@crush-protocol/mcp-client 0.1.14 → 0.3.0

package/dist/cli.js

@@ -2,9 +2,12 @@
 import "dotenv/config";
 import { BacktestClient } from "./backtest/backtestClient.js";
 import { ClickHouseDirectClient } from "./clickhouse/directClient.js";
+import { OAuthRemoteMcpClient } from "./mcp/oauthRemoteClient.js";
 import { RemoteMcpClient } from "./mcp/remoteClient.js";
+import { installClientConfig } from "./setup/setupClients.js";
+const DEFAULT_MCP_SERVER_URL = "https://crush-mcp-ats.dev.xexlab.com/mcp";
 const printUsage = () => {
-    console.log(`\ncrush-mcp-client\n\nGeneral:\n  tools:list [--url URL] [--token TOKEN]\n  tool:call --name TOOL_NAME [--args JSON] [--url URL] [--token TOKEN]\n  ping [--url URL] [--token TOKEN]\n\nBacktest:\n  backtest:schema [--url URL] [--token TOKEN]\n  backtest:tokens [--platform PLATFORM] [--url URL] [--token TOKEN]\n  backtest:validate --expression JSON [--data-source kline|factors] [--url URL] [--token TOKEN]\n  backtest:create --config JSON [--backtest-id ID] [--url URL] [--token TOKEN]\n  backtest:get --backtest-id ID [--url URL] [--token TOKEN]\n  backtest:list [--status STATUS] [--limit N] [--offset N] [--url URL] [--token TOKEN]\n\nClickHouse:\n  clickhouse:list-tables [--ch-host HOST --ch-port PORT --ch-user USER --ch-password PASS --ch-database DB]\n  clickhouse:query --sql SQL [--ch-host HOST --ch-port PORT --ch-user USER --ch-password PASS --ch-database DB --ch-row-cap N]\n\nEnv fallback:\n  CRUSH_MCP_SERVER_URL, CRUSH_MCP_TOKEN\n  CH_HOST, CH_PORT, CH_USER, CH_PASSWORD, CH_DATABASE, CH_ROW_CAP\n`);
+    console.log(`\ncrush-mcp-client\n\nGeneral:\n  login [--url URL]\n  setup [--cursor] [--claude] [--codex] [--gemini] [--opencode] [--all] [--scope user|project] [--url URL]\n  tools:list [--url URL] [--token TOKEN]\n  tool:call --name TOOL_NAME [--args JSON] [--url URL] [--token TOKEN]\n  ping [--url URL] [--token TOKEN]\n\nBacktest:\n  backtest:schema [--url URL] [--token TOKEN]\n  backtest:tokens [--platform PLATFORM] [--url URL] [--token TOKEN]\n  backtest:validate --expression JSON [--data-source kline|factors] [--url URL] [--token TOKEN]\n  backtest:create --config JSON [--backtest-id ID] [--url URL] [--token TOKEN]\n  backtest:list [--status STATUS] [--limit N] [--offset N] [--url URL] [--token TOKEN]\n\nClickHouse:\n  clickhouse:list-tables [--ch-host HOST --ch-port PORT --ch-user USER --ch-password PASS --ch-database DB]\n  clickhouse:query --sql SQL [--ch-host HOST --ch-port PORT --ch-user USER --ch-password PASS --ch-database DB --ch-row-cap N]\n\nAuth:\n  --token TOKEN uses a provided OAuth access token.\n  Without --token, OAuth runs automatically in the browser when needed.\n\nEnv:\n  CRUSH_MCP_SERVER_URL, CRUSH_OAUTH_ACCESS_TOKEN\n  CH_HOST, CH_PORT, CH_USER, CH_PASSWORD, CH_DATABASE, CH_ROW_CAP\n`);
 };
 const parseFlags = (args) => {
     const flags = {};
@@ -29,34 +32,60 @@ const requireString = (value, message) => {
     }
     return value;
 };
-const createRemoteClient = (flags) => {
-    const serverUrl = typeof flags.url === "string"
-        ? flags.url
-        : (process.env.CRUSH_MCP_SERVER_URL ?? "https://mcp.crush-protocol.com/mcp");
-    const token = typeof flags.token === "string"
-        ? flags.token
-        : requireString(process.env.CRUSH_MCP_TOKEN, "Missing token. Use --token or CRUSH_MCP_TOKEN");
-    return new RemoteMcpClient({ serverUrl, token });
+const getServerUrl = (flags) => typeof flags.url === "string"
+    ? flags.url
+    : (process.env.CRUSH_MCP_SERVER_URL ?? DEFAULT_MCP_SERVER_URL);
+const getSetupTargets = (flags) => {
+    const explicitTargets = ["cursor", "claude", "codex", "gemini", "opencode"].filter((target) => flags[target] === true);
+    if (flags.all === true) {
+        return ["cursor", "claude", "codex", "gemini", "opencode"];
+    }
+    return explicitTargets;
+};
+/**
+ * 创建 MCP 客户端（统一认证入口）
+ *
+ * 优先级：
+ * 1. --token 参数 → 直接使用（适用于 CI/脚本）
+ * 2. CRUSH_OAUTH_ACCESS_TOKEN 环境变量 → 直接使用
+ * 3. 以上都没有 → 走 OAuthRemoteMcpClient 自动 OAuth 流程
+ *    - 本地有缓存 token → 直接用
+ *    - token 过期 → 自动 refresh
+ *    - 无 token → 自动拉起浏览器登录
+ */
+const createSmartClient = (flags) => {
