+        ? ["authorization_code", "refresh_token"]
+        : ["authorization_code"];
+}
+// The registration response MAY echo back what was actually granted, which
+// can narrow the request. Fall back to what was requested when the server
+// stays silent on a field.
+function grantedGrantTypes(echoed, requested) {
+    return echoed ?? requested;
+}
+function grantedScope(echoed, requested) {
+    return echoed ?? requested;
+}
+/**
+ * Register a loopback public client with the authorization server (RFC 7591).
+ * Loopback clients cannot keep a secret, so registration requests
+ * `token_endpoint_auth_method: "none"`. `grant_types` is negotiated from
+ * `grantTypesSupported` (see grantTypesToRequest); `scope`, when supplied, is
+ * carried on the registration request per RFC 7591 §2. Throws
+ * OAuthDiscoveryError when the server has no registration endpoint or
+ * rejects the request.
+ */
+export async function registerMcpClient(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const requestedGrantTypes = grantTypesToRequest(opts.grantTypesSupported);
+    let res;
+    try {
+        res = await fetchImpl(opts.registrationEndpoint, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "application/json",
+            },
+            body: JSON.stringify({
+                client_name: opts.clientName,
+                redirect_uris: opts.redirectUris,
+                grant_types: requestedGrantTypes,
+                response_types: ["code"],
+                token_endpoint_auth_method: "none",
+                scope: opts.scope,
+            }),
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (error) {
+        throw new OAuthDiscoveryError(`registration request to ${opts.registrationEndpoint} failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!res.ok) {
+        let detail = "";
+        try {
+            detail = await res.text();
+        }
+        catch {
+            // Non-2xx is the error; the body is optional detail.
+        }
+        throw new OAuthDiscoveryError(`registration endpoint ${opts.registrationEndpoint} returned status ${String(res.status)}${detail ? `: ${detail}` : ""}`);
+    }
+    const payload = ClientRegistrationResponse(await readJson(res, opts.registrationEndpoint));
+    if (payload instanceof type.errors)
+        throw new OAuthDiscoveryError(`registration endpoint ${opts.registrationEndpoint} returned a malformed response: ${payload.summary}`);
+    const scope = grantedScope(payload.scope, opts.scope);
+    const registration = {
+        clientId: payload.client_id,
+        grantTypes: grantedGrantTypes(payload.grant_types, requestedGrantTypes),
+    };
+    if (scope !== undefined)
+        registration.scope = scope;
+    return registration;
+}
+// MCP authorization spec, "Scope Selection Strategy": priority order is (1)
+// the `scope` parameter from a 401 WWW-Authenticate challenge, (2) all scopes
+// in the protected resource's `scopes_supported`, (3) omit the scope
+// parameter entirely. `offline_access` is layered on separately per the
+// spec's "Refresh Tokens" section: `wantRefresh` defaults to true (this
+// package always registers for refresh_token, see grantTypesToRequest), so
+// offline_access is added whenever the authorization server's own
+// `scopes_supported` lists it; pass `wantRefresh: false` to opt out.
+export function selectMcpScopes(opts) {
+    const priorityScopes = selectPriorityScopes(opts);
+    return addOfflineAccessScope(priorityScopes, opts);
+}
+function selectPriorityScopes(opts) {
+    if (opts.challengeScope !== undefined)
+        return opts.challengeScope.split(" ").filter((scope) => scope.length > 0);
+    const resourceScopes = opts.entry.resourceScopesSupported;
+    if (resourceScopes !== undefined)
+        return [...resourceScopes];
+    return [];
+}
+function addOfflineAccessScope(scopes, opts) {
+    if (opts.wantRefresh === false)
+        return scopes;
+    const authServerScopes = opts.entry.authorizationServer.scopesSupported;
+    if (authServerScopes === undefined)
+        return scopes;
+    if (!authServerScopes.includes("offline_access"))
+        return scopes;
+    if (scopes.includes("offline_access"))
+        return scopes;
+    return [...scopes, "offline_access"];
+}
+/**
+ * Build the OAuth client config for a discovered entry plus a registered
+ * client id. The RFC 8707 `resource` indicator binds the token to the MCP
+ * server; callers pass further provider-required params through
+ * `extraAuthorizeParams`. Scopes come from `selectMcpScopes` unless the
+ * caller passes an explicit `scopes` override; `wantRefresh` defaults to
+ * true, matching this package's default refresh_token registration request.
+ */
+export function mcpClientConfig(entry, opts) {
+    const scopeOptions = {
+        entry,
+        wantRefresh: opts.wantRefresh ?? true,
+    };
+    if (opts.challengeScope !== undefined)
+        scopeOptions.challengeScope = opts.challengeScope;
+    const scopes = opts.scopes ?? selectMcpScopes(scopeOptions);
+    const extraAuthorizeParams = {};
+    for (const [key, value] of Object.entries(opts.extraAuthorizeParams ?? {}))
+        extraAuthorizeParams[key] = value;
+    extraAuthorizeParams.resource = entry.resourceUrl;
+    return {
+        clientId: opts.clientId,
+        authorizeUrl: entry.authorizationServer.authorizationEndpoint,
+        tokenUrl: entry.authorizationServer.tokenEndpoint,
+        redirectUri: opts.redirectUri,
+        scopes,
+        extraAuthorizeParams,
+        tokenTimeoutMs: opts.tokenTimeoutMs ?? DEFAULT_TOKEN_TIMEOUT_MS,
+    };
+}

