@mcp-use/client 2.1.0 → 2.1.1-canary.0

package/dist/react/index.js

@@ -270,6 +270,7 @@ var PERSISTED_SERVER_CONFIG_KEYS = [
   "reconnectionOptions",
   "popupFeatures",
   "preventAutoAuth",
+  "detectMixedAuth",
   "useRedirectFlow",
   "protocolNegotiation",
   "timeout",
@@ -449,11 +450,136 @@ import { useCallback as useCallback2, useEffect, useMemo, useRef, useState } fro
 // src/transport/http.ts
 import {
   Client,
+  discoverOAuthProtectedResourceMetadata,
   SdkError,
   SdkHttpError,
   StreamableHTTPClientTransport,
+  UnauthorizedError as UnauthorizedError2
+} from "@modelcontextprotocol/client";
+
+// src/auth/flow.ts
+import {
+  auth,
+  InsufficientScopeError,
   UnauthorizedError
 } from "@modelcontextprotocol/client";
+var DEFAULT_AUTH_TIMEOUT_MS = 5 * 6e4;
+function isUnauthorized(err, depth = 0) {
+  if (!err || depth > 5) return false;
+  if (err instanceof UnauthorizedError) return true;
+  if (err instanceof Error) {
+    const code = err.code;
+    if (code === 401) return true;
+    if (err.name === "UnauthorizedError") return true;
+    const message = err.message ?? "";
+    if (message.includes("401") || message.includes("Unauthorized")) {
+      return true;
+    }
+    if (err.cause && isUnauthorized(err.cause, depth + 1)) return true;
+    const data = err.data;
+    if (data?.cause && isUnauthorized(data.cause, depth + 1)) return true;
+  }
+  return false;
+}
+function isOAuthInteractionRequired(err, depth = 0) {
+  if (!err || depth > 5) return false;
+  if (err instanceof InsufficientScopeError || err instanceof UnauthorizedError) {
+    return true;
+  }
+  if (err instanceof Error) {
+    if (err.name === "InsufficientScopeError" || err.name === "UnauthorizedError") {
+      return true;
+    }
+    if (err.cause && isOAuthInteractionRequired(err.cause, depth + 1)) {
+      return true;
+    }
+    const data = err.data;
+    if (data?.cause && isOAuthInteractionRequired(data.cause, depth + 1)) {
+      return true;
+    }
+  }
+  return false;
+}
+async function completeOAuthFlow(provider, serverUrl, options = {}) {
+  const flowProvider = provider;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
+  const fetchFn = options.fetchFn ?? flowProvider.getProxyFetch?.() ?? void 0;
+  if (!flowProvider.hasPendingFlow) {
+    const result = await auth(provider, { serverUrl, fetchFn });
+    if (result === "AUTHORIZED") return;
+    if (result !== "REDIRECT") {
+      throw new Error(`Unexpected OAuth auth() result: ${result}`);
+    }
+  }
+  if (flowProvider.preventAutoAuth === true && typeof flowProvider.startAuthorization === "function") {
+    flowProvider.startAuthorization();
+  }
+  if (typeof flowProvider.getAuthorizationResponse === "function" || typeof flowProvider.getAuthorizationCode === "function") {
+    const response = typeof flowProvider.getAuthorizationResponse === "function" ? await flowProvider.getAuthorizationResponse() : { code: await flowProvider.getAuthorizationCode() };
+    if (options.finishAuthorization) {
+      await options.finishAuthorization(response.code, response.iss);
+    } else {
+      await auth(provider, {
+        serverUrl,
+        authorizationCode: response.code,
+        ...response.iss !== void 0 ? { iss: response.iss } : {},
+        fetchFn
+      });
+    }
+    return;
+  }
+  await waitForBrowserAuthComplete(flowProvider, timeoutMs);
+}
+async function waitForBrowserAuthComplete(provider, timeoutMs) {
+  if (typeof window === "undefined") {
+    throw new Error(
+      "OAuth redirect requires a browser environment or a provider with getAuthorizationCode()"
+    );
+  }
+  if (provider.useRedirectFlow) {
+    await new Promise(() => {
+    });
+    return;
+  }
+  const tokensKey = provider.getKey?.("tokens");
+  if (!tokensKey) {
+    throw new Error(
+      "Browser OAuth provider must expose getKey() for token storage"
+    );
+  }
+  let state = null;
+  const authUrl = provider.getLastAttemptedAuthUrl?.();
+  if (authUrl) {
+    try {
+      state = new URL(authUrl).searchParams.get("state");
+    } catch {
+    }
+  }
+  try {
+    const result = await runAuthPopup({
+      popup: null,
+      state,
+      tokensKey,
+      timeoutMs
+    });
+    switch (result.kind) {
+      case "success":
+        return;
+      case "cancelled":
+        throw new Error("OAuth authentication was cancelled.");
+      case "timeout":
+        throw new Error(
+          `OAuth callback not received within ${timeoutMs}ms. Ensure /oauth/callback calls onMcpAuthorization().`
+        );
+      case "error":
+        throw new Error(result.error);
+      default:
+        throw new Error("Unexpected OAuth popup result");
+    }
+  } finally {
+    provider.markFlowComplete?.();
+  }
+}
 
 // src/utils/json-schema-validator.ts
 import {
@@ -517,6 +643,7 @@ var BaseConnector = class {
   toolsCache = null;
   capabilitiesCache = null;
   serverInfoCache = null;
+  authorizationCache;
   connected = false;
   opts;
   notificationHandlers = [];
@@ -780,6 +907,21 @@ var BaseConnector = class {
       "setupElicitationHandler: Elicitation handler registered successfully"
     );
   }
+  /**
+   * Run one logical MCP operation. HTTP connectors override this host seam to
+   * finish an SDK-started interactive OAuth flow and retry exactly once.