+    const serverUrl = getServerUrl(flags);
+    // 显式传了 token → 用简单客户端
+    const explicitToken = typeof flags.token === "string" ? flags.token : process.env.CRUSH_OAUTH_ACCESS_TOKEN || "";
+    if (explicitToken) {
+        return {
+            client: new RemoteMcpClient({ serverUrl, token: explicitToken }),
+            needsOAuthConnect: false,
+        };
+    }
+    // 否则走 OAuth 自动流程
+    return {
+        client: new OAuthRemoteMcpClient({ serverUrl }),
+        needsOAuthConnect: true,
+    };
+};
+const connectClient = async (flags) => {
+    const { client, needsOAuthConnect } = createSmartClient(flags);
+    if (needsOAuthConnect) {
+        await client.connect();
+    }
+    else {
+        await client.connect();
+    }
+    return client;
 };
 const createClickHouseClient = (flags) => {
-    const host = typeof flags["ch-host"] === "string"
-        ? flags["ch-host"]
-        : (process.env.CH_HOST ?? "localhost");
-    const portRaw = typeof flags["ch-port"] === "string"
-        ? flags["ch-port"]
-        : (process.env.CH_PORT ?? "8123");
-    const user = typeof flags["ch-user"] === "string"
-        ? flags["ch-user"]
-        : (process.env.CH_USER ?? "default");
-    const password = typeof flags["ch-password"] === "string"
-        ? flags["ch-password"]
-        : (process.env.CH_PASSWORD ?? "");
-    const database = typeof flags["ch-database"] === "string"
-        ? flags["ch-database"]
-        : (process.env.CH_DATABASE ?? "crush_ats");
-    const rowCapRaw = typeof flags["ch-row-cap"] === "string"
-        ? flags["ch-row-cap"]
-        : process.env.CH_ROW_CAP;
+    const host = typeof flags["ch-host"] === "string" ? flags["ch-host"] : (process.env.CH_HOST ?? "localhost");
+    const portRaw = typeof flags["ch-port"] === "string" ? flags["ch-port"] : (process.env.CH_PORT ?? "8123");
+    const user = typeof flags["ch-user"] === "string" ? flags["ch-user"] : (process.env.CH_USER ?? "default");
+    const password = typeof flags["ch-password"] === "string" ? flags["ch-password"] : (process.env.CH_PASSWORD ?? "");
+    const database = typeof flags["ch-database"] === "string" ? flags["ch-database"] : (process.env.CH_DATABASE ?? "crush_ats");
+    const rowCapRaw = typeof flags["ch-row-cap"] === "string" ? flags["ch-row-cap"] : process.env.CH_ROW_CAP;
     const port = Number(portRaw);
     if (!Number.isFinite(port) || port <= 0) {
         throw new Error(`Invalid ClickHouse port: ${portRaw}`);
@@ -80,18 +109,43 @@ const createClickHouseClient = (flags) => {
 };
 const run = async () => {
     const [, , command, ...rest] = process.argv;
-    if (!command ||
-        command === "help" ||
-        command === "--help" ||
-        command === "-h") {
+    if (!command || command === "help" || command === "--help" || command === "-h") {
         printUsage();
         return;
     }
     const flags = parseFlags(rest);
     switch (command) {
+        case "login": {
+            const serverUrl = getServerUrl(flags);
+            const client = new OAuthRemoteMcpClient({ serverUrl });
+            try {
+                await client.ensureAuthorized();
+                console.log("OAuth authorization is ready. Tokens are stored locally.");
+            }
+            finally {
+                await client.close();
+            }
+            return;
+        }
+        case "setup": {
+            const targets = getSetupTargets(flags);
+            if (targets.length === 0) {
+                throw new Error("Specify at least one setup target: --cursor, --claude, --codex, --gemini, --opencode, or --all");
+            }
+            const rawScope = typeof flags.scope === "string" ? flags.scope : "user";
+            if (rawScope !== "user" && rawScope !== "project") {
+                throw new Error("Invalid --scope. Expected 'user' or 'project'.");
+            }
+            const scope = rawScope;
+            const serverUrl = getServerUrl(flags);
+            for (const target of targets) {
+                const location = installClientConfig(target, serverUrl, scope);
+                console.log(`[setup] ${target}: configured (${location})`);
+            }
