@mcp-use/client 2.1.0 → 2.1.1-canary.1

package/dist/index.js

@@ -142,6 +142,268 @@ var init_logging = __esm({
   }
 });
 
+// src/auth/popup.ts
+function hasStoredTokens(tokensKey) {
+  try {
+    return typeof localStorage !== "undefined" && !!localStorage.getItem(tokensKey);
+  } catch {
+    return false;
+  }
+}
+function runAuthPopup({
+  popup,
+  state,
+  tokensKey,
+  timeoutMs = 5 * 6e4,
+  closePollMs = 1e3,
+  closeGraceMs = 2e4,
+  expectedOrigin = typeof window !== "undefined" ? window.location.origin : ""
+}) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let closeTimer = null;
+    let timeoutTimer = null;
+    let graceTimer = null;
+    let broadcastChannel = null;
+    const cleanup = () => {
+      if (closeTimer) {
+        clearInterval(closeTimer);
+        closeTimer = null;
+      }
+      if (timeoutTimer) {
+        clearTimeout(timeoutTimer);
+        timeoutTimer = null;
+      }
+      if (graceTimer) {
+        clearTimeout(graceTimer);
+        graceTimer = null;
+      }
+      if (typeof window !== "undefined") {
+        window.removeEventListener("message", messageHandler);
+        window.removeEventListener("storage", storageHandler);
+      }
+      if (broadcastChannel) {
+        try {
+          broadcastChannel.removeEventListener("message", broadcastHandler);
+          broadcastChannel.close();
+        } catch {
+        }
+        broadcastChannel = null;
+      }
+    };
+    const settle = (result) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(result);
+    };
+    const handlePayload = (payload) => {
+      if (!payload || payload.type !== MCP_AUTH_CALLBACK_MESSAGE_TYPE) return;
+      if (payload.state && state && payload.state !== state) return;
+      if (payload.success) {
+        settle({ kind: "success" });
+      } else {
+        settle({
+          kind: "error",
+          error: payload.error ?? "Authentication failed in callback."
+        });
+      }
+    };
+    const messageHandler = (event) => {
+      if (expectedOrigin && event.origin !== expectedOrigin) return;
+      handlePayload(event.data);
+    };
+    const broadcastHandler = (event) => {
+      handlePayload(event.data);
+    };
+    const storageHandler = (event) => {
+      if (event.key !== tokensKey) return;
+      if (event.newValue) settle({ kind: "success" });
+    };
+    if (typeof window !== "undefined") {
+      window.addEventListener("message", messageHandler);
+      window.addEventListener("storage", storageHandler);
+    }
+    if (typeof BroadcastChannel !== "undefined") {
+      try {
+        broadcastChannel = new BroadcastChannel(MCP_AUTH_BROADCAST_CHANNEL);
+        broadcastChannel.addEventListener("message", broadcastHandler);
+      } catch {
+        broadcastChannel = null;
+      }
+    }
+    if (popup) {
+      closeTimer = setInterval(() => {
+        if (settled) return;
+        let closed = false;
+        try {
+          closed = popup.closed;
+        } catch {
+          closed = false;
+        }
+        if (!closed) return;
+        if (closeTimer) {
+          clearInterval(closeTimer);
+          closeTimer = null;
+        }
+        if (hasStoredTokens(tokensKey)) {
+          settle({ kind: "success" });
+          return;
+        }
+        graceTimer = setTimeout(() => {
+          settle(
+            hasStoredTokens(tokensKey) ? { kind: "success" } : { kind: "cancelled" }
+          );
+        }, closeGraceMs);
+      }, closePollMs);
+    }
+    timeoutTimer = setTimeout(() => {
+      settle(
+        hasStoredTokens(tokensKey) ? { kind: "success" } : { kind: "timeout" }
+      );
+    }, timeoutMs);
+  });
+}
+var MCP_AUTH_BROADCAST_CHANNEL, MCP_AUTH_CALLBACK_MESSAGE_TYPE;
+var init_popup = __esm({
+  "src/auth/popup.ts"() {
+    "use strict";
+    MCP_AUTH_BROADCAST_CHANNEL = "mcp_auth_callback";
+    MCP_AUTH_CALLBACK_MESSAGE_TYPE = "mcp_auth_callback";
+  }
+});
+
+// src/auth/flow.ts
+import {
+  auth,
+  InsufficientScopeError,
+  UnauthorizedError
+} from "@modelcontextprotocol/client";
