@mcp-use/client 2.1.0 → 2.1.1-canary.1

package/dist/index-browser.js

@@ -128,7 +128,7 @@ var Logger = class {
 var logger = Logger.get();
 
 // src/utils/version.ts
-var VERSION = "2.1.0";
+var VERSION = "2.1.1-canary.1";
 function getPackageVersion() {
   return VERSION;
 }
@@ -1530,29 +1530,43 @@ var BrowserOAuthClientProvider = class {
    * @param authorizationUrl - The fully constructed authorization URL from the SDK.
    */
   async redirectToAuthorization(authorizationUrl) {
-    const sanitizedAuthUrl = await this.prepareAuthorizationUrl(authorizationUrl);
+    await this.prepareAuthorizationUrl(authorizationUrl);
     if (this.preventAutoAuth) {
       console.info(
         `[${this.storageKeyPrefix}] Auto-auth prevented. Authorization URL stored for manual trigger.`
       );
       return;
     }
+    this.startAuthorization();
+  }
+  /**
+   * Open the authorization URL prepared by the official SDK.
+   *
+   * This is the explicit-user-action counterpart to `preventAutoAuth`: the
+   * provider still lets the SDK own discovery and PKCE state, while a host can
+   * launch the stored authorization request later from an Authenticate button.
+   */
+  startAuthorization() {
+    const authorizationUrl = this.lastAttemptedAuthUrl;
+    if (!authorizationUrl) {
+      throw new Error("No prepared OAuth authorization is available");
+    }
     if (this.useRedirectFlow) {
       console.info(
         `[${this.storageKeyPrefix}] Redirecting to authorization URL (full-page redirect).`
       );
-      window.location.href = sanitizedAuthUrl;
+      window.location.href = authorizationUrl;
       return;
     }
     const popupFeatures = "width=600,height=700,resizable=yes,scrollbars=yes,status=yes";
     try {
       const popup = window.open(
-        sanitizedAuthUrl,
+        authorizationUrl,
         `mcp_auth_${this.serverUrlHash}`,
         popupFeatures
       );
       if (this.onPopupWindow) {
-        this.onPopupWindow(sanitizedAuthUrl, popupFeatures, popup);
+        this.onPopupWindow(authorizationUrl, popupFeatures, popup);
       }
       if (!popup || popup.closed || typeof popup.closed === "undefined") {
         console.warn(
@@ -1931,6 +1945,7 @@ async function completeAuthorization() {
 // src/auth/flow.ts
 import {
   auth,
+  InsufficientScopeError,
   UnauthorizedError
 } from "@modelcontextprotocol/client";
 var DEFAULT_AUTH_TIMEOUT_MS = 5 * 6e4;
@@ -1951,6 +1966,25 @@ function isUnauthorized(err, depth = 0) {
   }
   return false;
 }
+function isOAuthInteractionRequired(err, depth = 0) {
+  if (!err || depth > 5) return false;
+  if (err instanceof InsufficientScopeError || err instanceof UnauthorizedError) {
+    return true;
+  }
+  if (err instanceof Error) {
+    if (err.name === "InsufficientScopeError" || err.name === "UnauthorizedError") {
+      return true;
+    }
+    if (err.cause && isOAuthInteractionRequired(err.cause, depth + 1)) {
+      return true;
+    }
+    const data = err.data;
+    if (data?.cause && isOAuthInteractionRequired(data.cause, depth + 1)) {
+      return true;
+    }
+  }
+  return false;
+}
 async function completeOAuthFlow(provider, serverUrl, options = {}) {
   const flowProvider = provider;
   const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
@@ -1962,14 +1996,21 @@ async function completeOAuthFlow(provider, serverUrl, options = {}) {
       throw new Error(`Unexpected OAuth auth() result: ${result}`);
     }
   }
+  if (flowProvider.preventAutoAuth === true && typeof flowProvider.startAuthorization === "function") {
+    flowProvider.startAuthorization();
+  }
   if (typeof flowProvider.getAuthorizationResponse === "function" || typeof flowProvider.getAuthorizationCode === "function") {
     const response = typeof flowProvider.getAuthorizationResponse === "function" ? await flowProvider.getAuthorizationResponse() : { code: await flowProvider.getAuthorizationCode() };
-    await auth(provider, {
-      serverUrl,
-      authorizationCode: response.code,
-      ...response.iss !== void 0 ? { iss: response.iss } : {},
-      fetchFn
-    });
+    if (options.finishAuthorization) {
+      await options.finishAuthorization(response.code, response.iss);
+    } else {
+      await auth(provider, {
+        serverUrl,
+        authorizationCode: response.code,
+        ...response.iss !== void 0 ? { iss: response.iss } : {},
+        fetchFn
+      });
+    }
     return;
   }
   await waitForBrowserAuthComplete(flowProvider, timeoutMs);
@@ -2031,6 +2072,7 @@ import { auth as auth2, UnauthorizedError as UnauthorizedError3 } from "@modelco
 // src/transport/http.ts
 import {
   Client,
+  discoverOAuthProtectedResourceMetadata,
   SdkError,
   SdkHttpError,
   StreamableHTTPClientTransport as StreamableHTTPClientTransport2,
@@ -2087,6 +2129,7 @@ var BaseConnector = class {
   toolsCache = null;
   capabilitiesCache = null;
   serverInfoCache = null;
+  authorizationCache;
   connected = false;
   opts;
   notificationHandlers = [];
@@ -2350,6 +2393,28 @@ var BaseConnector = class {
       "setupElicitationHandler: Elicitation handler registered successfully"
     );
   }
+  /**
+   * Run one logical MCP operation. HTTP connectors override this host seam to
+   * finish an SDK-started interactive OAuth flow and retry exactly once.