package/dist/sidecar-bundle.d.ts

@@ -33,6 +33,8 @@ export interface McpBoundServer {
 }
 export interface McpServersConfig {
     readonly servers: readonly McpBoundServer[];
+    /** Per-request bound on `initialize` and `tools/call`; defaults to 60s. */
+    readonly timeoutMs?: number;
 }
 /**
  * MCP results are never interpreted: text blocks come back as their text so

package/dist/sidecar-bundle.js

@@ -11,9 +11,8 @@
 // point at which this bundle could do a `tools/list` round trip.
 import { defineTool, } from "@intx/agent";
 import { type } from "arktype";
-import { mcpCallTool, mcpInitialize, McpToolSchema, } from "./client.js";
-import { isAskExempt, qualifiedName, toolDescription } from "./naming.js";
-import { parseMcpEndpoint } from "./url.js";
+import { DEFAULT_TIMEOUT_MS, mcpCallTool, mcpInitialize, McpToolSchema, } from "./client.js";
+import { assertCatalogNames, assertServers, isAskExempt, qualifiedName, toolDescription, } from "./naming.js";
 /** The consumer key a host matches a credential binding against. */
 export const SIDECAR_BUNDLE_ID = "@corbits/mcp/sidecar-bundle";
 const BoundServerSchema = type({
@@ -22,7 +21,10 @@ const BoundServerSchema = type({
     tools: McpToolSchema.array(),
     "allowWithoutAsk?": "string[]",
 });
-const ConfigSchema = type({ servers: BoundServerSchema.array() });
+const ConfigSchema = type({
+    servers: BoundServerSchema.array(),
+    "timeoutMs?": "number > 0",
+});
 /** Validate at construction: a malformed deploy config is a deploy bug, not a
  * tool error the model should see. */
 function assertConfig(config) {
@@ -30,19 +32,15 @@ function assertConfig(config) {
     if (parsed instanceof type.errors) {
         throw new Error(`invalid @corbits/mcp server config: ${parsed.summary}`);
     }
-    const seen = new Set();
-    for (const server of config.servers) {
-        if (seen.has(server.handle)) {
-            throw new Error(`invalid @corbits/mcp server config: duplicate credential handle "${server.handle}"`);
-        }
-        seen.add(server.handle);
-        try {
-            parseMcpEndpoint(server.url);
-        }
-        catch (cause) {
-            throw new Error(`invalid @corbits/mcp server config: ${cause instanceof Error ? cause.message : String(cause)}`);
+    try {
+        assertServers(config.servers.map(({ handle, url }) => ({ name: handle, url })), "credential handle");
+        for (const server of config.servers) {
+            assertCatalogNames(server.handle, server.tools);
         }
     }
+    catch (cause) {
+        throw new Error(`invalid @corbits/mcp server config: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
 }
 const TextBlock = type({ type: "'text'", text: "string" }).array();
 /**
@@ -71,6 +69,7 @@ function requestPath(url) {
  */
 export function mcpServers(config) {
     assertConfig(config);
+    const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const entries = config.servers.flatMap((server) => server.tools.map((tool) => ({
         server,
         tool,
@@ -109,10 +108,11 @@ export function mcpServers(config) {
                         throw new Error(`the "${runtime.server.handle}" credential is a ${credential.kind} handle; an MCP server needs an http one`);
                     }
                     const mediated = (input, init) => credential.fetch(input, init);
-                    await mcpInitialize(requestPath(runtime.server.url), {
+                    const session = await mcpInitialize(requestPath(runtime.server.url), {
                         fetch: mediated,
+                        timeoutMs,
                     });
-                    return mediated;
+                    return { fetch: mediated, session };
                 })().catch((cause) => {
                     runtime.ready = undefined;
                     runtime.handle = undefined;
@@ -122,7 +122,7 @@ export function mcpServers(config) {
             }
             return {
                 definitions: toolDefinitions,
-                async run(call, _signal) {
+                async run(call, signal) {
                     const found = byName.get(call.name);
                     const runtime = found === undefined ? undefined : runtimes.get(found.server.handle);
                     if (found === undefined || runtime === undefined) {
@@ -133,8 +133,12 @@ export function mcpServers(config) {
                         };
                     }
                     try {
-                        const mediated = await connect(runtime);
-                        const result = await mcpCallTool(requestPath(found.server.url), found.tool.name, call.arguments, { fetch: mediated });
+                        const client = await connect(runtime);
+                        const result = await mcpCallTool(requestPath(found.server.url), found.tool.name, call.arguments, { ...client, timeoutMs, signal }).catch((cause) => {
+                            // The session may have expired; the next call opens a new one.
+                            runtime.ready = undefined;
+                            throw cause;
+                        });
                         return {
                             callId: call.id,
                             isError: result.isError === true,