+   */
+  async executeRequest(operation) {
+    return operation();
+  }
+  /** OAuth state discovered for the active connection, when available. */
+  get authorization() {
+    return this.authorizationCache;
+  }
+  /** Start optional OAuth for a connected mixed-auth server. */
+  async authenticate() {
+    throw new Error("This connector does not support interactive OAuth");
+  }
   /**
    * Disconnects the SDK client and releases transport resources.
    *
@@ -827,13 +969,13 @@ var BaseConnector = class {
       icons: serverInfo.icons
     } : null;
     try {
-      const listToolsRes = await this.client.listTools(
-        void 0,
-        defaultRequestOptions
+      const listToolsRes = await this.executeRequest(
+        () => this.client.listTools(void 0, defaultRequestOptions)
       );
       this.toolsCache = listToolsRes.tools ?? [];
       logger.debug(`Fetched ${this.toolsCache.length} tools from server`);
     } catch (err) {
+      if (isOAuthInteractionRequired(err)) throw err;
       const error = err;
       if (error.code === -32601) {
         logger.debug("Server does not implement tools/list, assuming no tools");
@@ -907,9 +1049,8 @@ var BaseConnector = class {
     const progressHandler = enhancedOptions?.onprogress;
     if (progressHandler) this.activeProgressHandlers.add(progressHandler);
     try {
-      const res = await this.client.callTool(
-        { name, arguments: args },
-        enhancedOptions
+      const res = await this.executeRequest(
+        () => this.client.callTool({ name, arguments: args }, enhancedOptions)
       );
       logger.debug(`Tool '${name}' returned`, res);
       return res;
@@ -929,7 +1070,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug("[listTools] Fetching fresh tools from server...");
-    const result = await this.client.listTools(void 0, options);
+    const result = await this.executeRequest(
+      () => this.client.listTools(void 0, options)
+    );
     const tools = result.tools ? [...result.tools] : [];
     logger.debug(
       `[listTools] Returned ${tools.length} tools:`,
@@ -949,7 +1092,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug("Listing resources", cursor ? `with cursor: ${cursor}` : "");
-    return await this.client.listResources({ cursor }, options);
+    return await this.executeRequest(
+      () => this.client.listResources({ cursor }, options)
+    );
   }
   /**
    * List all resources from the server, automatically handling pagination
@@ -967,14 +1112,16 @@ var BaseConnector = class {
     }
     try {
       logger.debug("Listing all resources (with auto-pagination)");
-      const allResources = [];
-      let cursor = void 0;
-      do {
-        const result = await this.client.listResources({ cursor }, options);
-        allResources.push(...result.resources || []);
-        cursor = result.nextCursor;
-      } while (cursor);
-      return { resources: allResources };
+      return await this.executeRequest(async () => {
+        const allResources = [];
+        let cursor = void 0;
+        do {
+          const result = await this.client.listResources({ cursor }, options);
+          allResources.push(...result.resources || []);
+          cursor = result.nextCursor;
+        } while (cursor);
+        return { resources: allResources };
+      });
     } catch (err) {
       const error = err;
       if (error.code === -32601) {
@@ -995,7 +1142,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug("Listing resource templates");
-    return await this.client.listResourceTemplates(void 0, options);
+    return await this.executeRequest(
+      () => this.client.listResourceTemplates(void 0, options)
+    );
   }
   /**
    * Request completion suggestions for a prompt or resource template argument
@@ -1009,7 +1158,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug("[complete] Requesting completions for:", params.ref);
-    const result = await this.client.complete(params, options);
+    const result = await this.executeRequest(
+      () => this.client.complete(params, options)
+    );
     logger.debug(
       `[complete] Received ${result.completion.values.length} suggestions`
     );
@@ -1027,7 +1178,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Reading resource ${uri}`);
-    const res = await this.client.readResource({ uri }, options);
+    const res = await this.executeRequest(
+      () => this.client.readResource({ uri }, options)
+    );
     return res;
   }
   /**
@@ -1041,7 +1194,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Subscribing to resource: ${uri}`);
-    return await this.client.subscribeResource({ uri }, options);
+    return await this.executeRequest(
+      () => this.client.subscribeResource({ uri }, options)
+    );
   }
   /**
    * Unsubscribe from resource updates
@@ -1054,7 +1209,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Unsubscribing from resource: ${uri}`);
-    return await this.client.unsubscribeResource({ uri }, options);
+    return await this.executeRequest(
+      () => this.client.unsubscribeResource({ uri }, options)
+    );
   }
   /**
    * Lists prompts exposed by the server.