+   */
+  async executeRequest(operation) {
+    return operation();
+  }
+  /** OAuth state discovered for the active connection, when available. */
+  get authorization() {
+    return this.authorizationCache;
+  }
+  /**
+   * Discover optional authorization metadata without delaying connection
+   * readiness. HTTP connectors override this with RFC 9728 discovery.
+   */
+  async discoverAuthorization() {
+    return this.authorization;
+  }
+  /** Start optional OAuth for a connected mixed-auth server. */
+  async authenticate() {
+    throw new Error("This connector does not support interactive OAuth");
+  }
   /**
    * Disconnects the SDK client and releases transport resources.
    *
@@ -2397,13 +2462,13 @@ var BaseConnector = class {
       icons: serverInfo.icons
     } : null;
     try {
-      const listToolsRes = await this.client.listTools(
-        void 0,
-        defaultRequestOptions
+      const listToolsRes = await this.executeRequest(
+        () => this.client.listTools(void 0, defaultRequestOptions)
       );
       this.toolsCache = listToolsRes.tools ?? [];
       logger.debug(`Fetched ${this.toolsCache.length} tools from server`);
     } catch (err) {
+      if (isOAuthInteractionRequired(err)) throw err;
       const error = err;
       if (error.code === -32601) {
         logger.debug("Server does not implement tools/list, assuming no tools");
@@ -2477,9 +2542,8 @@ var BaseConnector = class {
     const progressHandler = enhancedOptions?.onprogress;
     if (progressHandler) this.activeProgressHandlers.add(progressHandler);
     try {
-      const res = await this.client.callTool(
-        { name, arguments: args },
-        enhancedOptions
+      const res = await this.executeRequest(
+        () => this.client.callTool({ name, arguments: args }, enhancedOptions)
       );
       logger.debug(`Tool '${name}' returned`, res);
       return res;
@@ -2499,7 +2563,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug("[listTools] Fetching fresh tools from server...");
-    const result = await this.client.listTools(void 0, options);
+    const result = await this.executeRequest(
+      () => this.client.listTools(void 0, options)
+    );
     const tools = result.tools ? [...result.tools] : [];
     logger.debug(
       `[listTools] Returned ${tools.length} tools:`,
@@ -2519,7 +2585,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug("Listing resources", cursor ? `with cursor: ${cursor}` : "");
-    return await this.client.listResources({ cursor }, options);
+    return await this.executeRequest(
+      () => this.client.listResources({ cursor }, options)
+    );
   }
   /**
    * List all resources from the server, automatically handling pagination
@@ -2537,14 +2605,16 @@ var BaseConnector = class {
     }
     try {
       logger.debug("Listing all resources (with auto-pagination)");
-      const allResources = [];
-      let cursor = void 0;
-      do {
-        const result = await this.client.listResources({ cursor }, options);
-        allResources.push(...result.resources || []);
-        cursor = result.nextCursor;
-      } while (cursor);
-      return { resources: allResources };
+      return await this.executeRequest(async () => {
+        const allResources = [];
+        let cursor = void 0;
+        do {
+          const result = await this.client.listResources({ cursor }, options);
+          allResources.push(...result.resources || []);
+          cursor = result.nextCursor;
+        } while (cursor);
+        return { resources: allResources };
+      });
     } catch (err) {
       const error = err;
       if (error.code === -32601) {
@@ -2565,7 +2635,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug("Listing resource templates");
-    return await this.client.listResourceTemplates(void 0, options);
+    return await this.executeRequest(
+      () => this.client.listResourceTemplates(void 0, options)
+    );
   }
   /**
    * Request completion suggestions for a prompt or resource template argument
@@ -2579,7 +2651,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug("[complete] Requesting completions for:", params.ref);
-    const result = await this.client.complete(params, options);
+    const result = await this.executeRequest(
+      () => this.client.complete(params, options)
+    );
     logger.debug(
       `[complete] Received ${result.completion.values.length} suggestions`
     );
@@ -2597,7 +2671,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Reading resource ${uri}`);
-    const res = await this.client.readResource({ uri }, options);
