@lenne.tech/nest-server 11.42.15 → 11.43.0

package/src/core/modules/ai/README.md

@@ -685,32 +685,117 @@ Without Redis nothing changes: unknown ids answer `404` exactly as before.
 For generic MCP clients that auto-discover + register:
 `CoreAiMcpOAuthService` provides HMAC-signed access tokens (constant-time verify),
 PKCE S256, and MongoDB-backed client/code/refresh stores; the MCP controller then
-also accepts OAuth access tokens. Mount the discovery/token endpoints in `main.ts`:
+also accepts OAuth access tokens.
 
 ```typescript
-// main.ts, after app.init()
-import { mountAiMcpOAuth } from '@lenne.tech/nest-server';
-await mountAiMcpOAuth(app);
+// config.env.ts — that is all: endpoints, consent page and sign-in come with it
+ai: { mcp: { oauth: true, oauthSecret: process.env.NSC__AI__ENCRYPTION_SECRET } }
 ```
 
+**Mounted by `CoreModule` (11.43.0).** `CoreAiMcpOAuthInitializer` mounts the discovery and token
+endpoints (`/.well-known/oauth-authorization-server`, `/.well-known/oauth-protected-resource<mcp path>`,
+`/authorize`, `/token`, `/register`) during `app.init()` — no `main.ts` code, and the same under
+`Test.createTestingModule()`. The position is the point: the endpoints are an Express router, and Nest
+registers its not-found handler inside `app.init()`. The call this replaces — `mountAiMcpOAuth(app)` after
+`app.init()`, as this README used to say — sat behind that handler, so every OAuth endpoint answered 404.
+Mounted during init, the router sits behind every Nest middleware (security headers, request context,
+CORS) and the Nest routes, and ahead of the not-found handler. Guards and interceptors do not run for it;
+the SDK's handlers authenticate the client and rate-limit per IP themselves (so `trustProxy` matters
+behind a proxy). A `mountAiMcpOAuth()` call left in `main.ts` is a no-op and logs that it can go; options
+it passes that differ from the mount (`baseUrl`, `mcpPath`) are named in a warning.
+
+The protected MCP resource is described at the path Nest registered the endpoint at — global prefix and
+its exclusions, URI versioning and a `RouterModule` path included — and the endpoint's `401` names that
+metadata document in `WWW-Authenticate: Bearer resource_metadata="…"` (RFC 9728 §5.1). Without OAuth the
+challenge is a plain `Bearer`: there is no metadata to point at. CORS: a project's `enableCors()` runs
+first, so a browser-based MCP client on an origin it does not allow is refused at the preflight; native
+clients (Claude Code, Claude Desktop) send none.
+
 **Swagger (11.42.9):** `setupSwagger()` documents `/ai/mcp` (POST/GET/DELETE, with the bearer
 requirement the endpoint enforces itself) whenever the MCP server is registered, and — because the
-OAuth endpoints are an Express router, invisible to `@nestjs/swagger` — exactly the OAuth endpoints
-`mountAiMcpOAuth()` mounted (`/.well-known/oauth-authorization-server`,
-`/.well-known/oauth-protected-resource/ai/mcp`, `/authorize`, `/token`, `/register`; `/revoke` only for a
-provider with `revokeToken`). Without the call they are not documented, because they do not exist.
+OAuth endpoints are an Express router, invisible to `@nestjs/swagger` — exactly the OAuth endpoints that
+are mounted (`/revoke` only for a provider with `revokeToken`). Without `ai.mcp.oauth` they are not
+documented, because they do not exist.
 
 The issuer — and with it every endpoint URL in the discovery metadata, which MCP clients follow —
 is the server's `baseUrl` (`NSC__BASE_URL` when deployed), resolved the same way BetterAuth and
 CORS resolve it. `local` / `ci` / `e2e` fall back to `http://localhost:3000`; any other environment
-without a `baseUrl` fails the call instead of guessing, because a deployed API that advertised
+without a `baseUrl` fails the boot instead of guessing, because a deployed API that advertised
 `http://localhost:3000` sent Claude Code off to register the client on the user's own machine.
-Pass `{ baseUrl }` only when the issuer must differ from the server's `baseUrl`, and do not add a
-`localhost` fallback of your own. The resolved issuer is logged once at boot.
-
-Override `CoreAiMcpOAuthService.authorizeConsent()` to wire your login/consent UI.
+Set `ai.mcp.oauthBaseUrl` only when MCP clients reach the server under another URL than `baseUrl` (its
+origin is then trusted by Better-Auth automatically, because the consent page signs users in there),
+and do not add a `localhost` fallback of your own. Issuer and resource are logged once at boot.
 Set `ai.mcp.oauthSecret` (or reuse `ai.encryptionSecret`) to a random 32+ char value.
 
