@mastra/mcp 2.7.0 → 2.8.0-alpha.0

package/dist/index.js

@@ -16099,7 +16099,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 			...configured
 		};
 	}
-	async connectStdio(command) {
+	async connectStdio(command, generation) {
 		this.log("debug", `Using Stdio transport for command: ${command}`);
 		const transport = new StdioClientTransport({
 			command,
@@ -16109,7 +16109,9 @@ var InternalMastraMCPClient = class extends MastraBase {
 			cwd: this.serverConfig.cwd
 		});
 		observeEventStreamRequests(transport, this.noteEventStreamSent);
+		this.connectingTransport = transport;
 		try {
+			this.assertSameLifecycle(generation);
 			await this.client.connect(transport, {
 				timeout: this.serverConfig.timeout ?? this.timeout,
 				prior: this.priorDiscovery
@@ -16121,9 +16123,11 @@ var InternalMastraMCPClient = class extends MastraBase {
 			this.log("error", e instanceof Error ? e.stack || e.message : JSON.stringify(e));
 			await transport.close().catch(() => {});
 			throw e;
+		} finally {
+			if (this.connectingTransport === transport) this.connectingTransport = void 0;
 		}
 	}
-	async connectHttp(url) {
+	async connectHttp(url, generation) {
 		const { requestInit, authProvider, connectTimeout, fetch: userFetch, allowedHosts } = this.serverConfig;
 		if (allowedHosts !== void 0) assertHostAllowed(url, allowedHosts);
 		const policyUserFetch = userFetch && allowedHosts !== void 0 ? wrapFetchWithHostPolicy(userFetch, allowedHosts) : void 0;
@@ -16143,7 +16147,9 @@ var InternalMastraMCPClient = class extends MastraBase {
 			fetch
 		});
 		observeEventStreamRequests(transport, this.noteEventStreamSent);
+		this.connectingTransport = transport;
 		try {
+			this.assertSameLifecycle(generation);
 			await this.client.connect(transport, {
 				timeout: connectTimeout ?? DEFAULT_SERVER_CONNECT_TIMEOUT_MSEC,
 				prior: this.priorDiscovery
@@ -16157,6 +16163,8 @@ var InternalMastraMCPClient = class extends MastraBase {
 			this.log("debug", `Streamable HTTP transport failed: ${error}`);
 			if (authProvider && error instanceof UnauthorizedError) this.markNeedsAuth(transport);
 			throw error;
+		} finally {
+			if (this.connectingTransport === transport) this.connectingTransport = void 0;
 		}
 	}
 	/**
@@ -16246,6 +16254,34 @@ var InternalMastraMCPClient = class extends MastraBase {
 	isConnected = null;
 	reconnectPromise = null;
 	/**
+	* Transport of the connect attempt still in flight. The SDK only attaches it to
+	* the client once version negotiation finishes, so a server that never answers
+	* would otherwise leave nothing that disconnect() or a newer attempt can close.
+	*/
+	connectingTransport;
+	/**
+	* Closes the transport of an unfinished connect attempt. Closing makes the SDK
+	* reject that attempt and reap the child (and any negotiation probe) it spawned.
+	*/
+	async abandonPendingConnect() {
+		const pending = this.connectingTransport;
+		if (!pending) return;
+		this.connectingTransport = void 0;
+		await pending.close().catch(() => {});
+	}
+	/**
+	* Whether a connect or reconnect is still running on this client. A failed attempt
+	* that a newer one replaced reports true here, since the newer attempt owns the client.
+	*
+	* @internal
+	*/
+	hasPendingConnect() {
+		return this.isConnected !== null || this.reconnectPromise !== null;
+	}
+	assertSameLifecycle(generation) {
+		if (this.lifecycleGeneration !== generation) throw new Error("MCP client was disconnected while connecting");
+	}
+	/**
 	* Change notifications the caller has asked for. The client keeps exactly one
 	* `subscriptions/listen` stream open for this interest set, replaces it when the
 	* set changes and reopens it after a reconnect.