+    const res = await this.executeRequest(
+      () => this.client.readResource({ uri }, options)
+    );
     return res;
   }
   /**
@@ -2611,7 +2687,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Subscribing to resource: ${uri}`);
-    return await this.client.subscribeResource({ uri }, options);
+    return await this.executeRequest(
+      () => this.client.subscribeResource({ uri }, options)
+    );
   }
   /**
    * Unsubscribe from resource updates
@@ -2624,7 +2702,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Unsubscribing from resource: ${uri}`);
-    return await this.client.unsubscribeResource({ uri }, options);
+    return await this.executeRequest(
+      () => this.client.unsubscribeResource({ uri }, options)
+    );
   }
   /**
    * Lists prompts exposed by the server.
@@ -2641,7 +2721,7 @@ var BaseConnector = class {
     }
     try {
       logger.debug("Listing prompts");
-      return await this.client.listPrompts();
+      return await this.executeRequest(() => this.client.listPrompts());
     } catch (err) {
       const error = err;
       if (error.code === -32601) {
@@ -2663,7 +2743,9 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Getting prompt ${name}`);
-    return await this.client.getPrompt({ name, arguments: args });
+    return await this.executeRequest(
+      () => this.client.getPrompt({ name, arguments: args })
+    );
   }
   /**
    * Sends a raw, potentially non-standard request through the SDK client.
@@ -2678,10 +2760,12 @@ var BaseConnector = class {
       throw new Error("MCP client is not connected");
     }
     logger.debug(`Sending raw request '${method}' with params`, params);
-    return await this.client.request(
-      { method, params: params ?? {} },
-      passthroughResultSchema,
-      options
+    return await this.executeRequest(
+      () => this.client.request(
+        { method, params: params ?? {} },
+        passthroughResultSchema,
+        options
+      )
     );
   }
   /**
@@ -2714,6 +2798,7 @@ var BaseConnector = class {
       }
     }
     this.toolsCache = null;
+    this.authorizationCache = void 0;
     if (issues.length) {
       logger.warn(`Resource cleanup finished with ${issues.length} issue(s)`);
     }
@@ -2721,6 +2806,7 @@ var BaseConnector = class {
 };
 
 // src/transport/http.ts
+var MIXED_AUTH_DISCOVERY_TIMEOUT_MS = 2e3;
 function detectUnauthorized(err, depth = 0) {
   if (!err || depth > 5) return false;
   if (err instanceof UnauthorizedError2) return true;
@@ -2734,6 +2820,11 @@ function detectUnauthorized(err, depth = 0) {
   }
   return false;
 }
+function isOAuthClientProvider(provider) {
+  return Boolean(
+    provider && "redirectToAuthorization" in provider && typeof provider.redirectToAuthorization === "function" && "tokens" in provider && typeof provider.tokens === "function"
+  );
+}
 function createMcpProxyFetch(logicalServerUrl, proxyUrl, baseFetch, serverId) {
   const logical = new URL(logicalServerUrl);
   const proxy = proxyUrl.replace(/\/$/, "");
@@ -2759,6 +2850,31 @@ function createMcpProxyFetch(logicalServerUrl, proxyUrl, baseFetch, serverId) {
     );
   };
 }
+function createDeadlineFetch(baseFetch, deadlineSignal) {
+  return async (input, init) => {
+    const requestSignal = init?.signal;
+    if (!requestSignal) {
+      return baseFetch(input, { ...init, signal: deadlineSignal });
+    }
+    const controller = new AbortController();
+    const abortFromRequest = () => controller.abort(requestSignal.reason);
+    const abortFromDeadline = () => controller.abort(deadlineSignal.reason);
+    if (requestSignal.aborted) abortFromRequest();
+    else
+      requestSignal.addEventListener("abort", abortFromRequest, { once: true });
+    if (deadlineSignal.aborted) abortFromDeadline();
+    else
+      deadlineSignal.addEventListener("abort", abortFromDeadline, {
+        once: true
+      });
+    try {
+      return await baseFetch(input, { ...init, signal: controller.signal });
+    } finally {
+      requestSignal.removeEventListener("abort", abortFromRequest);
+      deadlineSignal.removeEventListener("abort", abortFromDeadline);
+    }
+  };
+}
 var HttpConnector = class extends BaseConnector {
   baseUrl;
   headers;
@@ -2769,8 +2885,12 @@ var HttpConnector = class extends BaseConnector {
   gatewayUrl;
   serverId;
   reconnectionOptions;
+  detectMixedAuth;
   transportType = null;
   streamableTransport = null;
+  hadAccessTokenAtConnect = false;
+  pendingOAuthCompletion = null;
+  authorizationDiscovery = null;
   /**
    * Creates an HTTP connector.