@@ -1071,7 +1228,7 @@ var BaseConnector = class {
     }
     try {
       logger.debug("Listing prompts");
-      return await this.client.listPrompts();
+      return await this.executeRequest(() => this.client.listPrompts());
     } catch (err) {
       const error = err;
       if (error.code === -32601) {
@@ -1093,7 +1250,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Getting prompt ${name}`);
-    return await this.client.getPrompt({ name, arguments: args });
+    return await this.executeRequest(
+      () => this.client.getPrompt({ name, arguments: args })
+    );
   }
   /**
    * Sends a raw, potentially non-standard request through the SDK client.
@@ -1108,10 +1267,12 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Sending raw request '${method}' with params`, params);
-    return await this.client.request(
-      { method, params: params ?? {} },
-      passthroughResultSchema,
-      options
+    return await this.executeRequest(
+      () => this.client.request(
+        { method, params: params ?? {} },
+        passthroughResultSchema,
+        options
+      )
     );
   }
   /**
@@ -1144,6 +1305,7 @@ var BaseConnector = class {
       }
     }
     this.toolsCache = null;
+    this.authorizationCache = void 0;
     if (issues.length) {
       logger.warn(`Resource cleanup finished with ${issues.length} issue(s)`);
     }
@@ -1151,9 +1313,10 @@ var BaseConnector = class {
 };
 
 // src/transport/http.ts
+var MIXED_AUTH_DISCOVERY_TIMEOUT_MS = 2e3;
 function detectUnauthorized(err, depth = 0) {
   if (!err || depth > 5) return false;
-  if (err instanceof UnauthorizedError) return true;
+  if (err instanceof UnauthorizedError2) return true;
   if (err instanceof SdkHttpError && err.status === 401) return true;
   if (err instanceof Error) {
     if (err.cause) {
@@ -1164,6 +1327,11 @@ function detectUnauthorized(err, depth = 0) {
   }
   return false;
 }
+function isOAuthClientProvider(provider) {
+  return Boolean(
+    provider && "redirectToAuthorization" in provider && typeof provider.redirectToAuthorization === "function" && "tokens" in provider && typeof provider.tokens === "function"
+  );
+}
 function createMcpProxyFetch(logicalServerUrl, proxyUrl, baseFetch, serverId) {
   const logical = new URL(logicalServerUrl);
   const proxy = proxyUrl.replace(/\/$/, "");
@@ -1189,6 +1357,31 @@ function createMcpProxyFetch(logicalServerUrl, proxyUrl, baseFetch, serverId) {
     );
   };
 }
+function createDeadlineFetch(baseFetch, deadlineSignal) {
+  return async (input, init) => {
+    const requestSignal = init?.signal;
+    if (!requestSignal) {
+      return baseFetch(input, { ...init, signal: deadlineSignal });
+    }
+    const controller = new AbortController();
+    const abortFromRequest = () => controller.abort(requestSignal.reason);
+    const abortFromDeadline = () => controller.abort(deadlineSignal.reason);
+    if (requestSignal.aborted) abortFromRequest();
+    else
+      requestSignal.addEventListener("abort", abortFromRequest, { once: true });
+    if (deadlineSignal.aborted) abortFromDeadline();
+    else
+      deadlineSignal.addEventListener("abort", abortFromDeadline, {
+        once: true
+      });
+    try {
+      return await baseFetch(input, { ...init, signal: controller.signal });
+    } finally {
+      requestSignal.removeEventListener("abort", abortFromRequest);
+      deadlineSignal.removeEventListener("abort", abortFromDeadline);
+    }
+  };
+}
 var HttpConnector = class extends BaseConnector {
   baseUrl;
   headers;
@@ -1199,8 +1392,11 @@ var HttpConnector = class extends BaseConnector {
   gatewayUrl;
   serverId;
   reconnectionOptions;
+  detectMixedAuth;
   transportType = null;
   streamableTransport = null;
+  hadAccessTokenAtConnect = false;
+  pendingOAuthCompletion = null;
   /**
    * Creates an HTTP connector.