@@ -16277,14 +16313,15 @@ var InternalMastraMCPClient = class extends MastraBase {
 	*
 	* @internal
 	*/
-	async connect() {
+	async connect(generation = this.lifecycleGeneration) {
 		if (this.isConnected) return this.isConnected;
-		this.isConnected = new Promise(async (resolve, reject) => {
+		const attempt = new Promise(async (resolve, reject) => {
 			try {
+				await this.abandonPendingConnect();
 				await this.detachStaleClientTransport();
 				const { command, url } = this.serverConfig;
-				if (command) await this.connectStdio(command);
-				else if (url) await this.connectHttp(url);
+				if (command) await this.connectStdio(command, generation);
+				else if (url) await this.connectHttp(url, generation);
 				else throw new Error("Server configuration must include either a command or a url.");
 				this.serverInstructions = this.client.getInstructions();
 				this.serverImplementation = this.client.getServerVersion();
@@ -16319,12 +16356,15 @@ var InternalMastraMCPClient = class extends MastraBase {
 				this.clientConnectionOnClose = connectionOnClose;
 				this.client.onclose = connectionOnClose;
 			} catch (e) {
-				if (!this.transport) this.unregisterProcessHooks();
-				this.isConnected = null;
+				if (this.isConnected === attempt) {
+					if (!this.transport) this.unregisterProcessHooks();
+					this.isConnected = null;
+				}
 				this.priorDiscovery = void 0;
 				reject(e);
 			}
 		});
+		this.isConnected = attempt;
 		if (this.processHooks) this.registerProcessHooks();
 		return this.isConnected;
 	}
@@ -16407,6 +16447,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 	}
 	async disconnect() {
 		this.lifecycleGeneration++;
+		await this.abandonPendingConnect();
 		const reconnectPromise = this.reconnectPromise;
 		if (reconnectPromise) await reconnectPromise.catch(() => {});
 		this.closePendingAuthTransport();
@@ -16445,6 +16486,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 			this.log("debug", "Reconnection already in progress; waiting for it to complete");
 			return await this.reconnectPromise;
 		}
+		const generation = this.lifecycleGeneration;
 		const reconnectPromise = (async () => {
 			this.log("debug", "Forcing reconnection to MCP server...");
 			this.closePendingAuthTransport();
@@ -16462,7 +16504,8 @@ var InternalMastraMCPClient = class extends MastraBase {
 				this.serverInstructions = void 0;
 				this.serverImplementation = void 0;
 			}
-			await this.connect();
+			this.assertSameLifecycle(generation);
+			await this.connect(generation);
 			this.log("debug", "Successfully reconnected to MCP server");
 		})();
 		this.reconnectPromise = reconnectPromise;
@@ -17932,6 +17975,11 @@ function cachedClient(id) {
 	return mcpClientInstances.get(id);
 }
 const TOOL_DISCOVERY_MAX_ATTEMPTS = 2;
+/**
+* `code` of the discovery error reported when a server exceeds `perServerTimeoutMs`.
+* The server's connect keeps running, so a later discovery can still succeed.
+*/
+const MCP_DISCOVERY_TIMEOUT_CODE = "MCP_DISCOVERY_TIMEOUT";
 const LOOPBACK_IPV4 = /^127\.(?:\d{1,3})\.(?:\d{1,3})\.(?:\d{1,3})$/;
 function isLoopbackHostname(hostname) {
 	return hostname === "localhost" || hostname === "[::1]" || hostname === "::1" || LOOPBACK_IPV4.test(hostname);
@@ -18711,14 +18759,14 @@ onListChanged: async (serverName, handler) => {
 				await client.connect();
 				return;
 			} catch (error) {
-				if (!(error instanceof UnauthorizedError)) throw this.handleConnectError(serverName, error);
+				if (!(error instanceof UnauthorizedError)) throw this.handleConnectError(serverName, error, client);
 			}
 			const { code, iss } = await callbackServer.waitForCode(options);
 			await client.finishAuth(code, iss);
 			try {
 				await client.connect();
 			} catch (error) {
-				throw error instanceof UnauthorizedError ? error : this.handleConnectError(serverName, error);
+				throw error instanceof UnauthorizedError ? error : this.handleConnectError(serverName, error, client);
 			}
 		} finally {
 			this.authCallbackServersByServer.delete(serverName);
@@ -19081,53 +19129,73 @@ onListChanged: async (serverName, handler) => {
 	* `prompts.list`.
