@inferencesh/sdk 0.26.0 → 0.26.2

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Added: `mcpTool(name, { server, toolName, credentialId? })` names the MCP server by its slug (the API's model: a server declares the provider it signs in through); `credentialId` pins one connection. The old `mcpTool(name, credentialId, toolName)` still works (deprecated): the API saves such a tool with the server the connection's provider is declared by. `MCPServerUpdateBody` gains `credentials`; its `auth_type`, `oauth_client_id` and `oauth_secret_key` are no longer read by the API (the provider's OAuth app is set through `PUT /credentials/{slug}/app`). Generated types: `MCPToolConfig.server`; `MCPServerDTO.oauth_client_id`, `CredentialProviderMCP` and `CredentialTypeMCP` are gone from the API.
+
+### Changed
+
+- Generated types follow the API: `MCPToolConfig` is `{ server, tool_name, credential_id? }`; `MCPServerDTO` loses `oauth_client_id`; `CredentialProviderMCP` and `CredentialTypeMCP` are gone (a credential of an MCP provider has type `oauth` or `api_key` and the provider slug the server declares in `credential_slug`).
+
+## [0.26.1] - 2026-10-12
+
+### Added
+
+- Generated types follow the API: `AuthSchemeSpec` gains `resource`, `issuer`, `authorization_response_iss_parameter_supported`, `callback` and `profile`, and `AuthSchemeClientAuth` adds `"none"`.
+
 ## [0.26.0] - 2026-10-12
 
 Breaking (types only, following the API's credential model): `CredentialRequirement.provider` is now a `ProviderSeed` object (`{ name?, website? }`) instead of a string, and the requirement's `name`, `website` and `key` fields moved into it. Requirements are keyed by slug.

package/README.md

@@ -377,7 +377,7 @@ Use the fluent builders to define `AgentTool` schemas. Client tools (`tool`) run
 | `agentTool(name, agentRef)` | Server | Delegate to a sub-agent |
 | `httpTool(name, url)` / `callTool(name, url)` | Server | HTTP request with credential injection (preferred over `webhookTool`) |
 | `webhookTool(name, url)` | Server | Unsigned webhook (legacy; use `httpTool` for new tools) |
-| `mcpTool(name, credentialId, toolName)` | Server | Call a tool through a connected MCP credential |
+| `mcpTool(name, { server, toolName, credentialId? })` | Server | Call a tool on an MCP server (by slug), signed in through the server's provider; `credentialId` pins one connection. `mcpTool(name, credentialId, toolName)` still works and is saved with the connection's server |
 | `internalTools()` | Server | Built-in tools: plan, memory, widget, finish, skills, meta, remote, knowledge, artifact, agent |
 
 ```typescript
@@ -420,7 +420,8 @@ const imageGen = appTool('generate_image', 'infsh/flux-schnell@abc123')
   .requireApproval()
   .build();
 
-const mcpSearch = mcpTool('notion_search', 'your-mcp-credential-id', 'search')
+// MCP server by slug; the runner's connection to its provider signs the call
+const mcpSearch = mcpTool('notion_search', { server: 'notion', toolName: 'search' })
   .describe('Search Notion pages')
   .param('query', string('Search query'))
   .build();
@@ -689,8 +690,8 @@ try {
 
 | Constant group | Values |
 |----------------|--------|
-| `CredentialProvider*` | `google`, `slack`, `notion`, `github`, `x`, `microsoft`, `salesforce`, `discord`, `gcp`, `mcp`, `reddit` |
-| `CredentialType*` | `service_account`, `oauth`, `api_key`, `wif`, `mcp` |
+| `CredentialProvider*` | `google`, `google-sa`, `slack`, `notion`, `github`, `x`, `microsoft`, `salesforce`, `discord`, `gcp`, `reddit` |
+| `CredentialType*` | `service_account`, `oauth`, `api_key`, `wif` |
 | `CredentialStatus*` | `connected`, `disconnected`, `expired`, `error` |
 
 ## Instance Status Constants

package/dist/api/write-bodies.d.ts

@@ -12,7 +12,7 @@
  * chats, engines and teams send PATCH; apps.patch and flows.patch are the
  * partial siblings of the POST updates that also edit a version.
  */
-import type { AgentConfigInput, AgentImages, AppDTO, ChatDTO, EngineDTO, FlowDTO, FlowVersionDTO, KnowledgeDTO, MCPServerAuthType, ProjectDTO, TeamDTO, Visibility } from '../types.js';
+import type { AgentConfigInput, AgentImages, AppDTO, ChatDTO, CredentialRequirements, EngineDTO, FlowDTO, FlowVersionDTO, KnowledgeDTO, ProjectDTO, TeamDTO, Visibility } from '../types.js';
 /**
  * POST /agents/{id}. Visibility and images, and a new version when
  * `version` is set. Name, title, harness, placement: set at creation.