    *
@@ -1231,6 +1427,99 @@ var HttpConnector = class extends BaseConnector {
     };
     this.protocolNegotiation = opts.protocolNegotiation ?? "auto";
     this.reconnectionOptions = opts.reconnectionOptions;
+    this.detectMixedAuth = opts.detectMixedAuth ?? true;
+  }
+  get oauthProvider() {
+    return isOAuthClientProvider(this.opts.authProvider) ? this.opts.authProvider : void 0;
+  }
+  async completeInteractiveAuthorization() {
+    const provider = this.oauthProvider;
+    if (!provider) {
+      throw new Error("No OAuth client provider is configured");
+    }
+    if (!this.pendingOAuthCompletion) {
+      this.pendingOAuthCompletion = completeOAuthFlow(provider, this.baseUrl, {
+        fetchFn: this.customFetch,
+        finishAuthorization: async (code, iss) => {
+          const transport = this.streamableTransport;
+          if (!transport) {
+            throw new Error("OAuth transport is no longer connected");
+          }
+          await transport.finishAuth(code, iss);
+        }
+      }).then(() => {
+        if (this.authorizationCache) {
+          this.authorizationCache = {
+            ...this.authorizationCache,
+            authenticated: true
+          };
+        }
+      }).finally(() => {
+        this.pendingOAuthCompletion = null;
+      });
+    }
+    await this.pendingOAuthCompletion;
+  }
+  async executeRequest(operation) {
+    try {
+      return await operation();
+    } catch (error) {
+      const provider = this.oauthProvider;
+      if (!provider || provider.preventAutoAuth === true || !isOAuthInteractionRequired(error)) {
+        throw error;
+      }
+      await this.completeInteractiveAuthorization();
+      return operation();
+    }
+  }
+  /** Authenticate an already-connected server without requiring a 401 first. */
+  async authenticate() {
+    if (!this.connected || !this.streamableTransport) {
+      throw new Error("MCP client is not connected");
+    }
+    await this.completeInteractiveAuthorization();
+  }
+  async initialize(defaultRequestOptions = this.opts.defaultRequestOptions ?? {}) {
+    const capabilities = await super.initialize(defaultRequestOptions);
+    if (!this.detectMixedAuth || !this.oauthProvider || this.hadAccessTokenAtConnect) {
+      return capabilities;
+    }
+    const controller = new AbortController();
+    let timeout;
+    const discoveryTimeout = new Promise((_, reject) => {
+      timeout = setTimeout(() => {
+        const error = new Error(
+          `Mixed-auth metadata discovery timed out after ${MIXED_AUTH_DISCOVERY_TIMEOUT_MS}ms`
+        );
+        controller.abort(error);
+        reject(error);
+      }, MIXED_AUTH_DISCOVERY_TIMEOUT_MS);
+    });
+    const baseFetch = this.customFetch ?? globalThis.fetch.bind(globalThis);
+    try {
+      const metadata = await Promise.race([
+        discoverOAuthProtectedResourceMetadata(
+          this.baseUrl,
+          { protocolVersion: this.negotiatedProtocolVersion },
+          createDeadlineFetch(baseFetch, controller.signal)
+        ),
+        discoveryTimeout
+      ]);
+      this.authorizationCache = {
+        mode: "mixed",
+        authenticated: false,
+        ...metadata.resource ? { resource: metadata.resource } : {},
+        ...metadata.scopes_supported ? { scopesSupported: [...metadata.scopes_supported] } : {}
+      };
+      logger.info(
+        "OAuth protected-resource metadata found after anonymous connection; server uses mixed auth"
+      );
+    } catch (error) {
+      logger.debug("Mixed-auth metadata was not discovered:", error);
+    } finally {
+      if (timeout) clearTimeout(timeout);
+    }
+    return capabilities;
   }
   buildClientOptions() {
     return {
@@ -1337,6 +1626,16 @@ var HttpConnector = class extends BaseConnector {
     }
     const baseUrl = this.baseUrl;
     logger.debug(`Connecting to MCP implementation via HTTP: ${baseUrl}`);
+    const oauthProvider = this.oauthProvider;
+    if (oauthProvider) {
+      try {
+        this.hadAccessTokenAtConnect = Boolean(
+          (await oauthProvider.tokens())?.access_token
+        );
+      } catch {
+        this.hadAccessTokenAtConnect = false;
+      }
+    }
     try {
       await this.connectWithStreamableHttp(baseUrl);
       logger.debug("\u2705 Successfully connected via streamable HTTP");
@@ -1611,7 +1910,7 @@ var HttpConnector = class extends BaseConnector {
 };
 
 // src/utils/version.ts
-var VERSION = "2.1.0";
+var VERSION = "2.1.1-canary.0";
 function getPackageVersion() {
   return VERSION;
 }
@@ -2577,29 +2876,43 @@ var BrowserOAuthClientProvider = class {
    * @param authorizationUrl - The fully constructed authorization URL from the SDK.