 	*/
 	async discoverAcrossServers(operation, onError, options) {
-		const serverNames = Object.keys(this.serverConfigs);
-		return Promise.all(serverNames.map(async (serverName) => {
-			const startedAt = performance.now();
-			let timer;
+		const only = options?.serverNames;
+		const serverNames = Object.keys(this.serverConfigs).filter((name) => !only || only.includes(name));
+		const onServerSettled = options?.onServerSettled;
+		const notifySettled = (result) => {
+			if (!onServerSettled) return result;
+			const logCallbackError = (error) => {
+				this.logger.error("MCP onServerSettled callback threw:", {
+					serverName: result.serverName,
+					error: error instanceof Error ? error.message : String(error)
+				});
+			};
 			try {
-				const operationPromise = operation(serverName);
-				return {
-					serverName,
-					value: options?.perServerTimeoutMs === void 0 ? await operationPromise : await Promise.race([operationPromise, new Promise((_, reject) => {
-						timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`Discovery timed out after ${options.perServerTimeoutMs}ms`)), options.perServerTimeoutMs);
-						timer.unref?.();
-					})]),
-					error: void 0,
-					duration: performance.now() - startedAt
-				};
+				const { serverName, ...settled } = result;
+				const outcome = onServerSettled(serverName, settled);
+				if (outcome && typeof outcome.then === "function") Promise.resolve(outcome).catch(logCallbackError);
 			} catch (error) {
-				const discoveryError = getMCPDiscoveryErrorDetails(error);
-				try {
-					const mastraError = new MastraError({
-						id: onError.errorId,
-						domain: ErrorDomain.MCP,
-						category: ErrorCategory.THIRD_PARTY,
-						details: { serverName }
-					}, error);
-					this.logger.trackException(mastraError);
-					this.logger.error(onError.logMessage, { error: mastraError.toString() });
-				} catch {
-					const fallbackError = new MastraError({
-						id: onError.errorId,
-						domain: ErrorDomain.MCP,
-						category: ErrorCategory.THIRD_PARTY,
-						text: discoveryError.message,
-						details: { serverName }
-					});
-					this.logger.trackException(fallbackError);
-					this.logger.error(onError.logMessage, { error: fallbackError.toString() });
-				}
-				return {
-					serverName,
-					value: void 0,
-					error: discoveryError,
-					duration: performance.now() - startedAt
-				};
-			} finally {
-				clearTimeout(timer);
+				logCallbackError(error);
 			}
-		}));
+			return result;
+		};
+		return Promise.all(serverNames.map(async (serverName) => notifySettled(await this.discoverServer(serverName, operation, onError, options?.perServerTimeoutMs))));
+	}
+	async discoverServer(serverName, operation, onError, perServerTimeoutMs) {
+		const startedAt = performance.now();
+		let timer;
+		try {
+			const operationPromise = operation(serverName);
+			return {
+				serverName,
+				value: perServerTimeoutMs === void 0 ? await operationPromise : await Promise.race([operationPromise, new Promise((_, reject) => {
+					timer = setTimeout(() => reject(Object.assign(/* @__PURE__ */ new Error(`Discovery timed out after ${perServerTimeoutMs}ms`), { code: MCP_DISCOVERY_TIMEOUT_CODE })), perServerTimeoutMs);
+					timer.unref?.();
+				})]),
+				error: void 0,
+				duration: performance.now() - startedAt
+			};
+		} catch (error) {
+			const discoveryError = getMCPDiscoveryErrorDetails(error);
+			try {
+				const mastraError = new MastraError({
+					id: onError.errorId,
+					domain: ErrorDomain.MCP,