+function isUnauthorized(err, depth = 0) {
+  if (!err || depth > 5) return false;
+  if (err instanceof UnauthorizedError) return true;
+  if (err instanceof Error) {
+    const code = err.code;
+    if (code === 401) return true;
+    if (err.name === "UnauthorizedError") return true;
+    const message = err.message ?? "";
+    if (message.includes("401") || message.includes("Unauthorized")) {
+      return true;
+    }
+    if (err.cause && isUnauthorized(err.cause, depth + 1)) return true;
+    const data = err.data;
+    if (data?.cause && isUnauthorized(data.cause, depth + 1)) return true;
+  }
+  return false;
+}
+function isOAuthInteractionRequired(err, depth = 0) {
+  if (!err || depth > 5) return false;
+  if (err instanceof InsufficientScopeError || err instanceof UnauthorizedError) {
+    return true;
+  }
+  if (err instanceof Error) {
+    if (err.name === "InsufficientScopeError" || err.name === "UnauthorizedError") {
+      return true;
+    }
+    if (err.cause && isOAuthInteractionRequired(err.cause, depth + 1)) {
+      return true;
+    }
+    const data = err.data;
+    if (data?.cause && isOAuthInteractionRequired(data.cause, depth + 1)) {
+      return true;
+    }
+  }
+  return false;
+}
+async function completeOAuthFlow(provider, serverUrl, options = {}) {
+  const flowProvider = provider;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
+  const fetchFn = options.fetchFn ?? flowProvider.getProxyFetch?.() ?? void 0;
+  if (!flowProvider.hasPendingFlow) {
+    const result = await auth(provider, { serverUrl, fetchFn });
+    if (result === "AUTHORIZED") return;
+    if (result !== "REDIRECT") {
+      throw new Error(`Unexpected OAuth auth() result: ${result}`);
+    }
+  }
+  if (flowProvider.preventAutoAuth === true && typeof flowProvider.startAuthorization === "function") {
+    flowProvider.startAuthorization();
+  }
+  if (typeof flowProvider.getAuthorizationResponse === "function" || typeof flowProvider.getAuthorizationCode === "function") {
+    const response = typeof flowProvider.getAuthorizationResponse === "function" ? await flowProvider.getAuthorizationResponse() : { code: await flowProvider.getAuthorizationCode() };
+    if (options.finishAuthorization) {
+      await options.finishAuthorization(response.code, response.iss);
+    } else {
+      await auth(provider, {
+        serverUrl,
+        authorizationCode: response.code,
+        ...response.iss !== void 0 ? { iss: response.iss } : {},
+        fetchFn
+      });
+    }
+    return;
+  }
+  await waitForBrowserAuthComplete(flowProvider, timeoutMs);
+}
+async function waitForBrowserAuthComplete(provider, timeoutMs) {
+  if (typeof window === "undefined") {
+    throw new Error(
+      "OAuth redirect requires a browser environment or a provider with getAuthorizationCode()"
+    );
+  }
+  if (provider.useRedirectFlow) {
+    await new Promise(() => {
+    });
+    return;
+  }
+  const tokensKey = provider.getKey?.("tokens");
+  if (!tokensKey) {
+    throw new Error(
+      "Browser OAuth provider must expose getKey() for token storage"
+    );
+  }
+  let state = null;
+  const authUrl = provider.getLastAttemptedAuthUrl?.();
+  if (authUrl) {
+    try {
+      state = new URL(authUrl).searchParams.get("state");
+    } catch {
+    }
+  }
+  try {
+    const result = await runAuthPopup({
+      popup: null,
+      state,
+      tokensKey,
+      timeoutMs
+    });
+    switch (result.kind) {
+      case "success":
+        return;
+      case "cancelled":
+        throw new Error("OAuth authentication was cancelled.");
+      case "timeout":
+        throw new Error(
+          `OAuth callback not received within ${timeoutMs}ms. Ensure /oauth/callback calls onMcpAuthorization().`
+        );
+      case "error":
+        throw new Error(result.error);
+      default:
+        throw new Error("Unexpected OAuth popup result");
+    }
+  } finally {
+    provider.markFlowComplete?.();
+  }
+}
+var DEFAULT_AUTH_TIMEOUT_MS;
+var init_flow = __esm({