package/dist/test-server.d.ts

@@ -0,0 +1,9 @@
+export interface TestServerHandle {
+    url: string;
+    requestsSeen: Request[];
+    stop(): void;
+}
+export declare function startTestMcpServer(opts?: {
+    requireAuth?: string;
+    stallToolsCall?: boolean;
+}): TestServerHandle;

package/dist/test-server.js

@@ -0,0 +1,92 @@
+// In-test streamable-HTTP MCP server (`echo`, and `delete_thing` flagged
+// `destructiveHint`) so the suite needs no network.
+import { type } from "arktype";
+const JsonRpcRequestBody = type({
+    id: "number",
+    method: "string",
+    "params?": "Record<string, unknown>",
+});
+const ToolCallParams = type({
+    name: "string",
+    arguments: "Record<string, unknown>",
+});
+export function startTestMcpServer(opts = {}) {
+    const requestsSeen = [];
+    const server = Bun.serve({
+        port: 0,
+        async fetch(req) {
+            requestsSeen.push(req);
+            if (opts.requireAuth !== undefined &&
+                req.headers.get("authorization") !== opts.requireAuth) {
+                return new Response("unauthorized", { status: 401 });
+            }
+            const raw = await req.json();
+            if (typeof raw === "object" && raw !== null && !("id" in raw)) {
+                return new Response(null, { status: 202 });
+            }
+            const parsedBody = JsonRpcRequestBody(raw);
+            if (parsedBody instanceof type.errors) {
+                return new Response("bad request", { status: 400 });
+            }
+            const body = parsedBody;
+            const reply = (result) => new Response(JSON.stringify({ jsonrpc: "2.0", id: body.id, result }), {
+                headers: { "content-type": "application/json" },
+            });
+            if (body.method === "initialize") {
+                return reply({
+                    protocolVersion: "2025-03-26",
+                    capabilities: {},
+                    serverInfo: { name: "test", version: "0" },
+                });
+            }
+            if (body.method === "tools/list") {
+                return reply({
+                    tools: [
+                        {
+                            name: "echo",
+                            description: "Echoes the given text back.",
+                            inputSchema: {
+                                type: "object",
+                                properties: { text: { type: "string" } },
+                                required: ["text"],
+                            },
+                        },
+                        {
+                            name: "delete_thing",
+                            description: "Deletes a thing by id.",
+                            inputSchema: {
+                                type: "object",
+                                properties: { id: { type: "string" } },
+                                required: ["id"],
+                            },
+                            annotations: { destructiveHint: true },
+                        },
+                    ],
+                });
+            }
+            if (body.method === "tools/call") {
+                if (opts.stallToolsCall === true)
+                    return new Promise(() => { });
+                const params = ToolCallParams(body.params);
+                if (params instanceof type.errors) {
+                    return new Response("bad request", { status: 400 });
+                }
+                if (params.name === "echo") {
+                    return reply({ content: params.arguments.text });
+                }
+                if (params.name === "delete_thing") {
+                    return reply({ content: `deleted ${String(params.arguments.id)}` });
+                }
+                return reply({ content: `unknown tool ${params.name}`, isError: true });
+            }
+            return new Response("not found", { status: 404 });
+        },
+    });
+    return {
+        url: new URL("mcp", server.url).toString(),
+        requestsSeen,
+        stop: () => {
+            void server.stop(true);
+        },
+    };
+}