+					category: ErrorCategory.THIRD_PARTY,
+					details: { serverName }
+				}, error);
+				this.logger.trackException(mastraError);
+				this.logger.error(onError.logMessage, { error: mastraError.toString() });
+			} catch {
+				const fallbackError = new MastraError({
+					id: onError.errorId,
+					domain: ErrorDomain.MCP,
+					category: ErrorCategory.THIRD_PARTY,
+					text: discoveryError.message,
+					details: { serverName }
+				});
+				this.logger.trackException(fallbackError);
+				this.logger.error(onError.logMessage, { error: fallbackError.toString() });
+			}
+			return {
+				serverName,
+				value: void 0,
+				error: discoveryError,
+				duration: performance.now() - startedAt
+			};
+		} finally {
+			clearTimeout(timer);
+		}
 	}
 	/**
 	* Creates `MCPServerBase` proxy objects for each server connection in this
@@ -19212,12 +19280,12 @@ onListChanged: async (serverName, handler) => {
 		try {
 			await mcpClient.connect();
 		} catch (e) {
-			throw this.handleConnectError(name, e);
+			throw this.handleConnectError(name, e, mcpClient);
 		}
 		this.logger.debug("Connected to MCP server", { name });
 		return mcpClient;
 	}
-	handleConnectError(name, error) {
+	handleConnectError(name, error, client) {
 		const mastraError = new MastraError({
 			id: "MCP_CLIENT_CONNECT_FAILED",
 			domain: ErrorDomain.MCP,
@@ -19227,7 +19295,7 @@ onListChanged: async (serverName, handler) => {
 		}, error);
 		this.logger.trackException(mastraError);
 		this.logger.error("MCPClient errored connecting to MCP server:", { error: mastraError.toString() });
-		if (!(error instanceof UnauthorizedError)) this.mcpClientsById.delete(name);
+		if (!(error instanceof UnauthorizedError) && !client.hasPendingConnect() && this.mcpClientsById.get(name) === client) this.mcpClientsById.delete(name);
 		return mastraError;
 	}
 	async getConnectedClientForServer(serverName) {
@@ -22638,7 +22706,8 @@ var MCPServer = class extends MCPServerBase {
 				tracingContext: {},
 				mastra: this.mastra,
 				logger: this.logger,
-				description: "description" in tool ? tool.description : void 0
+				description: "description" in tool ? tool.description : void 0,
+				resolveExecuteFGA: ({ user, requestContext }) => this.toolFGACheck(name, user, requestContext)
 			});
 			converted[name] = {
 				...coreTool,
@@ -23951,37 +24020,49 @@ var MCPServer = class extends MCPServerBase {
 		const fgaProvider = this.mastra?.getServer?.()?.fga;
 		if (!fgaProvider) return;
 		const { getMCPToolFGAResourceId, requireFGA, FGADeniedError, MastraFGAPermissions } = await import("@mastra/core/auth/ee");
-		const resourceId = getMCPToolFGAResourceId(this.id, toolId);
 		const user = requestContext.get("user");
 		if (!user) throw new FGADeniedError({ id: "unknown" }, {
 			type: "tool",
-			id: resourceId
+			id: getMCPToolFGAResourceId(this.id, toolId)
 		}, MastraFGAPermissions.TOOLS_EXECUTE);
-		const permission = this.fga?.permissionMapping?.[MastraFGAPermissions.TOOLS_EXECUTE] ?? MastraFGAPermissions.TOOLS_EXECUTE;
-		const mapping = this.fga?.resourceMapping?.tool ?? this.fga?.resourceMapping?.tools;
 		await requireFGA({
 			fgaProvider,
 			user,
+			requestContext,
+			...await this.toolFGACheck(toolId, user, requestContext)
+		});
+	}
+	/**
+	* The check for one of this server's tools: its MCP tool resource, or the server's `fga` mapping.
+	* The tools it builds run the same check, so they keep it when used outside the server, such as
+	* through `tools()` on an agent.