+  "src/auth/flow.ts"() {
+    "use strict";
+    init_popup();
+    DEFAULT_AUTH_TIMEOUT_MS = 5 * 6e4;
+  }
+});
+
 // src/utils/json-schema-validator.ts
 import {
   CfWorkerJsonSchemaValidator
@@ -190,6 +452,7 @@ var init_base = __esm({
   "src/transport/base.ts"() {
     "use strict";
     init_logging();
+    init_flow();
     init_connector_telemetry();
     passthroughResultSchema = {
       "~standard": {
@@ -204,6 +467,7 @@ var init_base = __esm({
       toolsCache = null;
       capabilitiesCache = null;
       serverInfoCache = null;
+      authorizationCache;
       connected = false;
       opts;
       notificationHandlers = [];
@@ -467,6 +731,28 @@ var init_base = __esm({
           "setupElicitationHandler: Elicitation handler registered successfully"
         );
       }
+      /**
+       * Run one logical MCP operation. HTTP connectors override this host seam to
+       * finish an SDK-started interactive OAuth flow and retry exactly once.
+       */
+      async executeRequest(operation) {
+        return operation();
+      }
+      /** OAuth state discovered for the active connection, when available. */
+      get authorization() {
+        return this.authorizationCache;
+      }
+      /**
+       * Discover optional authorization metadata without delaying connection
+       * readiness. HTTP connectors override this with RFC 9728 discovery.
+       */
+      async discoverAuthorization() {
+        return this.authorization;
+      }
+      /** Start optional OAuth for a connected mixed-auth server. */
+      async authenticate() {
+        throw new Error("This connector does not support interactive OAuth");
+      }
       /**
        * Disconnects the SDK client and releases transport resources.
        *
@@ -514,13 +800,13 @@ var init_base = __esm({
           icons: serverInfo.icons
         } : null;
         try {
-          const listToolsRes = await this.client.listTools(
-            void 0,
-            defaultRequestOptions
+          const listToolsRes = await this.executeRequest(
+            () => this.client.listTools(void 0, defaultRequestOptions)
           );
           this.toolsCache = listToolsRes.tools ?? [];
           logger.debug(`Fetched ${this.toolsCache.length} tools from server`);
         } catch (err) {
+          if (isOAuthInteractionRequired(err)) throw err;
           const error = err;
           if (error.code === -32601) {
             logger.debug("Server does not implement tools/list, assuming no tools");
@@ -594,9 +880,8 @@ var init_base = __esm({
         const progressHandler = enhancedOptions?.onprogress;
         if (progressHandler) this.activeProgressHandlers.add(progressHandler);
         try {
-          const res = await this.client.callTool(
-            { name, arguments: args },
-            enhancedOptions
+          const res = await this.executeRequest(
+            () => this.client.callTool({ name, arguments: args }, enhancedOptions)
           );
           logger.debug(`Tool '${name}' returned`, res);
           return res;
@@ -616,7 +901,9 @@ var init_base = __esm({
           throw new Error("MCP client is not connected");
         }
         logger.debug("[listTools] Fetching fresh tools from server...");
-        const result = await this.client.listTools(void 0, options);
+        const result = await this.executeRequest(
+          () => this.client.listTools(void 0, options)
+        );
         const tools = result.tools ? [...result.tools] : [];
         logger.debug(
           `[listTools] Returned ${tools.length} tools:`,
@@ -636,7 +923,9 @@ var init_base = __esm({
           throw new Error("MCP client is not connected");
         }
         logger.debug("Listing resources", cursor ? `with cursor: ${cursor}` : "");
-        return await this.client.listResources({ cursor }, options);
+        return await this.executeRequest(
+          () => this.client.listResources({ cursor }, options)
+        );
       }
       /**
        * List all resources from the server, automatically handling pagination