+            return;
+        }
         case "tools:list": {
-            const client = createRemoteClient(flags);
-            await client.connect();
+            const client = await connectClient(flags);
             try {
                 const result = await client.listTools();
                 console.log(JSON.stringify(result, null, 2));
@@ -111,8 +165,7 @@ const run = async () => {
             catch (e) {
                 throw new Error(`Invalid --args JSON: ${e.message}`);
             }
-            const client = createRemoteClient(flags);
-            await client.connect();
+            const client = await connectClient(flags);
             try {
                 const result = await client.callTool(name, parsedArgs);
                 console.log(JSON.stringify(result, null, 2));
@@ -123,8 +176,7 @@ const run = async () => {
             return;
         }
         case "ping": {
-            const client = createRemoteClient(flags);
-            await client.connect();
+            const client = await connectClient(flags);
             try {
                 const result = await client.ping();
                 console.log(JSON.stringify(result, null, 2));
@@ -135,8 +187,7 @@ const run = async () => {
             return;
         }
         case "backtest:schema": {
-            const client = createRemoteClient(flags);
-            await client.connect();
+            const client = await connectClient(flags);
             try {
                 const bt = new BacktestClient(client);
                 const result = await bt.getConfigSchema();
@@ -148,8 +199,7 @@ const run = async () => {
             return;
         }
         case "backtest:tokens": {
-            const client = createRemoteClient(flags);
-            await client.connect();
+            const client = await connectClient(flags);
             try {
                 const bt = new BacktestClient(client);
                 const platform = typeof flags.platform === "string" ? flags.platform : undefined;
@@ -174,11 +224,8 @@ const run = async () => {
             catch (e) {
                 throw new Error(`Invalid --expression JSON: ${e.message}`);
             }
-            const dataSource = typeof flags["data-source"] === "string"
-                ? flags["data-source"]
-                : undefined;
-            const client = createRemoteClient(flags);
-            await client.connect();
+            const dataSource = typeof flags["data-source"] === "string" ? flags["data-source"] : undefined;
+            const client = await connectClient(flags);
             try {
                 const bt = new BacktestClient(client);
                 const result = await bt.validateExpression({ expression, dataSource });
@@ -198,11 +245,8 @@ const run = async () => {
             catch (e) {
                 throw new Error(`Invalid --config JSON: ${e.message}`);
             }
-            const backtestId = typeof flags["backtest-id"] === "string"
-                ? flags["backtest-id"]
-                : undefined;
-            const client = createRemoteClient(flags);
-            await client.connect();
+            const backtestId = typeof flags["backtest-id"] === "string" ? flags["backtest-id"] : undefined;
+            const client = await connectClient(flags);
             try {
                 const bt = new BacktestClient(client);
                 const result = await bt.createBacktest({ config, backtestId });
@@ -213,28 +257,11 @@ const run = async () => {
             }
             return;
         }
-        case "backtest:get": {
-            const backtestId = requireString(flags["backtest-id"], "Missing --backtest-id for backtest:get");
-            const client = createRemoteClient(flags);
-            await client.connect();
-            try {
-                const bt = new BacktestClient(client);
-                const result = await bt.getResult({ backtestId });
-                console.log(JSON.stringify(result, null, 2));
-            }
-            finally {
-                await client.close();
-            }
-            return;
-        }
         case "backtest:list": {