+	*/
+	async toolFGACheck(toolId, user, requestContext) {
+		const { getMCPToolFGAResourceId, MastraFGAPermissions } = await import("@mastra/core/auth/ee");
+		const resourceId = getMCPToolFGAResourceId(this.id, toolId);
+		const permission = this.fga?.permissionMapping?.[MastraFGAPermissions.TOOLS_EXECUTE] ?? MastraFGAPermissions.TOOLS_EXECUTE;
+		const mapping = this.fga?.resourceMapping?.tool ?? this.fga?.resourceMapping?.tools;
+		const derivedId = mapping && user ? mapping.deriveId?.({
+			user,
+			resourceId,
+			requestContext
+		}) : void 0;
+		return {
 			resource: mapping ? {
 				type: mapping.fgaResourceType,
-				id: mapping.deriveId?.({
-					user,
-					resourceId,
-					requestContext
-				}) ?? resourceId
+				id: derivedId ?? resourceId
 			} : {
 				type: "tool",
 				id: resourceId
 			},
 			permission,
-			requestContext,
 			context: { resourceId },
 			metadata: {
 				mcpServerId: this.id,
 				mcpServerName: this.name,
 				toolId
 			}
-		});
+		};
 	}
 	async authorizedToolEntries(requestContext) {
 		const entries = Object.entries(this.convertedTools);
@@ -25106,6 +25187,6 @@ var MCPEventsSignalProvider = class MCPEventsSignalProvider extends SignalProvid
 		else console.warn(`[${this.id}] ${info.key}:`, error);
 	}
 };
-export { InMemoryMCPEventCursorStore, InMemoryMCPTaskStore, InMemoryOAuthStorage, InMemoryWebhookSubscriptionStore, InternalMastraMCPClient, MCPClient, MCPClientServerProxy, MCPEventsSignalProvider, MCPOAuthClientProvider, MCPServer, MCPTaskLimitError, MCP_CALL_TOOL_CONTENT, MCP_CALL_TOOL_META, MCP_CLIENT_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION, ServerEventActions, ServerPromptActions, ServerResourceActions, ServerToolActions, UnauthorizedError, auth, buildDiscoveryUrls, createIntrospectionValidator, createOAuthCallbackServer, createOAuthMiddleware, createSimpleTokenProvider, createStaticTokenValidator, defineEvent, discoverAuthorizationServerMetadata, discoverOAuthMetadata, discoverOAuthProtectedResourceMetadata, exchangeAuthorization, extractBearerToken, extractResourceMetadataUrl, generateProtectedResourceMetadata, generateWWWAuthenticateHeader, getCallbackUrlCandidates, getMcpCallToolContent, getMcpCallToolMeta, isMCPTaskStoreAdmin, isWorkflowTaskContext, parseErrorResponse, principalKeyOf, refreshAuthorization, selectResourceURL, startAuthorization, taskKeyOf, traceContextFromMeta, traceContextToMeta };
+export { InMemoryMCPEventCursorStore, InMemoryMCPTaskStore, InMemoryOAuthStorage, InMemoryWebhookSubscriptionStore, InternalMastraMCPClient, MCPClient, MCPClientServerProxy, MCPEventsSignalProvider, MCPOAuthClientProvider, MCPServer, MCPTaskLimitError, MCP_CALL_TOOL_CONTENT, MCP_CALL_TOOL_META, MCP_CLIENT_PROTOCOL_VERSION, MCP_DISCOVERY_TIMEOUT_CODE, MCP_PROTOCOL_VERSION, ServerEventActions, ServerPromptActions, ServerResourceActions, ServerToolActions, UnauthorizedError, auth, buildDiscoveryUrls, createIntrospectionValidator, createOAuthCallbackServer, createOAuthMiddleware, createSimpleTokenProvider, createStaticTokenValidator, defineEvent, discoverAuthorizationServerMetadata, discoverOAuthMetadata, discoverOAuthProtectedResourceMetadata, exchangeAuthorization, extractBearerToken, extractResourceMetadataUrl, generateProtectedResourceMetadata, generateWWWAuthenticateHeader, getCallbackUrlCandidates, getMcpCallToolContent, getMcpCallToolMeta, isMCPTaskStoreAdmin, isWorkflowTaskContext, parseErrorResponse, principalKeyOf, refreshAuthorization, selectResourceURL, startAuthorization, taskKeyOf, traceContextFromMeta, traceContextToMeta };
 
 //# sourceMappingURL=index.js.map