@@ -654,14 +943,16 @@ var init_base = __esm({
         }
         try {
           logger.debug("Listing all resources (with auto-pagination)");
-          const allResources = [];
-          let cursor = void 0;
-          do {
-            const result = await this.client.listResources({ cursor }, options);
-            allResources.push(...result.resources || []);
-            cursor = result.nextCursor;
-          } while (cursor);
-          return { resources: allResources };
+          return await this.executeRequest(async () => {
+            const allResources = [];
+            let cursor = void 0;
+            do {
+              const result = await this.client.listResources({ cursor }, options);
+              allResources.push(...result.resources || []);
+              cursor = result.nextCursor;
+            } while (cursor);
+            return { resources: allResources };
+          });
         } catch (err) {
           const error = err;
           if (error.code === -32601) {
@@ -682,7 +973,9 @@ var init_base = __esm({
           throw new Error("MCP client is not connected");
         }
         logger.debug("Listing resource templates");
-        return await this.client.listResourceTemplates(void 0, options);
+        return await this.executeRequest(
+          () => this.client.listResourceTemplates(void 0, options)
+        );
       }
       /**
        * Request completion suggestions for a prompt or resource template argument
@@ -696,7 +989,9 @@ var init_base = __esm({
           throw new Error("MCP client is not connected");
         }
         logger.debug("[complete] Requesting completions for:", params.ref);
-        const result = await this.client.complete(params, options);
+        const result = await this.executeRequest(
+          () => this.client.complete(params, options)
+        );
         logger.debug(
           `[complete] Received ${result.completion.values.length} suggestions`
         );
@@ -714,7 +1009,9 @@ var init_base = __esm({
           throw new Error("MCP client is not connected");
         }
         logger.debug(`Reading resource ${uri}`);
-        const res = await this.client.readResource({ uri }, options);
+        const res = await this.executeRequest(
+          () => this.client.readResource({ uri }, options)
+        );
         return res;
       }
       /**
@@ -728,7 +1025,9 @@ var init_base = __esm({
           throw new Error("MCP client is not connected");
         }
         logger.debug(`Subscribing to resource: ${uri}`);
-        return await this.client.subscribeResource({ uri }, options);
+        return await this.executeRequest(
+          () => this.client.subscribeResource({ uri }, options)
+        );
       }
       /**
        * Unsubscribe from resource updates
@@ -741,7 +1040,9 @@ var init_base = __esm({
           throw new Error("MCP client is not connected");
         }
         logger.debug(`Unsubscribing from resource: ${uri}`);
-        return await this.client.unsubscribeResource({ uri }, options);
+        return await this.executeRequest(
+          () => this.client.unsubscribeResource({ uri }, options)
+        );
       }
       /**
        * Lists prompts exposed by the server.
@@ -758,7 +1059,7 @@ var init_base = __esm({
         }
         try {
           logger.debug("Listing prompts");
-          return await this.client.listPrompts();
+          return await this.executeRequest(() => this.client.listPrompts());
         } catch (err) {
           const error = err;
           if (error.code === -32601) {
@@ -780,7 +1081,9 @@ var init_base = __esm({
           throw new Error("MCP client is not connected");
         }
         logger.debug(`Getting prompt ${name}`);
-        return await this.client.getPrompt({ name, arguments: args });
+        return await this.executeRequest(
+          () => this.client.getPrompt({ name, arguments: args })
+        );
       }
       /**
        * Sends a raw, potentially non-standard request through the SDK client.