-            const status = typeof flags.status === "string"
-                ? flags.status
-                : undefined;
+            const status = typeof flags.status === "string" ? flags.status : undefined;
             const limit = typeof flags.limit === "string" ? Number(flags.limit) : undefined;
             const offset = typeof flags.offset === "string" ? Number(flags.offset) : undefined;
-            const client = createRemoteClient(flags);
-            await client.connect();
+            const client = await connectClient(flags);
             try {
                 const bt = new BacktestClient(client);
                 const result = await bt.list({ status, limit, offset });

package/dist/index.d.ts

@@ -1,3 +1,6 @@
-export { ClickHouseDirectClient, DEFAULT_ROW_CAP, type ClickHouseDirectConfig, } from "./clickhouse/directClient.js";
+export { BacktestClient, type BacktestConfigSchema, type BacktestRecord, type CreateBacktestInput, type GetAvailableTokensInput, type ListBacktestsInput, type ListBacktestsResult, type TokenInfo, type ValidationResult, } from "./backtest/backtestClient.js";
+export { ClickHouseDirectClient, type ClickHouseDirectConfig, DEFAULT_ROW_CAP, } from "./clickhouse/directClient.js";
+export { InteractiveOAuthProvider, type InteractiveOAuthProviderOptions, } from "./mcp/oauthProvider.js";
+export { OAuthRemoteMcpClient, type OAuthRemoteMcpClientOptions, } from "./mcp/oauthRemoteClient.js";
 export { RemoteMcpClient, type RemoteMcpClientOptions, } from "./mcp/remoteClient.js";
-export { BacktestClient, type BacktestConfigSchema, type BacktestRecord, type CreateBacktestInput, type GetAvailableTokensInput, type GetBacktestResultInput, type ListBacktestsInput, type ListBacktestsResult, type TokenInfo, type ValidationResult, } from "./backtest/backtestClient.js";
+export type { McpClientLike } from "./mcp/types.js";

package/dist/index.js

@@ -1,3 +1,5 @@
+export { BacktestClient, } from "./backtest/backtestClient.js";
 export { ClickHouseDirectClient, DEFAULT_ROW_CAP, } from "./clickhouse/directClient.js";
+export { InteractiveOAuthProvider, } from "./mcp/oauthProvider.js";
+export { OAuthRemoteMcpClient, } from "./mcp/oauthRemoteClient.js";
 export { RemoteMcpClient, } from "./mcp/remoteClient.js";
-export { BacktestClient, } from "./backtest/backtestClient.js";

package/dist/mcp/oauthProvider.d.ts

@@ -0,0 +1,42 @@
+import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+export type InteractiveOAuthProviderOptions = {
+    serverUrl: string;
+    clientName?: string;
+    clientVersion?: string;
+    scope?: string;
+    redirectPort?: number;
+    redirectPath?: string;
+    storageDir?: string;
+    openBrowser?: boolean;
+    onAuthorizationUrl?: (authorizationUrl: URL) => void | Promise<void>;
+};
+export declare class InteractiveOAuthProvider implements OAuthClientProvider {
+    private readonly options;
+    readonly redirectUrl: URL;
+    private readonly storageFile;
+    private readonly scope;
+    private readonly openBrowserByDefault;
+    private readonly onAuthorizationUrl?;
+    private callbackServer?;
+    private pendingAuthorization?;
+    constructor(options: InteractiveOAuthProviderOptions);
+    get clientMetadata(): OAuthClientMetadata;
+    state(): Promise<string>;
+    clientInformation(): Promise<OAuthClientInformationMixed | undefined>;
+    saveClientInformation(clientInformation: OAuthClientInformationMixed): Promise<void>;
+    tokens(): Promise<OAuthTokens | undefined>;
+    saveTokens(tokens: OAuthTokens): Promise<void>;
+    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    saveCodeVerifier(codeVerifier: string): Promise<void>;
+    codeVerifier(): Promise<string>;
+    invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier"): Promise<void>;
+    waitForAuthorizationCode(): Promise<string>;
+    close(): Promise<void>;
+    private loadState;
+    private saveState;
+    private createPendingAuthorization;
+    private ensureCallbackServer;
+    private closeCallbackServer;
+    private handleCallbackRequest;
+}

package/dist/mcp/oauthProvider.js

@@ -0,0 +1,264 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import os from "node:os";