    */
   async redirectToAuthorization(authorizationUrl) {
-    const sanitizedAuthUrl = await this.prepareAuthorizationUrl(authorizationUrl);
+    await this.prepareAuthorizationUrl(authorizationUrl);
     if (this.preventAutoAuth) {
       console.info(
         `[${this.storageKeyPrefix}] Auto-auth prevented. Authorization URL stored for manual trigger.`
       );
       return;
     }
+    this.startAuthorization();
+  }
+  /**
+   * Open the authorization URL prepared by the official SDK.
+   *
+   * This is the explicit-user-action counterpart to `preventAutoAuth`: the
+   * provider still lets the SDK own discovery and PKCE state, while a host can
+   * launch the stored authorization request later from an Authenticate button.
+   */
+  startAuthorization() {
+    const authorizationUrl = this.lastAttemptedAuthUrl;
+    if (!authorizationUrl) {
+      throw new Error("No prepared OAuth authorization is available");
+    }
     if (this.useRedirectFlow) {
       console.info(
         `[${this.storageKeyPrefix}] Redirecting to authorization URL (full-page redirect).`
       );
-      window.location.href = sanitizedAuthUrl;
+      window.location.href = authorizationUrl;
       return;
     }
     const popupFeatures = "width=600,height=700,resizable=yes,scrollbars=yes,status=yes";
     try {
       const popup = window.open(
-        sanitizedAuthUrl,
+        authorizationUrl,
         `mcp_auth_${this.serverUrlHash}`,
         popupFeatures
       );
       if (this.onPopupWindow) {
-        this.onPopupWindow(sanitizedAuthUrl, popupFeatures, popup);
+        this.onPopupWindow(authorizationUrl, popupFeatures, popup);
       }
       if (!popup || popup.closed || typeof popup.closed === "undefined") {
         console.warn(
@@ -3148,103 +3461,6 @@ function setTelemetrySource(source) {
   Tel.getInstance().setSource(source);
 }
 
-// src/auth/flow.ts
-import {
-  auth,
-  UnauthorizedError as UnauthorizedError2
-} from "@modelcontextprotocol/client";
-var DEFAULT_AUTH_TIMEOUT_MS = 5 * 6e4;
-function isUnauthorized(err, depth = 0) {
-  if (!err || depth > 5) return false;
-  if (err instanceof UnauthorizedError2) return true;
-  if (err instanceof Error) {
-    const code = err.code;
-    if (code === 401) return true;
-    if (err.name === "UnauthorizedError") return true;
-    const message = err.message ?? "";
-    if (message.includes("401") || message.includes("Unauthorized")) {
-      return true;
-    }
-    if (err.cause && isUnauthorized(err.cause, depth + 1)) return true;
-    const data = err.data;
-    if (data?.cause && isUnauthorized(data.cause, depth + 1)) return true;
-  }
-  return false;
-}
-async function completeOAuthFlow(provider, serverUrl, options = {}) {
-  const flowProvider = provider;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
-  const fetchFn = options.fetchFn ?? flowProvider.getProxyFetch?.() ?? void 0;
-  if (!flowProvider.hasPendingFlow) {
-    const result = await auth(provider, { serverUrl, fetchFn });
-    if (result === "AUTHORIZED") return;
-    if (result !== "REDIRECT") {
-      throw new Error(`Unexpected OAuth auth() result: ${result}`);
-    }
-  }
-  if (typeof flowProvider.getAuthorizationResponse === "function" || typeof flowProvider.getAuthorizationCode === "function") {
-    const response = typeof flowProvider.getAuthorizationResponse === "function" ? await flowProvider.getAuthorizationResponse() : { code: await flowProvider.getAuthorizationCode() };
-    await auth(provider, {
-      serverUrl,
-      authorizationCode: response.code,
-      ...response.iss !== void 0 ? { iss: response.iss } : {},
-      fetchFn
-    });
-    return;
-  }
-  await waitForBrowserAuthComplete(flowProvider, timeoutMs);
-}
-async function waitForBrowserAuthComplete(provider, timeoutMs) {
-  if (typeof window === "undefined") {
-    throw new Error(
-      "OAuth redirect requires a browser environment or a provider with getAuthorizationCode()"
-    );
-  }
-  if (provider.useRedirectFlow) {
-    await new Promise(() => {
-    });
-    return;
-  }
-  const tokensKey = provider.getKey?.("tokens");
-  if (!tokensKey) {
-    throw new Error(
-      "Browser OAuth provider must expose getKey() for token storage"
-    );
-  }
-  let state = null;
-  const authUrl = provider.getLastAttemptedAuthUrl?.();
-  if (authUrl) {
-    try {
-      state = new URL(authUrl).searchParams.get("state");
-    } catch {
-    }
-  }
-  try {
-    const result = await runAuthPopup({
-      popup: null,
-      state,
-      tokensKey,
-      timeoutMs