@@ -88,9 +88,12 @@ export type TeamUpdateBody = Partial<Pick<TeamDTO, 'name' | 'email' | 'avatar_ur
 /**
  * PUT /mcp-servers/{id}. A field left out keeps its value. Title,
  * description, icon URL and documentation URL take what is sent, and ""
- * clears them; slug, name, server URL, auth type and the OAuth client
- * change only to a non-empty value. Headers sent replace the set ({}
- * clears it). Visibility: `POST /mcp-servers/{id}/visibility`.
+ * clears them; slug, name and server URL change only to a non-empty value.
+ * Headers sent replace the set ({} clears it); default scopes sent replace
+ * the list; `credentials` sent replace the declaration of the provider the
+ * server signs in through ([] clears it). Auth type is the server's own
+ * report. The provider's OAuth app: `PUT /credentials/{slug}/app`.
+ * Visibility: `POST /mcp-servers/{id}/visibility`.
  */
 export interface MCPServerUpdateBody {
     slug?: string;
@@ -99,12 +102,10 @@ export interface MCPServerUpdateBody {
     description?: string;
     icon_url?: string;
     server_url?: string;
-    auth_type?: MCPServerAuthType;
-    oauth_client_id?: string;
-    oauth_secret_key?: string;
     default_scopes?: string[];
     headers?: {
         [key: string]: string;
     };
     documentation_url?: string;
+    credentials?: CredentialRequirements;
 }

package/dist/tool-builder.d.ts

@@ -113,13 +113,29 @@ export declare const webhookTool: (name: string, url: string) => WebhookToolBuil
 export declare const httpTool: (name: string, url: string) => HTTPToolBuilder;
 /** Create a call tool — makes authenticated HTTP requests. Preferred name for httpTool. */
 export declare const callTool: (name: string, url: string) => HTTPToolBuilder;
-/** Create an MCP connector tool (calls a tool on a connected MCP server) */
-/** `credentialId` is the MCP credential the tool runs through. */
-export declare const mcpTool: (name: string, credentialId: string, toolName: string) => MCPToolBuilder;
+/** What an MCP tool calls: a tool on a server, named by the server's slug. */
+export interface MCPToolTarget {
+    /** The MCP server's slug (a workspace registration or a directory entry). */
+    server: string;
+    toolName: string;
+    /** Pins one connection to the server's provider; by default the runner's own is used. */
+    credentialId?: string;
+}
+/**
+ * Create an MCP tool: `toolName` on the MCP server `target.server` (its slug).
+ * The call signs in with the runner's connection to the server's provider;
+ * `credentialId` pins one connection instead.
+ *
+ * The older form `mcpTool(name, credentialId, toolName)` (a string second
+ * argument) still works: a tool naming only a connection is saved with the
+ * server that connection's provider is declared by.
+ */
+export declare function mcpTool(name: string, target: MCPToolTarget | string, toolName?: string): MCPToolBuilder;
 declare class MCPToolBuilder extends ToolBuilder {
-    private credentialId;
-    private toolName;
-    constructor(name: string, credentialId: string, toolName: string);
+    private target;
+    constructor(name: string, target: Partial<MCPToolTarget> & {
+        toolName: string;
+    });
     build(): AgentTool;
 }
 declare class InternalToolsBuilder {

package/dist/tool-builder.js

@@ -236,14 +236,25 @@ export const webhookTool = (name, url) => new WebhookToolBuilder(name, url);
 export const httpTool = (name, url) => new HTTPToolBuilder(name, url);
 /** Create a call tool — makes authenticated HTTP requests. Preferred name for httpTool. */
 export const callTool = (name, url) => new HTTPToolBuilder(name, url);
-/** Create an MCP connector tool (calls a tool on a connected MCP server) */
-/** `credentialId` is the MCP credential the tool runs through. */
-export const mcpTool = (name, credentialId, toolName) => new MCPToolBuilder(name, credentialId, toolName);
+/**
+ * Create an MCP tool: `toolName` on the MCP server `target.server` (its slug).
+ * The call signs in with the runner's connection to the server's provider;
+ * `credentialId` pins one connection instead.
+ *
+ * The older form `mcpTool(name, credentialId, toolName)` (a string second
+ * argument) still works: a tool naming only a connection is saved with the
+ * server that connection's provider is declared by.