+**Consent page (11.43.0).** `/authorize` answers with a built-in, build-free page — the step where the
+user decides whether an MCP client may act for them:
+
+- **Nobody signed in** → the sign-in view: e-mail + password and the two-factor step (TOTP or backup
+  code) against Better-Auth's own endpoints on this origin (`<basePath>/sign-in/email`,
+  `/two-factor/verify-totp`, `/two-factor/verify-backup-code`), then a reload of the same `/authorize`
+  request. Passkey and social login go through the app's login page: `ai.mcp.oauthLoginUrl`, else
+  `<appUrl>/auth/login`, opened next to the consent page, which then offers "continue". A `{returnTo}`
+  in `oauthLoginUrl` is replaced by the pending request's URL, for a login page that sends the user
+  back by itself. A user already signed in to the API origin (session cookie) skips this view.
+- **Signed in** → the consent view: the signed-in account first (with "use another account", which signs
+  out and shows the sign-in view), the client's name, the host the code goes to (a loopback host is
+  named "an application on this computer"), Allow / Deny as a form POST. Allow is rendered `disabled`;
+  a nonce'd script enables it, and a click counts only after intent on this page — visible, focused,
+  and a pointer move / key / touch at least 600 ms after it got there. That defeats
+  double-clickjacking (a hostile page sends this window to `/authorize` behind a popup and lets the
+  second click of a "double-click" land on Allow). Without JavaScript nothing can be approved, and the
+  sign-in forms are hidden and `method="post"`, so a password never lands in a URL.
+- **Allow** issues the code only with the page's CSRF token, signed with the OAuth secret and bound to
+  the user, the client, the redirect URI and the PKCE challenge (10 minutes); a stale token shows the
+  form again, a forged or tampered one too, and nothing is issued. **Deny** sends the client back with
+  `access_denied`.
+
+The page carries its own `Content-Security-Policy` (script and style by nonce, `frame-ancestors 'none'`,
+no `form-action`, which browsers would apply to the redirect to the client), `X-Frame-Options: DENY`,
+`Cache-Control: no-store` and `Referrer-Policy: no-referrer`, independent of `security.headers`. Every
+value from outside is escaped — the client's name is chosen by whoever registered the client. German
+for a German `Accept-Language`, English otherwise.
+
+Why Allow is a deliberate step: dynamic registration is open by design, so anybody can register a
+client with their own redirect URI and start the flow — PKCE is then theirs too. A GET to `/authorize`
+is what any link produces, and it carries the session cookie, so a page that issued on GET would let any
+link a signed-in user opens authorize an attacker's client. The framework refuses a code saved while
+answering a GET to `/authorize` (logged; the client gets `error=server_error`) — for the built-in page
+and for one of your own alike.
+
+**Global prefix.** Nest registers the Better-Auth middleware below a global prefix while the OAuth router sits at the
+root, so the page resolves the session itself when the middleware did not run, and signs in at the prefixed IAM path
+(`/api/iam/sign-in/email`). Better-Auth's own routes are not forwarded below a global prefix (see `setupSwagger()`), so
+the two-factor step does not work there; users with 2FA sign in through the app.
+
+**Needs Better-Auth.** The page signs users in through it; without Better-Auth active the boot warns and
+the page offers no sign-in. Its sign-in goes through the IAM sign-in controller, which (since 11.43.0)
+hands Better-Auth the request so Better-Auth's own login-CSRF protection runs — otherwise a hostile page
+could sign the visitor in to the attacker's account before they approve a client.
+
+**Your own page.** Override `renderConsentPage(view)` in a subclass to restyle it (keep every value
+escaped), or `authorizeConsent(client, params, res)` for a consent UI of your own — same shape: no session
+→ sign in, GET → show which client, POST with a CSRF token → `saveAuthorizationCode()` and redirect;
+refuse with `AccessDeniedError` from `this.loadOAuthErrors()`. Register the subclass via
+`CoreModule.forRoot(env, { ai: { mcpOAuthService } })`, so the MCP controller and the endpoints share it.
+Two checks stay outside the overridable methods: an API token can never approve a consent, and the
+production secret check runs again before the endpoints are mounted (without a signing secret, a
+environment outside `local` / `ci` / `e2e` refuses to boot and to sign tokens at all — deployed `develop` and `test`
+stages included).
+
+Known property of the SDK: `/authorize` redirects its error answers to the client's registered
+redirect URI, and any client may register any https URI — an open redirect in the sense of RFC 9700
+§4.11.2, carrying only an OAuth error code.
+
+**Refusals are OAuth errors (11.43.0).** The SDK's handlers answer an error with its OAuth code only
+when it is one of the SDK's own `OAuthError` classes; anything else becomes `500 server_error`. The
+built-in provider refuses an unknown, rotated or foreign refresh token or authorization code with
+`400 invalid_grant` (until 11.43.0 these were plain `Error`s and answered 500). That matters beyond the
+status: an MCP client discards its stored tokens only on `invalid_grant`, so on a 500 it kept a dead
+token, retried, and never asked the user to sign in again. A refusal in your own `authorizeConsent()`
+needs the same: take the class from `this.loadOAuthErrors()` (e.g. `AccessDeniedError` when the user
+declines), never a plain `Error`.
+
 ## Tests
 