-    });
-    switch (result.kind) {
-      case "success":
-        return;
-      case "cancelled":
-        throw new Error("OAuth authentication was cancelled.");
-      case "timeout":
-        throw new Error(
-          `OAuth callback not received within ${timeoutMs}ms. Ensure /oauth/callback calls onMcpAuthorization().`
-        );
-      case "error":
-        throw new Error(result.error);
-      default:
-        throw new Error("Unexpected OAuth popup result");
-    }
-  } finally {
-    provider.markFlowComplete?.();
-  }
-}
-
 // src/core/base.ts
 init_logging();
 
@@ -3475,6 +3691,14 @@ var MCPConnection = class {
   get serverInfo() {
     return this.connector.serverInfo;
   }
+  /** OAuth state discovered for this connection, when available. */
+  get authorization() {
+    return this.connector.authorization;
+  }
+  /** Authenticate an already-connected mixed-auth server. */
+  async authenticate() {
+    await this.connector.authenticate();
+  }
   /**
    * The negotiated protocol era for this session's connection:
    * `"legacy"` (2025-era) or `"modern"` (2026-07-28-era).
@@ -3507,7 +3731,8 @@ var MCPConnection = class {
       ...server ? { server } : {},
       capabilities,
       instructions: this.connector.instructions,
-      extensions
+      extensions,
+      ...this.authorization ? { authorization: this.authorization } : {}
     };
   }
   /**
@@ -3747,7 +3972,7 @@ function trackClientRemoveServer(name) {
 }
 
 // src/core/base.ts
-function isOAuthClientProvider(provider) {
+function isOAuthClientProvider2(provider) {
   return !!provider && typeof provider === "object" && "redirectUrl" in provider && "clientMetadata" in provider;
 }
 var BaseMCPClient = class {
@@ -3980,7 +4205,7 @@ var BaseMCPClient = class {
         ...serverConfig,
         authProvider: oauthProvider
       };
-    } else if ("authProvider" in serverConfig && serverConfig.authProvider && isOAuthClientProvider(serverConfig.authProvider)) {
+    } else if ("authProvider" in serverConfig && serverConfig.authProvider && isOAuthClientProvider2(serverConfig.authProvider)) {
       oauthProvider = serverConfig.authProvider;
     }
     const openSession = async () => {
@@ -4320,6 +4545,7 @@ var BrowserMCPClient = class _BrowserMCPClient extends BaseMCPClient {
       fetch: configuredFetch,
       authToken,
       authProvider,
+      detectMixedAuth,
       wrapTransport,
       clientOptions,
       protocolNegotiation,
@@ -4344,6 +4570,7 @@ var BrowserMCPClient = class _BrowserMCPClient extends BaseMCPClient {
       fetch: configuredFetch ?? globalThis.fetch.bind(globalThis),
       authToken,
       authProvider,
+      detectMixedAuth,
       wrapTransport,
       clientOptions,
       onSampling: resolved.onSampling,
@@ -4655,6 +4882,9 @@ function useMcpOperations(params) {
         });
         return result;
       } catch (error) {
+        if (isOAuthInteractionRequired(error)) {
+          params.onAuthorizationRequired(error);
+        }
         params.addLog("error", `Tool "${name}" call failed:`, error);
         Tel.getInstance().trackUseMcpToolCall({
           toolName: name,
@@ -4666,7 +4896,7 @@ function useMcpOperations(params) {
         throw error;
       }
     },
-    [params.addLog]
+    [params.addLog, params.onAuthorizationRequired]
   );
   const listResources = useCallback(async () => {
     const connection = requireConnection(params, "list resources");
@@ -4842,6 +5072,7 @@ function useMcp(options) {
     reconnectionOptions,
     preventAutoAuth = true,
     // Default to true - require explicit user action for OAuth
+    detectMixedAuth = true,
     useRedirectFlow = false,
     // Default to false for backward compatibility (use popup)
     onPopupWindow,
@@ -5019,6 +5250,7 @@ function useMcp(options) {
   const [log, setLog] = useState([]);
   const [authUrl, setAuthUrl] = useState(void 0);
   const [authTokens, setAuthTokens] = useState(void 0);
+  const [authorization, setAuthorization] = useState(void 0);
   const clientRef = useRef(null);
   const connectionRef = useRef(null);
   const authProviderRef = useRef(
@@ -5033,6 +5265,9 @@ function useMcp(options) {
   const retryScheduledRef = useRef(false);
   const popupFlowActiveRef = useRef(false);
   const stateRef = useRef(state);
+  const authorizationRef = useRef(authorization);
+  const authorizationServerUrlRef = useRef(url);
+  authorizationRef.current = authorization;
   const autoReconnectRef = useRef(autoReconnect);
   const successfulTransportRef = useRef(null);