@@ -795,10 +1098,12 @@ var init_base = __esm({
           throw new Error("MCP client is not connected");
         }
         logger.debug(`Sending raw request '${method}' with params`, params);
-        return await this.client.request(
-          { method, params: params ?? {} },
-          passthroughResultSchema,
-          options
+        return await this.executeRequest(
+          () => this.client.request(
+            { method, params: params ?? {} },
+            passthroughResultSchema,
+            options
+          )
         );
       }
       /**
@@ -831,6 +1136,7 @@ var init_base = __esm({
           }
         }
         this.toolsCache = null;
+        this.authorizationCache = void 0;
         if (issues.length) {
           logger.warn(`Resource cleanup finished with ${issues.length} issue(s)`);
         }
@@ -1219,7 +1525,7 @@ init_connector_telemetry();
 init_logging();
 
 // src/utils/version.ts
-var VERSION = "2.1.0";
+var VERSION = "2.1.1-canary.1";
 function getPackageVersion() {
   return VERSION;
 }
@@ -1618,396 +1924,173 @@ var Telemetry = class _Telemetry {
     const p = capturePostHog({
       host: HOST,
       apiKey: PROJECT_API_KEY,
-      event: event.name,
-      distinctId: currentUserId,
-      properties
-    });
-    this._pending.add(p);
-    void p.finally(() => this._pending.delete(p));
-  }
-  async trackAgentExecution(data) {
-    if (!this.isEnabled) return;
-    await this.capture(new MCPAgentExecutionEvent(data));
-  }
-  async trackMCPClientInit(data) {
-    if (!this.isEnabled) return;
-    await this.capture(new MCPClientInitEvent(data));
-  }
-  async trackConnectorInit(data) {
-    if (!this.isEnabled) return;
-    await this.capture(new ConnectorInitEvent(data));
-  }
-  async trackClientAddServer(serverName, serverConfig) {
-    if (!this.isEnabled) return;
-    await this.capture(new ClientAddServerEvent({ serverName, serverConfig }));
-  }
-  async trackClientRemoveServer(serverName) {
-    if (!this.isEnabled) return;
-    await this.capture(new ClientRemoveServerEvent({ serverName }));
-  }
-  async trackUseMcpConnection(data) {
-    if (!this.isEnabled) return;
-    await this.capture({
-      name: "usemcp_connection",
-      properties: {
-        url_domain: new URL(data.url).hostname,
-        transport_type: data.transportType,
-        success: data.success,
-        error_type: data.errorType ?? null,
-        connection_time_ms: data.connectionTimeMs ?? null,
-        has_oauth: data.hasOAuth,
-        has_sampling: data.hasSampling,
-        has_elicitation: data.hasElicitation
-      }
-    });
-  }
-  async trackUseMcpToolCall(data) {
-    if (!this.isEnabled) return;
-    await this.capture({
-      name: "usemcp_tool_call",
-      properties: {
-        tool_name: data.toolName,
-        success: data.success,
-        error_type: data.errorType ?? null,
-        execution_time_ms: data.executionTimeMs ?? null
-      }
-    });
-  }
-  async trackUseMcpResourceRead(data) {
-    if (!this.isEnabled) return;
-    await this.capture({
-      name: "usemcp_resource_read",
-      properties: {
-        resource_uri_scheme: data.resourceUri.split(":")[0],
-        success: data.success,
-        error_type: data.errorType ?? null
-      }
-    });
-  }
-  identify(userId, properties) {
-    this._currUserId = userId;
-    this._storage?.setUserId(userId);
-    if (this._telemetryEnabled) {
-      void capturePostHog({
-        host: HOST,
-        apiKey: PROJECT_API_KEY,
-        event: "$identify",
-        distinctId: userId,
-        properties: { $set: properties ?? {} }
-      });
-    }
-  }
-  reset() {
-    this._currUserId = null;
-  }
-  flush() {
-    void Promise.allSettled([...this._pending]);
-  }
-  async shutdown() {
-    try {
-      await Promise.allSettled([...this._pending]);
-      logger.debug("Telemetry fetch captures flushed");
-    } catch (e) {
-      logger.debug(`Error flushing telemetry captures: ${e}`);
-    }
-  }
-};
-var Tel = Telemetry;
-function setTelemetrySource(source) {
-  Tel.getInstance().setSource(source);
-}