package/dist/tool.d.ts

@@ -25,6 +25,8 @@ export interface McpToolsOptions {
      * that flag wins no matter what the operator lists here.
      */
     allowWithoutAsk?: string[];
+    /** Per-request bound on every MCP round trip; defaults to 60s. */
+    timeoutMs?: number;
 }
 /**
  * Discover every server's tool catalog and build the `@corbits/mcp` tool

package/dist/tool.js

@@ -2,8 +2,8 @@
 // each is grantable individually. Discovery runs up front because
 // `createAgent` calls a tool factory synchronously.
 import { defineTool, } from "@intx/agent";
-import { mcpCallTool, mcpInitialize, mcpListTools, } from "./client.js";
-import { isAskExempt, qualifiedName, toolDescription } from "./naming.js";
+import { DEFAULT_TIMEOUT_MS, mcpCallTool, mcpInitialize, mcpListTools, } from "./client.js";
+import { assertCatalogNames, assertServers, isAskExempt, qualifiedName, toolDescription, } from "./naming.js";
 async function resolveFetch(server, credentials) {
     if (server.credentialHandle === undefined)
         return undefined;
@@ -23,12 +23,18 @@ async function resolveFetch(server, credentials) {
  */
 export async function mcpTools(options, discoveryEnv = {}) {
     const allowWithoutAsk = options.allowWithoutAsk ?? [];
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    assertServers(options.servers, "MCP server name");
     const discovered = [];
     for (const server of options.servers) {
         const clientFetch = await resolveFetch(server, discoveryEnv.credentials);
-        const clientOpts = clientFetch !== undefined ? { fetch: clientFetch } : {};
-        await mcpInitialize(server.url, clientOpts);
-        const tools = await mcpListTools(server.url, clientOpts);
+        const clientOpts = {
+            ...(clientFetch !== undefined ? { fetch: clientFetch } : {}),
+            timeoutMs,
+        };
+        const session = await mcpInitialize(server.url, clientOpts);
+        const tools = await mcpListTools(server.url, { ...clientOpts, session });
+        assertCatalogNames(server.name, tools);
         for (const tool of tools) {
             discovered.push({
                 server,
@@ -60,9 +66,28 @@ export async function mcpTools(options, discoveryEnv = {}) {
             for (const server of options.servers) {
                 fetchByServer.set(server.name, resolveFetch(server, env.credentials));
             }
+            // One session per server, opened on first use and reopened after a
+            // failed call in case the server expired it.
+            const clientByServer = new Map();
+            function connect(server) {
+                let client = clientByServer.get(server.name);
+                if (client === undefined) {
+                    client = (async () => {
+                        const clientFetch = await fetchByServer.get(server.name);
+                        const opts = {
+                            ...(clientFetch !== undefined ? { fetch: clientFetch } : {}),
+                            timeoutMs,
+                        };
+                        const session = await mcpInitialize(server.url, opts);
+                        return { ...opts, session };
+                    })();
+                    clientByServer.set(server.name, client);
+                }
+                return client;
+            }
             return {
                 definitions: toolDefinitions,
-                async run(call, _signal) {
+                async run(call, signal) {
                     const found = byName.get(call.name);
                     if (found === undefined) {
                         return {
@@ -72,8 +97,15 @@ export async function mcpTools(options, discoveryEnv = {}) {
                         };
                     }
                     try {
-                        const clientFetch = await fetchByServer.get(found.server.name);
-                        const result = await mcpCallTool(found.server.url, found.tool.name, call.arguments, clientFetch !== undefined ? { fetch: clientFetch } : {});
+                        const result = await connect(found.server)
+                            .then((client) => mcpCallTool(found.server.url, found.tool.name, call.arguments, {
+                            ...client,
+                            signal,
+                        }))
+                            .catch((cause) => {
+                            clientByServer.delete(found.server.name);
+                            throw cause;
+                        });
                         return {
                             callId: call.id,
                             isError: result.isError === true,