   const connectRef = useRef(null);
@@ -5099,6 +5334,24 @@ function useMcp(options) {
     },
     [instanceLogger]
   );
+  const onAuthorizationRequired = useCallback2(
+    (authError) => {
+      const preparedAuthUrl = authProviderRef.current?.getLastAttemptedAuthUrl?.() ?? void 0;
+      addLog(
+        "info",
+        "This server requires OAuth for the requested operation; waiting for authentication.",
+        authError
+      );
+      const authorizationRequired = {
+        ...authorizationRef.current ?? { mode: "mixed" },
+        authenticated: false
+      };
+      authorizationRef.current = authorizationRequired;
+      setAuthorization(authorizationRequired);
+      if (preparedAuthUrl) setAuthUrl(preparedAuthUrl);
+    },
+    [addLog]
+  );
   const connectionOperations = useMcpOperations({
     stateRef,
     connectionRef,
@@ -5109,7 +5362,8 @@ function useMcp(options) {
     setResourceTemplates,
     setPrompts,
     setSkills,
-    addLog
+    addLog,
+    onAuthorizationRequired
   });
   const disconnect = useCallback2(
     async (quiet = false) => {
@@ -5250,6 +5504,11 @@ function useMcp(options) {
     connectingRef.current = true;
     connectEpochRef.current += 1;
     connectAttemptRef.current += 1;
+    if (authorizationServerUrlRef.current !== url) {
+      authorizationServerUrlRef.current = url;
+      authorizationRef.current = void 0;
+      setAuthorization(void 0);
+    }
     setError(void 0);
     setAuthUrl(void 0);
     successfulTransportRef.current = null;
@@ -5336,6 +5595,7 @@ function useMcp(options) {
           // Protocol era negotiation mode ("legacy" | "auto" | { pin }); the
           // connector defaults to automatic v1/v2 negotiation.
           ...protocolNegotiation !== void 0 && { protocolNegotiation },
+          detectMixedAuth,
           // Pass user-configurable reconnection options, or when autoReconnect
           // is disabled, disable SDK transport reconnection to prevent
           // unwanted GET polling requests
@@ -5501,8 +5761,13 @@ function useMcp(options) {
           protocolEra: protocolEra2,
           protocolVersion: protocolVersion2,
           instructions: instructions2,
-          extensions: extensions2
+          extensions: extensions2,
+          authorization: connectionAuthorization
         } = connection.info;
+        if (connectionAuthorization) {
+          setAuthorization(connectionAuthorization);
+          authorizationRef.current = connectionAuthorization;
+        }
         if (isMountedRef.current) {
           setProtocolEra(protocolEra2);
           setProtocolVersion(protocolVersion2);
@@ -5553,6 +5818,14 @@ function useMcp(options) {
             return "failed";
           }
           if (tokens?.access_token) {
+            if (authorizationRef.current?.mode === "mixed") {
+              const authenticatedAuthorization = {
+                ...authorizationRef.current,
+                authenticated: true
+              };
+              setAuthorization(authenticatedAuthorization);
+              authorizationRef.current = authenticatedAuthorization;
+            }
             const expiresAt = getOAuthTokenExpiry(tokens);
             let tokenEndpoint = null;
             let resource = null;
@@ -5732,6 +6005,7 @@ function useMcp(options) {
     headers,
     transportType,
     preventAutoAuth,
+    detectMixedAuth,
     useRedirectFlow,
     onPopupWindow,
     enabled,
@@ -5768,11 +6042,12 @@ function useMcp(options) {
   const authenticate = useCallback2(async () => {
     addLog("info", "Manual authentication requested...");
     const currentState = stateRef.current;
+    const isOptionalMixedAuthentication = currentState === "ready" && authorizationRef.current?.mode === "mixed";
     if (currentState === "failed") {
       addLog("info", "Attempting to reconnect and authenticate via retry...");
       retry();
-    } else if (currentState === "pending_auth") {
-      addLog("info", "Proceeding with authentication from pending state...");
+    } else if (currentState === "pending_auth" || currentState === "ready" && authorizationRef.current?.mode === "mixed" && !authorizationRef.current.authenticated) {
+      addLog("info", "Proceeding with authentication...");
       try {
         assert(
           authProviderRef.current,
@@ -5891,16 +6166,16 @@ function useMcp(options) {
           case "cancelled":
             addLog(
               "warn",
-              "Authentication popup was closed before completing. Returning to pending_auth."