 - `tests/unit/ai.spec.ts` — crypto, registry role filtering, orchestrator loop,

package/src/core/modules/ai/core-ai-mcp-oauth.initializer.ts

@@ -0,0 +1,199 @@
+import {
+  Injectable,
+  Logger,
+  OnApplicationBootstrap,
+  OnApplicationShutdown,
+  OnModuleInit,
+  Optional,
+  RequestMethod,
+} from '@nestjs/common';
+import { MODULE_PATH, PATH_METADATA, VERSION_METADATA } from '@nestjs/common/constants';
+import { addLeadingSlash } from '@nestjs/common/utils/shared.utils';
+import { ApplicationConfig, HttpAdapterHost, ModuleRef, ModulesContainer } from '@nestjs/core';
+import { RoutePathFactory } from '@nestjs/core/router/route-path-factory';
+
+import { ConfigService } from '../../common/services/config.service';
+import { getBetterAuthTokenService } from '../better-auth/core-better-auth.registry';
+import { CoreAiMcpController } from './core-ai-mcp.controller';
+import { mountAiMcpOAuthRouter } from './helpers/ai-mcp-oauth.helper';
+import { getMountedMcpOAuth, IMountedMcpOAuth, setMountedMcpOAuth } from './helpers/ai-mcp-oauth.registry';
+import { CoreAiMcpOAuthService } from './services/core-ai-mcp-oauth.service';
+
+/**
+ * Mounts the MCP OAuth 2.1 endpoints (`/.well-known/oauth-*`, `/authorize`, `/token`, `/register`)
+ * when `ai.mcp.oauth` is enabled — no `main.ts` code, and the same under `Test.createTestingModule()`.
+ *
+ * WHERE in the lifecycle is the whole point. The endpoints are an Express router, not Nest routes,
+ * and Nest registers its not-found handler inside `app.init()`, after `onModuleInit`. A router added
+ * after `app.init()` — what the documentation used to prescribe — sits behind that handler and is
+ * never reached: every OAuth endpoint answered 404. Mounted here, it sits behind every Nest
+ * middleware (security headers, request context, CORS) and the Nest routes, and ahead of the
+ * not-found handler.
+ *
+ * The MCP resource path is computed the way Nest computes the controller's route (global prefix and
+ * its exclusions, URI versioning, a `RouterModule` path), so the protected resource metadata names
+ * the URL the MCP endpoint actually answers on. The issuer is `ai.mcp.oauthBaseUrl`, else the
+ * server's `baseUrl`; a deployed environment without either fails the boot rather than advertising
+ * a guessed URL.
+ *
+ * Registered by `CoreAiModule` whenever the MCP endpoint is; consumers never interact with it.
+ */
+@Injectable()
+export class CoreAiMcpOAuthInitializer implements OnApplicationBootstrap, OnApplicationShutdown, OnModuleInit {
+  protected readonly logger = new Logger(CoreAiMcpOAuthInitializer.name);
+
+  /** What this instance mounted, so shutdown clears only its own record. */
+  private mounted?: IMountedMcpOAuth;
+
+  constructor(
+    protected readonly oauthService: CoreAiMcpOAuthService,
+    @Optional() protected readonly httpAdapterHost?: HttpAdapterHost,
+    @Optional() protected readonly moduleRef?: ModuleRef,
+    @Optional() protected readonly modulesContainer?: ModulesContainer,
+  ) {}
+
+  async onModuleInit(): Promise<void> {
+    if (!this.oauthService.isOAuthEnabled()) {
+      return;
+    }
+    const adapter = this.httpAdapterHost?.httpAdapter;
+    if (!adapter) {
+      // An application context without an HTTP server (CLI, migration script): nothing to serve.
+      return;
+    }
+    // Repeated here, in framework code, because a subclass may override onModuleInit() without super.
+    this.oauthService.assertProductionSafe();
+    if (adapter.getType() !== 'express') {
+      throw new Error(
+        `ai.mcp.oauth requires the Express adapter, but the application runs on "${adapter.getType()}": ` +
+          'the MCP OAuth endpoints are an Express router.',
+      );
+    }
+
+    this.mounted = await mountAiMcpOAuthRouter(
+      adapter.getInstance(),
+      (router) => adapter.use(router),
+      this.oauthService,
+      {
+        baseUrl: ConfigService.get<unknown>('ai.mcp.oauthBaseUrl'),
+        authBasePath: this.resolveAuthBasePath(),
+        baseUrlSource: 'ai.mcp.oauthBaseUrl',
+        mcpPath: this.resolveMcpPath(),
+      },
+    );
+  }
+
+  /**
+   * The built-in consent page signs users in through Better-Auth. Checked at bootstrap, when every
+   * module — Better-Auth's included — has initialized.
+   */
+  onApplicationBootstrap(): void {
+    if (!this.mounted || !this.oauthService.usesBuiltInConsent() || getBetterAuthTokenService()) {