    *
@@ -2801,6 +2921,103 @@ var HttpConnector = class extends BaseConnector {
     };
     this.protocolNegotiation = opts.protocolNegotiation ?? "auto";
     this.reconnectionOptions = opts.reconnectionOptions;
+    this.detectMixedAuth = opts.detectMixedAuth ?? true;
+  }
+  get oauthProvider() {
+    return isOAuthClientProvider(this.opts.authProvider) ? this.opts.authProvider : void 0;
+  }
+  async completeInteractiveAuthorization() {
+    const provider = this.oauthProvider;
+    if (!provider) {
+      throw new Error("No OAuth client provider is configured");
+    }
+    if (!this.pendingOAuthCompletion) {
+      this.pendingOAuthCompletion = completeOAuthFlow(provider, this.baseUrl, {
+        fetchFn: this.customFetch,
+        finishAuthorization: async (code, iss) => {
+          const transport = this.streamableTransport;
+          if (!transport) {
+            throw new Error("OAuth transport is no longer connected");
+          }
+          await transport.finishAuth(code, iss);
+        }
+      }).then(() => {
+        if (this.authorizationCache) {
+          this.authorizationCache = {
+            ...this.authorizationCache,
+            authenticated: true
+          };
+        }
+      }).finally(() => {
+        this.pendingOAuthCompletion = null;
+      });
+    }
+    await this.pendingOAuthCompletion;
+  }
+  async executeRequest(operation) {
+    try {
+      return await operation();
+    } catch (error) {
+      const provider = this.oauthProvider;
+      if (!provider || provider.preventAutoAuth === true || !isOAuthInteractionRequired(error)) {
+        throw error;
+      }
+      await this.completeInteractiveAuthorization();
+      return operation();
+    }
+  }
+  /** Authenticate an already-connected server without requiring a 401 first. */
+  async authenticate() {
+    if (!this.connected || !this.streamableTransport) {
+      throw new Error("MCP client is not connected");
+    }
+    await this.completeInteractiveAuthorization();
+  }
+  async discoverAuthorization() {
+    if (!this.detectMixedAuth || !this.oauthProvider || this.hadAccessTokenAtConnect) {
+      return this.authorizationCache;
+    }
+    if (this.authorizationDiscovery) return this.authorizationDiscovery;
+    this.authorizationDiscovery = this.discoverMixedAuthorization();
+    return this.authorizationDiscovery;
+  }
+  async discoverMixedAuthorization() {
+    const controller = new AbortController();
+    let timeout;
+    const discoveryTimeout = new Promise((_, reject) => {
+      timeout = setTimeout(() => {
+        const error = new Error(
+          `Mixed-auth metadata discovery timed out after ${MIXED_AUTH_DISCOVERY_TIMEOUT_MS}ms`
+        );
+        controller.abort(error);
+        reject(error);
+      }, MIXED_AUTH_DISCOVERY_TIMEOUT_MS);
+    });
+    const baseFetch = this.customFetch ?? globalThis.fetch.bind(globalThis);
+    try {
+      const metadata = await Promise.race([
+        discoverOAuthProtectedResourceMetadata(
+          this.baseUrl,
+          { protocolVersion: this.negotiatedProtocolVersion },
+          createDeadlineFetch(baseFetch, controller.signal)
+        ),
+        discoveryTimeout
+      ]);
+      this.authorizationCache = {
+        mode: "mixed",
+        authenticated: false,
+        ...metadata.resource ? { resource: metadata.resource } : {},
+        ...metadata.scopes_supported ? { scopesSupported: [...metadata.scopes_supported] } : {}
+      };
+      logger.info(
+        "OAuth protected-resource metadata found after anonymous connection; server uses mixed auth"
+      );
+    } catch (error) {
+      logger.debug("Mixed-auth metadata was not discovered:", error);
+    } finally {
+      if (timeout) clearTimeout(timeout);
+    }