+              isOptionalMixedAuthentication ? "Authentication popup was closed before completing. Public tools remain available." : "Authentication popup was closed before completing. Returning to pending_auth."
             );
-            setState("pending_auth");
+            setState(isOptionalMixedAuthentication ? "ready" : "pending_auth");
             break;
           case "timeout":
             addLog(
               "warn",
-              "Authentication timed out waiting for the popup. Returning to pending_auth."
+              isOptionalMixedAuthentication ? "Authentication timed out waiting for the popup. Public tools remain available." : "Authentication timed out waiting for the popup. Returning to pending_auth."
             );
-            setState("pending_auth");
+            setState(isOptionalMixedAuthentication ? "ready" : "pending_auth");
             break;
           case "error":
             failConnection(`Authentication failed: ${result.error}`);
@@ -6189,6 +6464,7 @@ function useMcp(options) {
     log,
     authUrl,
     authTokens,
+    authorization,
     client: clientRef.current,
     ...connectionOperations,
     retry,
@@ -6598,7 +6874,7 @@ function isSameMcpServer(left, right) {
   return left.id === right.id && sameSerializedValue(
     pickLiveServerConfig(left),
     pickLiveServerConfig(right)
-  ) && left.name === right.name && left.state === right.state && left.error === right.error && left.authUrl === right.authUrl && sameSerializedValue(left.authTokens, right.authTokens) && left.protocolEra === right.protocolEra && left.protocolVersion === right.protocolVersion && sameSerializedValue(left.serverInfo, right.serverInfo) && sameSerializedValue(left.capabilities, right.capabilities) && left.instructions === right.instructions && sameSerializedValue(left.extensions, right.extensions) && sameSerializedValue(left.tools, right.tools) && sameSerializedValue(left.resources, right.resources) && sameSerializedValue(left.resourceTemplates, right.resourceTemplates) && sameSerializedValue(left.prompts, right.prompts) && sameSerializedValue(left.notifications, right.notifications) && left.unreadNotificationCount === right.unreadNotificationCount && sameSerializedValue(
+  ) && left.name === right.name && left.state === right.state && left.error === right.error && left.authUrl === right.authUrl && sameSerializedValue(left.authTokens, right.authTokens) && sameSerializedValue(left.authorization, right.authorization) && left.protocolEra === right.protocolEra && left.protocolVersion === right.protocolVersion && sameSerializedValue(left.serverInfo, right.serverInfo) && sameSerializedValue(left.capabilities, right.capabilities) && left.instructions === right.instructions && sameSerializedValue(left.extensions, right.extensions) && sameSerializedValue(left.tools, right.tools) && sameSerializedValue(left.resources, right.resources) && sameSerializedValue(left.resourceTemplates, right.resourceTemplates) && sameSerializedValue(left.prompts, right.prompts) && sameSerializedValue(left.notifications, right.notifications) && left.unreadNotificationCount === right.unreadNotificationCount && sameSerializedValue(
     left.pendingSamplingRequests,
     right.pendingSamplingRequests
   ) && sameSerializedValue(
@@ -6780,6 +7056,7 @@ function McpServerWrapper({
     mcp.instructions,
     mcp.extensions,
     mcp.authTokens,
+    mcp.authorization,
     // Functions excluded - they're stable via useCallback in useMcp
     // mcp.log excluded - log changes shouldn't trigger provider updates
     // mcp.client excluded - client reference stability handled by manual check
@@ -8991,6 +9268,7 @@ export {
   getAllRpcLogs,
   getRpcLogs,
   getViewResourceUri,
+  isOAuthInteractionRequired,
   isToolVisibleToModel,
   isViewResource,
   isViewTool,