+      return;
+    }
+    this.logger.warn(
+      'ai.mcp.oauth is enabled, but Better-Auth is not active: the built-in consent page has no way to sign a user ' +
+        'in, so no MCP client can be authorized. Enable betterAuth, or register a CoreAiMcpOAuthService subclass ' +
+        'with an authorizeConsent() of your own via CoreModule.forRoot(env, { ai: { mcpOAuthService } }).',
+    );
+  }
+
+  onApplicationShutdown(): void {
+    if (this.mounted && getMountedMcpOAuth() === this.mounted) {
+      setMountedMcpOAuth(undefined);
+    }
+  }
+
+  /**
+   * The path the MCP endpoint (`POST` on `CoreAiMcpController`) is registered at, computed with
+   * Nest's own `RoutePathFactory` from the inputs Nest passes it (`NestApplication.registerRouter`,
+   * `RoutesResolver`). Re-implementing the rules instead would drift silently the first time Nest
+   * changes one; this breaks loudly, and `tests/unit/ai-mcp-oauth-lifecycle.spec.ts` pins the result
+   * against the route the controller actually answers on.
+   */
+  protected resolveMcpPath(): string {
+    const container = (this.moduleRef as unknown as { container?: { applicationConfig?: ApplicationConfig } })
+      ?.container;
+    const applicationConfig = container?.applicationConfig;
+    const ctrlPath = this.controllerPath();
+    if (!applicationConfig) {
+      return ctrlPath;
+    }
+
+    const versioningOptions = applicationConfig.getVersioning();
+    const controllerVersion = versioningOptions
+      ? (Reflect.getMetadata(VERSION_METADATA, CoreAiMcpController) ?? versioningOptions.defaultVersion)
+      : undefined;
+    const paths = new RoutePathFactory(applicationConfig).create(
+      {
+        controllerVersion,
+        ctrlPath,
+        globalPrefix: addLeadingSlash(applicationConfig.getGlobalPrefix()),
+        methodPath: '/',
+        modulePath: this.modulePath(),
+        versioningOptions,
+      },
+      RequestMethod.POST,
+    );
+
+    if (paths.length > 1) {
+      this.logger.warn(
+        `The MCP endpoint is registered at ${paths.join(', ')}; the OAuth metadata describes the first one only.`,
+      );
+    }
+    return paths[0];
+  }
+
+  /**
+   * Where the IAM endpoints the consent page signs in through answer: Better-Auth's `basePath` below
+   * the global prefix (and URI version) Nest registers the IAM controller under. The OAuth router
+   * itself sits at the root, so a page served there must not assume `/iam`.
+   */
+  protected resolveAuthBasePath(): string {
+    const basePath = `/${String(ConfigService.get<string>('betterAuth.basePath') || 'iam').replace(/^\//, '')}`;
+    const applicationConfig = (this.moduleRef as unknown as { container?: { applicationConfig?: ApplicationConfig } })
+      ?.container?.applicationConfig;
+    if (!applicationConfig) {
+      return basePath;
+    }
+    const versioningOptions = applicationConfig.getVersioning();
+    const [signIn] = new RoutePathFactory(applicationConfig).create(
+      {
+        controllerVersion: versioningOptions?.defaultVersion,
+        ctrlPath: basePath,
+        globalPrefix: addLeadingSlash(applicationConfig.getGlobalPrefix()),
+        methodPath: '/sign-in/email',
+        versioningOptions,
+      },
+      RequestMethod.POST,
+    );
+    return signIn.replace(/\/sign-in\/email$/, '');
+  }
+
+  /** The controller's declared route, with a leading slash (`/ai/mcp`). */
+  private controllerPath(): string {
+    const declared = Reflect.getMetadata(PATH_METADATA, CoreAiMcpController);
+    const path = Array.isArray(declared) ? declared[0] : declared;
+    return `/${String(path ?? 'ai/mcp').replace(/^\//, '')}`;
+  }
+
+  /**
+   * A `RouterModule` path in front of the module that registered the MCP controller, read the way
+   * `RoutesResolver` reads it. The module is looked up rather than imported: importing `CoreAiModule`
+   * here would put this file and the module on an import cycle.
+   */
+  private modulePath(): string | undefined {
+    if (!this.modulesContainer) {
+      return undefined;
+    }
+    for (const module of this.modulesContainer.values()) {
+      if (module.controllers.has(CoreAiMcpController)) {
+        return (
+          Reflect.getMetadata(MODULE_PATH + this.modulesContainer.applicationId, module.metatype) ??
+          Reflect.getMetadata(MODULE_PATH, module.metatype)
+        );
+      }
+    }
+    return undefined;
+  }
+}