+    return this.authorizationCache;
   }
   buildClientOptions() {
     return {
@@ -2907,6 +3124,16 @@ var HttpConnector = class extends BaseConnector {
     }
     const baseUrl = this.baseUrl;
     logger.debug(`Connecting to MCP implementation via HTTP: ${baseUrl}`);
+    const oauthProvider = this.oauthProvider;
+    if (oauthProvider) {
+      try {
+        this.hadAccessTokenAtConnect = Boolean(
+          (await oauthProvider.tokens())?.access_token
+        );
+      } catch {
+        this.hadAccessTokenAtConnect = false;
+      }
+    }
     try {
       await this.connectWithStreamableHttp(baseUrl);
       logger.debug("\u2705 Successfully connected via streamable HTTP");
@@ -3177,6 +3404,7 @@ var HttpConnector = class extends BaseConnector {
       }
     }
     await super.cleanupResources();
+    this.authorizationDiscovery = null;
   }
 };
 
@@ -3258,6 +3486,7 @@ function createConnectorFromConfig(serverConfig, connectorOptions) {
       fetch: serverConfig.fetch,
       authToken: serverConfig.authToken,
       authProvider: serverConfig.authProvider,
+      detectMixedAuth: serverConfig.detectMixedAuth,
       protocolNegotiation: serverConfig.protocolNegotiation,
       timeout: serverConfig.timeout,
       roots: serverConfig.roots,
@@ -3500,6 +3729,18 @@ var MCPConnection = class {
   get serverInfo() {
     return this.connector.serverInfo;
   }
+  /** OAuth state discovered for this connection, when available. */
+  get authorization() {
+    return this.connector.authorization;
+  }
+  /** Discover optional OAuth metadata without delaying MCP readiness. */
+  async discoverAuthorization() {
+    return this.connector.discoverAuthorization();
+  }
+  /** Authenticate an already-connected mixed-auth server. */
+  async authenticate() {
+    await this.connector.authenticate();
+  }
   /**
    * The negotiated protocol era for this session's connection:
    * `"legacy"` (2025-era) or `"modern"` (2026-07-28-era).
@@ -3532,7 +3773,8 @@ var MCPConnection = class {
       ...server ? { server } : {},
       capabilities,
       instructions: this.connector.instructions,
-      extensions
+      extensions,
+      ...this.authorization ? { authorization: this.authorization } : {}
     };
   }
   /**
@@ -3763,7 +4005,7 @@ var MCPConnection = class {
 };
 
 // src/core/base.ts
-function isOAuthClientProvider(provider) {
+function isOAuthClientProvider2(provider) {
   return !!provider && typeof provider === "object" && "redirectUrl" in provider && "clientMetadata" in provider;
 }
 var BaseMCPClient = class {
@@ -3996,7 +4238,7 @@ var BaseMCPClient = class {
         ...serverConfig,
         authProvider: oauthProvider
       };
-    } else if ("authProvider" in serverConfig && serverConfig.authProvider && isOAuthClientProvider(serverConfig.authProvider)) {
+    } else if ("authProvider" in serverConfig && serverConfig.authProvider && isOAuthClientProvider2(serverConfig.authProvider)) {
       oauthProvider = serverConfig.authProvider;
     }
     const openSession = async () => {
@@ -4336,6 +4578,7 @@ var BrowserMCPClient = class _BrowserMCPClient extends BaseMCPClient {
       fetch: configuredFetch,
       authToken,
       authProvider,
+      detectMixedAuth,
       wrapTransport,
       clientOptions,
       protocolNegotiation,
@@ -4360,6 +4603,7 @@ var BrowserMCPClient = class _BrowserMCPClient extends BaseMCPClient {
       fetch: configuredFetch ?? globalThis.fetch.bind(globalThis),
       authToken,
       authProvider,
+      detectMixedAuth,
       wrapTransport,
       clientOptions,
       onSampling: resolved.onSampling,
@@ -4470,6 +4714,7 @@ export {
   createOAuthProvider,
   detectFavicon,
   getPackageVersion,
+  isOAuthInteractionRequired,
   isUnauthorized,
   logger,
   normalizeClientInfo,