+ */
+export function mcpTool(name, target, toolName) {
+    if (typeof target === 'string') {
+        return new MCPToolBuilder(name, { toolName: toolName ?? '', credentialId: target });
+    }
+    return new MCPToolBuilder(name, target);
+}
 class MCPToolBuilder extends ToolBuilder {
-    constructor(name, credentialId, toolName) {
+    constructor(name, target) {
         super(name);
-        this.credentialId = credentialId;
-        this.toolName = toolName;
+        this.target = target;
     }
     build() {
         return {
@@ -252,7 +263,11 @@ class MCPToolBuilder extends ToolBuilder {
             description: this.desc,
             type: ToolTypeMCP,
             require_approval: this.approval || undefined,
-            mcp: { credential_id: this.credentialId, tool_name: this.toolName },
+            mcp: {
+                tool_name: this.target.toolName,
+                ...(this.target.server ? { server: this.target.server } : {}),
+                ...(this.target.credentialId ? { credential_id: this.target.credentialId } : {}),
+            },
         };
     }
 }

package/dist/types.d.ts

@@ -200,9 +200,18 @@ export interface HTTPToolConfig {
     input_schema?: any;
     output_schema?: any;
 }
+/**
+ * MCPToolConfig is a tool of an MCP server: the server by its slug (the
+ * agent's team's registration, its org's or the directory's) and the tool
+ * to call. CredentialID pins the connection the call signs in with; without
+ * it the runner's connection to the server's provider is used. A tool
+ * written with only a connection is saved with the server that
+ * connection's provider is declared by.
+ */
 export interface MCPToolConfig {
-    credential_id?: string;
+    server?: string;
     tool_name: string;
+    credential_id?: string;
 }
 export interface AppToolConfigDTO {
     ref: string;
@@ -253,8 +262,9 @@ export interface HTTPToolConfigDTO {
     output_schema?: any;
 }
 export interface MCPToolConfigDTO {
-    credential_id: string;
+    server: string;
     tool_name: string;
+    credential_id?: string;
 }
 /**
  * AgentImages contains display images for an agent
@@ -4016,7 +4026,6 @@ export interface MCPServerDTO {
     icon_url: string;
     server_url: string;
     auth_type: MCPServerAuthType;
-    oauth_client_id?: string;
     default_scopes: StringSlice;
     /**
      * Headers are static HTTP headers sent on every request to the server,
@@ -5563,7 +5572,7 @@ export interface SecretField {
  * AuthSchemeClientAuth is how client_id/client_secret reach the token
  * endpoint. Most providers accept either; a few insist on one.
  */
-export type AuthSchemeClientAuth = "basic" | "body";
+export type AuthSchemeClientAuth = "basic" | "body" | "none";
 /**
  * AuthSchemeClientAuthBasic sends them as an HTTP Basic Authorization
  * header (RFC 6749 §2.3.1, the default).
@@ -5573,6 +5582,14 @@ export declare const AuthSchemeClientAuthBasic: AuthSchemeClientAuth;
  * AuthSchemeClientAuthBody sends them as form fields in the request body.
  */
 export declare const AuthSchemeClientAuthBody: AuthSchemeClientAuth;
+/**
+ * AuthSchemeClientAuthNone is a public client (RFC 8414
+ * token_endpoint_auth_method "none"): the client id goes in the body,
+ * there is no secret, and PKCE is what proves the client. Its OAuth app
+ * is complete with a client id alone (a dynamically registered client,
+ * or a Client ID Metadata Document URL).
+ */
+export declare const AuthSchemeClientAuthNone: AuthSchemeClientAuth;
 /**
  * AuthSchemeTokenRequest is the token request's body encoding.
  */
@@ -5781,6 +5798,35 @@ export interface AuthSchemeSpec {
      * is asked for again.
      */
     incremental_add_scopes?: boolean;
+    /**
+     * Resource is the RFC 8707 resource indicator: the protected resource
+     * the token is minted for (an MCP server's URL). Sent on the authorize,
+     * code and refresh requests when the profile takes one. Empty = none.
+     */
+    resource?: string;
+    /**
+     * Issuer is the authorization server's RFC 8414 issuer. With
+     * AuthorizationResponseIssParameterSupported, the callback's iss must
+     * name it (RFC 9207, against mix-up); an issuer alone still refuses a
+     * callback naming another one.
+     */
+    issuer?: string;
+    authorization_response_iss_parameter_supported?: boolean;
+    /**
+     * Callback is the name of the redirect URI the app was registered with
+     * (<app>/settings/secrets/oauth/<callback>). Empty = the slug. Schemes
+     * whose clients are registered once for many slugs share one (an MCP
+     * server's dynamically registered client and the Client ID Metadata
+     * Document name the "mcp" callback); the flow's provider then comes
+     * from the connect intent, never from the callback's path.
+     */
+    callback?: string;
+    /**
+     * Profile names the authorization server's deviations from the specs
+     * (authprovider.AuthServerProfile: endpoints placed by app fields,
+     * scopes on refresh, actionable errors, admin consent). Empty = none.