package/src/core/modules/ai/core-ai-mcp.controller.ts

@@ -9,6 +9,7 @@ import { ConfigService } from '../../common/services/config.service';
 import { CoreRedisService } from '../../common/services/core-redis.service';
 import { CoreBetterAuthModule } from '../better-auth/core-better-auth.module';
 import { ErrorCode } from '../error-code/error-codes';
+import { getMountedMcpOAuth } from './helpers/ai-mcp-oauth.registry';
 import { CoreAiMcpOAuthService } from './services/core-ai-mcp-oauth.service';
 import { CoreAiMcpService } from './services/core-ai-mcp.service';
 import { AiToolUser } from './tools/ai-tool.registry';
@@ -34,7 +35,8 @@ import { AiToolUser } from './tools/ai-tool.registry';
  * `WWW-Authenticate` header as the protocol expects.
  *
  * When `ai.mcp.oauth` is enabled, the handler additionally accepts OAuth 2.1 access
- * tokens (see `mountAiMcpOAuth`); otherwise it authenticates via Bearer/session token.
+ * tokens (endpoints mounted by `CoreAiMcpOAuthInitializer`); otherwise it authenticates via
+ * Bearer/session token.
  *
  * ## Multi-replica
  *
@@ -121,7 +123,7 @@ export class CoreAiMcpController implements OnModuleDestroy {
   async handlePost(@Req() req: Request, @Res() res: Response): Promise<void> {
     const user = await this.resolveUser(req);
     if (!user?.id) {
-      this.unauthorized(req, res);
+      this.unauthorized(res);
       return;
     }
 
@@ -298,7 +300,7 @@ export class CoreAiMcpController implements OnModuleDestroy {
   private async handleSessionRequest(req: Request, res: Response): Promise<void> {
     const user = await this.resolveUser(req);
     if (!user?.id) {
-      this.unauthorized(req, res);
+      this.unauthorized(res);
       return;
     }
     const sessionId = req.headers['mcp-session-id'] as string | undefined;
@@ -470,12 +472,17 @@ export class CoreAiMcpController implements OnModuleDestroy {
 