-function setProductVersion(version) {
-  Tel.getInstance().setProductVersion(version);
-}
-
-// src/telemetry/telemetry-node.ts
-function getCacheHome(os, path2) {
-  const envVar = process.env.XDG_CACHE_HOME;
-  if (envVar && path2.isAbsolute(envVar)) {
-    return envVar;
-  }
-  const homeDir = os.homedir();
-  if (process.platform === "win32") {
-    const appdata = process.env.LOCALAPPDATA || process.env.APPDATA;
-    if (appdata) return appdata;
-    return path2.join(homeDir, "AppData", "Local");
-  }
-  if (process.platform === "darwin") {
-    return path2.join(homeDir, "Library", "Caches");
-  }
-  return path2.join(homeDir, ".cache");
-}
-function createFsStorage() {
-  let fs2;
-  let os;
-  let path2;
-  try {
-    fs2 = __require("fs");
-    os = __require("os");
-    path2 = __require("path");
-  } catch {
-    return {
-      getUserId: () => null,
-      setUserId: () => void 0
-    };
-  }
-  const cacheHome = getCacheHome(os, path2);
-  const userIdPath = path2.join(cacheHome, "mcp_use_3", "telemetry_user_id");
-  return {
-    getUserId() {
-      try {
-        if (!fs2.existsSync(userIdPath)) return null;
-        return fs2.readFileSync(userIdPath, "utf-8").trim() || null;
-      } catch {
-        return null;
-      }
-    },
-    setUserId(id) {
-      try {
-        fs2.mkdirSync(path2.dirname(userIdPath), { recursive: true });
-        fs2.writeFileSync(userIdPath, id);
-      } catch {
-      }
-    }
-  };
-}
-configureTelemetryStorage(createFsStorage());
-
-// src/telemetry/configure-node.ts
-setClientTelemetryTracker({
-  addServer: (name, config) => Telemetry.getInstance().trackClientAddServer(name, config).catch(() => void 0),
-  removeServer: (name) => Telemetry.getInstance().trackClientRemoveServer(name).catch(() => void 0)
-});
-setConnectorTelemetryTracker(
-  (data) => Telemetry.getInstance().trackConnectorInit(data).catch(() => void 0)
-);
-
-// src/index.ts
-import { auth as auth2, UnauthorizedError as UnauthorizedError3 } from "@modelcontextprotocol/client";
-
-// src/auth/flow.ts
-import {
-  auth,
-  UnauthorizedError
-} from "@modelcontextprotocol/client";
-
-// src/auth/popup.ts
-var MCP_AUTH_BROADCAST_CHANNEL = "mcp_auth_callback";
-var MCP_AUTH_CALLBACK_MESSAGE_TYPE = "mcp_auth_callback";
-function hasStoredTokens(tokensKey) {
-  try {
-    return typeof localStorage !== "undefined" && !!localStorage.getItem(tokensKey);
-  } catch {
-    return false;
-  }
-}
-function runAuthPopup({
-  popup,
-  state,
-  tokensKey,
-  timeoutMs = 5 * 6e4,
-  closePollMs = 1e3,
-  closeGraceMs = 2e4,
-  expectedOrigin = typeof window !== "undefined" ? window.location.origin : ""
-}) {
-  return new Promise((resolve) => {
-    let settled = false;
-    let closeTimer = null;
-    let timeoutTimer = null;
-    let graceTimer = null;
-    let broadcastChannel = null;
-    const cleanup = () => {
-      if (closeTimer) {
-        clearInterval(closeTimer);
-        closeTimer = null;
-      }
-      if (timeoutTimer) {
-        clearTimeout(timeoutTimer);
-        timeoutTimer = null;
-      }
-      if (graceTimer) {
-        clearTimeout(graceTimer);
-        graceTimer = null;
-      }
-      if (typeof window !== "undefined") {
-        window.removeEventListener("message", messageHandler);
-        window.removeEventListener("storage", storageHandler);
-      }
-      if (broadcastChannel) {
-        try {
-          broadcastChannel.removeEventListener("message", broadcastHandler);
-          broadcastChannel.close();
-        } catch {
-        }
-        broadcastChannel = null;
-      }
-    };
-    const settle = (result) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      resolve(result);
-    };
-    const handlePayload = (payload) => {
-      if (!payload || payload.type !== MCP_AUTH_CALLBACK_MESSAGE_TYPE) return;
-      if (payload.state && state && payload.state !== state) return;
-      if (payload.success) {
-        settle({ kind: "success" });
-      } else {
-        settle({
-          kind: "error",
-          error: payload.error ?? "Authentication failed in callback."