+     */
+    profile?: string;
     token_endpoint?: string;
     /**
      * RevocationEndpoint is the RFC 7009 endpoint, when the provider has
@@ -6427,9 +6473,24 @@ export interface StreamDelta {
 export interface LLMOutput {
     response: string;
     reasoning?: string;
+    reasoning_state?: ReasoningState;
     tool_calls?: ToolCall[];
     usage?: LLMUsage;
 }
+/**
+ * ReasoningState is the opaque state a model hands back with a response for
+ * the next request to carry: a signature over its reasoning (Anthropic
+ * thinking, Gemini thought_signature) or the reasoning itself encrypted
+ * (OpenAI). The platform never reads it. An app writes its own entry under
+ * its own key and, replaying a conversation, places only the entries it
+ * wrote: another provider's signature in its request is refused. The agent
+ * loop stores every assistant message's state and sends all of it back, so a
+ * conversation that moves between models keeps each one's state for it.
+ * Not on LLMDelta: the state is whole only on the final output.
+ */
+export type ReasoningState = {
+    [key: string]: any;
+};
 /**
  * LLMDelta is a streaming delta for LLMOutput.
  */
@@ -6575,6 +6636,11 @@ export interface LLMContextMessage {
     role: ChatMessageRole;
     text?: string;
     reasoning?: string;
+    /**
+     * ReasoningState is what the model's output carried, on an assistant
+     * message: see ReasoningState.
+     */
+    reasoning_state?: ReasoningState;
     images?: string[];
     files?: string[];
     tools?: Tool[];
@@ -6839,7 +6905,7 @@ export declare const ContentUnrated: ContentRating;
 /**
  * CredentialProvider names the external service a credential is for.
  */
-export type CredentialProvider = "google" | "google-sa" | "slack" | "notion" | "github" | "x" | "microsoft" | "salesforce" | "discord" | "gcp" | "mcp" | "reddit";
+export type CredentialProvider = "google" | "google-sa" | "slack" | "notion" | "github" | "x" | "microsoft" | "salesforce" | "discord" | "gcp" | "reddit";
 /**
  * Credential.Provider is a plain string; cast with string(...) when assigning.
  */
@@ -6880,10 +6946,6 @@ export declare const CredentialProviderDiscord: CredentialProvider;
  * Credential.Provider is a plain string; cast with string(...) when assigning.
  */
 export declare const CredentialProviderGCP: CredentialProvider;
-/**
- * Credential.Provider is a plain string; cast with string(...) when assigning.
- */
-export declare const CredentialProviderMCP: CredentialProvider;
 /**
  * Credential.Provider is a plain string; cast with string(...) when assigning.
  */
@@ -6891,10 +6953,9 @@ export declare const CredentialProviderReddit: CredentialProvider;
 /**
  * CredentialType describes the credential category.
  */
-export type CredentialType = "oauth" | "api_key" | "mcp" | "service_account" | "wif";
+export type CredentialType = "oauth" | "api_key" | "service_account" | "wif";
 export declare const CredentialTypeOAuth: CredentialType;
 export declare const CredentialTypeAPIKey: CredentialType;
-export declare const CredentialTypeMCP: CredentialType;
 export declare const CredentialTypeServiceAccount: CredentialType;
 export declare const CredentialTypeWIF: CredentialType;
 /**

package/dist/types.js

@@ -786,6 +786,14 @@ export const AuthSchemeClientAuthBasic = "basic";
  * AuthSchemeClientAuthBody sends them as form fields in the request body.
  */
 export const AuthSchemeClientAuthBody = "body";
+/**
+ * AuthSchemeClientAuthNone is a public client (RFC 8414
+ * token_endpoint_auth_method "none"): the client id goes in the body,
+ * there is no secret, and PKCE is what proves the client. Its OAuth app
+ * is complete with a client id alone (a dynamically registered client,
+ * or a Client ID Metadata Document URL).
+ */
+export const AuthSchemeClientAuthNone = "none";
 export const AuthSchemeTokenRequestForm = "form";
 export const AuthSchemeTokenRequestJSON = "json";
 /**
@@ -1230,17 +1238,12 @@ export const CredentialProviderDiscord = "discord";
  * Credential.Provider is a plain string; cast with string(...) when assigning.
  */
 export const CredentialProviderGCP = "gcp";
-/**
- * Credential.Provider is a plain string; cast with string(...) when assigning.
- */
-export const CredentialProviderMCP = "mcp";
 /**
  * Credential.Provider is a plain string; cast with string(...) when assigning.
  */
 export const CredentialProviderReddit = "reddit";
 export const CredentialTypeOAuth = "oauth";
 export const CredentialTypeAPIKey = "api_key";
-export const CredentialTypeMCP = "mcp";
 export const CredentialTypeServiceAccount = "service_account";
 export const CredentialTypeWIF = "wif";
 export const CredentialStatusPending = "pending";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inferencesh/sdk",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "Official JavaScript/TypeScript SDK for inference.sh - Run AI models with a simple API",
   "type": "module",
   "main": "dist/index.js",