   /**
    * MCP-style 401 with a `WWW-Authenticate` header for OAuth discovery.
+   *
+   * `resource_metadata` is the URL of the protected resource METADATA (RFC 9728 §5.1), exactly as
+   * the mounted OAuth router serves it — not the endpoint itself, and not a URL built from the
+   * request's `Host` header, which the caller controls. Without mounted OAuth endpoints there is
+   * no metadata to point at, so the challenge is a plain `Bearer`.
    */
-  private unauthorized(req: Request, res: Response): void {
-    const baseUrl = `${req.protocol}://${req.get('host')}`;
+  private unauthorized(res: Response): void {
+    const oauth = getMountedMcpOAuth();
     res
       .status(401)
-      .set({ 'WWW-Authenticate': `Bearer resource_metadata="${baseUrl}/ai/mcp"` })
+      .set({ 'WWW-Authenticate': oauth ? `Bearer resource_metadata="${oauth.resourceMetadataUrl}"` : 'Bearer' })
       .json({ error: 'Unauthorized: a valid Bearer token is required' });
   }
 

package/src/core/modules/ai/core-ai.module.ts

@@ -1,6 +1,7 @@
 import { DynamicModule, Global, Module, Type } from '@nestjs/common';
 import { MongooseModule } from '@nestjs/mongoose';
 
+import { CoreAiMcpOAuthInitializer } from './core-ai-mcp-oauth.initializer';
 import { CoreAiMcpController } from './core-ai-mcp.controller';
 import { CoreAiController } from './core-ai.controller';
 import { CoreAiResolver } from './core-ai.resolver';
@@ -95,6 +96,12 @@ export interface CoreAiModuleOptions {
   /** Whether to register the MCP server controller at /ai/mcp. */
   mcpEnabled?: boolean;
 
+  /**
+   * Custom MCP OAuth service (extends CoreAiMcpOAuthService) — where `authorizeConsent()` wires the
+   * login/consent UI. Bound to the base token, so the MCP controller and the OAuth endpoints use it.
+   */
+  mcpOAuthService?: Type<CoreAiMcpOAuthService>;
+
   /** Custom connection-preference service (extends CoreAiConnectionPreferenceService). */
   preferenceService?: Type<CoreAiConnectionPreferenceService>;
 
@@ -174,11 +181,15 @@ export class CoreAiModule {
     const ToolPolicyServiceClass = options.toolPolicyService || CoreAiToolPolicyService;
     const ModeServiceClass = options.modeService || CoreAiModeService;
     const McpClientServiceClass = options.mcpClientService || CoreAiMcpClientService;
+    const McpOAuthServiceClass = options.mcpOAuthService || CoreAiMcpOAuthService;
 
-    // Register the MCP controller only when enabled (it lazy-loads the MCP SDK).
+    // Register the MCP controller only when enabled (it lazy-loads the MCP SDK), together with the
+    // initializer that mounts its OAuth endpoints when `ai.mcp.oauth` is enabled.
     const controllers: Type<any>[] = [ControllerClass];
+    const mcpProviders: Type<any>[] = [];
     if (options.mcpEnabled) {
       controllers.push(CoreAiMcpController);
+      mcpProviders.push(CoreAiMcpOAuthInitializer);
     }
 
     return {
@@ -246,7 +257,7 @@ export class CoreAiModule {
         { provide: CoreAiConversationService, useClass: ConversationServiceClass },
         { provide: CoreAiInteractionService, useClass: InteractionServiceClass },
         CoreAiMcpService,
-        CoreAiMcpOAuthService,
+        ...mcpProviders,
         // Bind base-class tokens to the (possibly overridden) implementations so
         // injections by base type resolve to the project's subclass.
         { provide: CoreAiConnectionPreferenceService, useClass: PreferenceServiceClass },
@@ -262,6 +273,7 @@ export class CoreAiModule {
         { provide: CoreAiToolPolicyService, useClass: ToolPolicyServiceClass },
         { provide: CoreAiModeService, useClass: ModeServiceClass },
         { provide: CoreAiMcpClientService, useClass: McpClientServiceClass },
+        { provide: CoreAiMcpOAuthService, useClass: McpOAuthServiceClass },
         ResolverClass,
       ],
     };