+import path from "node:path";
+const DEFAULT_SCOPE = "mcp:tools";
+const DEFAULT_REDIRECT_PORT = 8787;
+const DEFAULT_REDIRECT_PATH = "/oauth/callback";
+const renderCallbackHtml = (title, message) => `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>${title}</title>
+  <style>
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+      background: linear-gradient(135deg, #f6f7fb, #eef2ff);
+      color: #0f172a;
+    }
+    main {
+      max-width: 560px;
+      padding: 32px;
+      border-radius: 20px;
+      background: rgba(255, 255, 255, 0.96);
+      box-shadow: 0 20px 45px rgba(15, 23, 42, 0.14);
+      text-align: center;
+    }
+    h1 {
+      margin: 0 0 12px;
+      font-size: 28px;
+    }
+    p {
+      margin: 0;
+      line-height: 1.6;
+      color: #334155;
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>${title}</h1>
+    <p>${message}</p>
+  </main>
+</body>
+</html>`;
+const defaultStorageDir = () => path.join(os.homedir(), ".crush-mcp");
+const hashServerUrl = (serverUrl) => createHash("sha256").update(serverUrl).digest("hex").slice(0, 16);
+const openBrowser = async (authorizationUrl) => {
+    const url = authorizationUrl.toString();
+    if (process.env.BROWSER) {
+        spawn(process.env.BROWSER, [url], { stdio: "ignore", detached: true }).unref();
+        return;
+    }
+    if (process.platform === "darwin") {
+        spawn("open", [url], { stdio: "ignore", detached: true }).unref();
+        return;
+    }
+    if (process.platform === "win32") {
+        spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
+        return;
+    }
+    spawn("xdg-open", [url], { stdio: "ignore", detached: true }).unref();
+};
+export class InteractiveOAuthProvider {
+    options;
+    redirectUrl;
+    storageFile;
+    scope;
+    openBrowserByDefault;
+    onAuthorizationUrl;
+    callbackServer;
+    pendingAuthorization;
+    constructor(options) {
+        this.options = options;
+        const redirectPort = options.redirectPort ?? DEFAULT_REDIRECT_PORT;
+        const redirectPath = options.redirectPath ?? DEFAULT_REDIRECT_PATH;
+        this.redirectUrl = new URL(`http://127.0.0.1:${redirectPort}${redirectPath}`);
+        this.scope = options.scope ?? DEFAULT_SCOPE;
+        this.openBrowserByDefault = options.openBrowser ?? true;
+        const storageDir = options.storageDir ?? defaultStorageDir();
+        this.storageFile = path.join(storageDir, `oauth-${hashServerUrl(options.serverUrl)}.json`);
+        this.onAuthorizationUrl = options.onAuthorizationUrl;
+    }
+    get clientMetadata() {
+        return {
+            client_name: this.options.clientName ?? "Crush MCP Client",
+            grant_types: ["authorization_code", "refresh_token"],
+            redirect_uris: [this.redirectUrl.toString()],
+            response_types: ["code"],
+            scope: this.scope,
+            software_version: this.options.clientVersion,
+            token_endpoint_auth_method: "none",
+        };
+    }
+    async state() {
+        return randomBytes(16).toString("hex");
+    }
+    async clientInformation() {
+        const data = await this.loadState();
+        return data.clientInformation;
+    }
+    async saveClientInformation(clientInformation) {
+        const data = await this.loadState();
+        data.clientInformation = clientInformation;
+        await this.saveState(data);
+    }
+    async tokens() {
+        const data = await this.loadState();
+        return data.tokens;
+    }
+    async saveTokens(tokens) {
+        const data = await this.loadState();
+        data.tokens = tokens;
+        await this.saveState(data);
+    }
+    async redirectToAuthorization(authorizationUrl) {
+        this.createPendingAuthorization();
+        await this.ensureCallbackServer();
+        if (this.onAuthorizationUrl) {
+            await this.onAuthorizationUrl(authorizationUrl);
+        }
+        if (this.openBrowserByDefault) {
+            try {
+                await openBrowser(authorizationUrl);
+            }
+            catch {
+                // Fall back to printing the URL when no browser launcher is available.