-        });
-      }
-    };
-    const messageHandler = (event) => {
-      if (expectedOrigin && event.origin !== expectedOrigin) return;
-      handlePayload(event.data);
-    };
-    const broadcastHandler = (event) => {
-      handlePayload(event.data);
-    };
-    const storageHandler = (event) => {
-      if (event.key !== tokensKey) return;
-      if (event.newValue) settle({ kind: "success" });
-    };
-    if (typeof window !== "undefined") {
-      window.addEventListener("message", messageHandler);
-      window.addEventListener("storage", storageHandler);
-    }
-    if (typeof BroadcastChannel !== "undefined") {
-      try {
-        broadcastChannel = new BroadcastChannel(MCP_AUTH_BROADCAST_CHANNEL);
-        broadcastChannel.addEventListener("message", broadcastHandler);
-      } catch {
-        broadcastChannel = null;
-      }
-    }
-    if (popup) {
-      closeTimer = setInterval(() => {
-        if (settled) return;
-        let closed = false;
-        try {
-          closed = popup.closed;
-        } catch {
-          closed = false;
-        }
-        if (!closed) return;
-        if (closeTimer) {
-          clearInterval(closeTimer);
-          closeTimer = null;
-        }
-        if (hasStoredTokens(tokensKey)) {
-          settle({ kind: "success" });
-          return;
-        }
-        graceTimer = setTimeout(() => {
-          settle(
-            hasStoredTokens(tokensKey) ? { kind: "success" } : { kind: "cancelled" }
-          );
-        }, closeGraceMs);
-      }, closePollMs);
-    }
-    timeoutTimer = setTimeout(() => {
-      settle(
-        hasStoredTokens(tokensKey) ? { kind: "success" } : { kind: "timeout" }
-      );
-    }, timeoutMs);
-  });
-}
-
-// src/auth/flow.ts
-var DEFAULT_AUTH_TIMEOUT_MS = 5 * 6e4;
-function isUnauthorized(err, depth = 0) {
-  if (!err || depth > 5) return false;
-  if (err instanceof UnauthorizedError) return true;
-  if (err instanceof Error) {
-    const code = err.code;
-    if (code === 401) return true;
-    if (err.name === "UnauthorizedError") return true;
-    const message = err.message ?? "";
-    if (message.includes("401") || message.includes("Unauthorized")) {
-      return true;
-    }
-    if (err.cause && isUnauthorized(err.cause, depth + 1)) return true;
-    const data = err.data;
-    if (data?.cause && isUnauthorized(data.cause, depth + 1)) return true;
+      event: event.name,
+      distinctId: currentUserId,
+      properties
+    });
+    this._pending.add(p);
+    void p.finally(() => this._pending.delete(p));
   }
-  return false;
-}
-async function completeOAuthFlow(provider, serverUrl, options = {}) {
-  const flowProvider = provider;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
-  const fetchFn = options.fetchFn ?? flowProvider.getProxyFetch?.() ?? void 0;
-  if (!flowProvider.hasPendingFlow) {
-    const result = await auth(provider, { serverUrl, fetchFn });
-    if (result === "AUTHORIZED") return;
-    if (result !== "REDIRECT") {
-      throw new Error(`Unexpected OAuth auth() result: ${result}`);
-    }
+  async trackAgentExecution(data) {
+    if (!this.isEnabled) return;
+    await this.capture(new MCPAgentExecutionEvent(data));
   }
-  if (typeof flowProvider.getAuthorizationResponse === "function" || typeof flowProvider.getAuthorizationCode === "function") {