+            }
+        }
+        process.stdout.write(`\nOpen this URL to authorize Crush MCP:\n${authorizationUrl.toString()}\n\n`);
+    }
+    async saveCodeVerifier(codeVerifier) {
+        const data = await this.loadState();
+        data.codeVerifier = codeVerifier;
+        await this.saveState(data);
+    }
+    async codeVerifier() {
+        const data = await this.loadState();
+        if (!data.codeVerifier) {
+            throw new Error("Missing PKCE code verifier. Restart the OAuth flow.");
+        }
+        return data.codeVerifier;
+    }
+    async invalidateCredentials(scope) {
+        const data = await this.loadState();
+        if (scope === "all") {
+            await rm(this.storageFile, { force: true });
+            return;
+        }
+        if (scope === "client") {
+            delete data.clientInformation;
+        }
+        if (scope === "tokens") {
+            delete data.tokens;
+        }
+        if (scope === "verifier") {
+            delete data.codeVerifier;
+        }
+        await this.saveState(data);
+    }
+    async waitForAuthorizationCode() {
+        if (!this.pendingAuthorization) {
+            this.createPendingAuthorization();
+        }
+        return this.pendingAuthorization.promise;
+    }
+    async close() {
+        await this.closeCallbackServer();
+    }
+    async loadState() {
+        try {
+            const raw = await readFile(this.storageFile, "utf8");
+            return JSON.parse(raw);
+        }
+        catch (error) {
+            const err = error;
+            if (err.code === "ENOENT") {
+                return {};
+            }
+            throw error;
+        }
+    }
+    async saveState(data) {
+        await mkdir(path.dirname(this.storageFile), { recursive: true });
+        await writeFile(this.storageFile, JSON.stringify(data, null, 2), "utf8");
+    }
+    createPendingAuthorization() {
+        let resolve;
+        let reject;
+        const promise = new Promise((innerResolve, innerReject) => {
+            resolve = innerResolve;
+            reject = innerReject;
+        });
+        this.pendingAuthorization = { promise, resolve, reject };
+        return this.pendingAuthorization;
+    }
+    async ensureCallbackServer() {
+        if (this.callbackServer) {
+            return;
+        }
+        this.callbackServer = createServer((req, res) => {
+            void this.handleCallbackRequest(req, res);
+        });
+        await new Promise((resolve, reject) => {
+            this.callbackServer.once("error", (error) => reject(error));
+            this.callbackServer.listen(Number(this.redirectUrl.port), this.redirectUrl.hostname, () => resolve());
+        });
+    }
+    async closeCallbackServer() {
+        if (!this.callbackServer) {
+            return;
+        }
+        const server = this.callbackServer;
+        this.callbackServer = undefined;
+        await new Promise((resolve, reject) => {
+            server.close((error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve();
+            });
+        });
+    }
+    async handleCallbackRequest(req, res) {
+        const requestUrl = new URL(req.url || "/", this.redirectUrl);
+        if (requestUrl.pathname !== this.redirectUrl.pathname) {
+            res.statusCode = 404;
+            res.end("Not found");
+            return;
+        }
+        const error = requestUrl.searchParams.get("error");
+        const errorDescription = requestUrl.searchParams.get("error_description");
+        const code = requestUrl.searchParams.get("code");
+        res.setHeader("Content-Type", "text/html; charset=utf-8");
+        if (error) {
+            res.statusCode = 400;
+            res.end(renderCallbackHtml("Authorization failed", errorDescription || error));
+            this.pendingAuthorization?.reject(new Error(errorDescription || error));
+            this.pendingAuthorization = undefined;
+            await this.closeCallbackServer();
+            return;
+        }
+        if (!code) {
+            res.statusCode = 400;
+            res.end(renderCallbackHtml("Authorization failed", "Missing authorization code."));
+            this.pendingAuthorization?.reject(new Error("Missing authorization code in callback."));
+            this.pendingAuthorization = undefined;
+            await this.closeCallbackServer();
+            return;
+        }
+        res.statusCode = 200;
+        res.end(renderCallbackHtml("Authorization complete", "You can close this tab and return to your MCP client."));
+        this.pendingAuthorization?.resolve(code);
+        this.pendingAuthorization = undefined;
+        await this.closeCallbackServer();
+    }
+}