-    const response = typeof flowProvider.getAuthorizationResponse === "function" ? await flowProvider.getAuthorizationResponse() : { code: await flowProvider.getAuthorizationCode() };
-    await auth(provider, {
-      serverUrl,
-      authorizationCode: response.code,
-      ...response.iss !== void 0 ? { iss: response.iss } : {},
-      fetchFn
+  async trackMCPClientInit(data) {
+    if (!this.isEnabled) return;
+    await this.capture(new MCPClientInitEvent(data));
+  }
+  async trackConnectorInit(data) {
+    if (!this.isEnabled) return;
+    await this.capture(new ConnectorInitEvent(data));
+  }
+  async trackClientAddServer(serverName, serverConfig) {
+    if (!this.isEnabled) return;
+    await this.capture(new ClientAddServerEvent({ serverName, serverConfig }));
+  }
+  async trackClientRemoveServer(serverName) {
+    if (!this.isEnabled) return;
+    await this.capture(new ClientRemoveServerEvent({ serverName }));
+  }
+  async trackUseMcpConnection(data) {
+    if (!this.isEnabled) return;
+    await this.capture({
+      name: "usemcp_connection",
+      properties: {
+        url_domain: new URL(data.url).hostname,
+        transport_type: data.transportType,
+        success: data.success,
+        error_type: data.errorType ?? null,
+        connection_time_ms: data.connectionTimeMs ?? null,
+        has_oauth: data.hasOAuth,
+        has_sampling: data.hasSampling,
+        has_elicitation: data.hasElicitation
+      }
     });
-    return;
   }
-  await waitForBrowserAuthComplete(flowProvider, timeoutMs);
-}
-async function waitForBrowserAuthComplete(provider, timeoutMs) {
-  if (typeof window === "undefined") {
-    throw new Error(
-      "OAuth redirect requires a browser environment or a provider with getAuthorizationCode()"
-    );
+  async trackUseMcpToolCall(data) {
+    if (!this.isEnabled) return;
+    await this.capture({
+      name: "usemcp_tool_call",
+      properties: {
+        tool_name: data.toolName,
+        success: data.success,
+        error_type: data.errorType ?? null,
+        execution_time_ms: data.executionTimeMs ?? null
+      }
+    });
   }
-  if (provider.useRedirectFlow) {
-    await new Promise(() => {
+  async trackUseMcpResourceRead(data) {
+    if (!this.isEnabled) return;
+    await this.capture({
+      name: "usemcp_resource_read",
+      properties: {
+        resource_uri_scheme: data.resourceUri.split(":")[0],
+        success: data.success,
+        error_type: data.errorType ?? null
+      }
     });
-    return;
   }
-  const tokensKey = provider.getKey?.("tokens");
-  if (!tokensKey) {
-    throw new Error(
-      "Browser OAuth provider must expose getKey() for token storage"
-    );
+  identify(userId, properties) {
+    this._currUserId = userId;
+    this._storage?.setUserId(userId);
+    if (this._telemetryEnabled) {
+      void capturePostHog({
+        host: HOST,
+        apiKey: PROJECT_API_KEY,
+        event: "$identify",
+        distinctId: userId,
+        properties: { $set: properties ?? {} }
+      });
+    }
   }
-  let state = null;
-  const authUrl = provider.getLastAttemptedAuthUrl?.();
-  if (authUrl) {
+  reset() {
+    this._currUserId = null;
+  }
+  flush() {
+    void Promise.allSettled([...this._pending]);
+  }
+  async shutdown() {
     try {
-      state = new URL(authUrl).searchParams.get("state");
-    } catch {
+      await Promise.allSettled([...this._pending]);
+      logger.debug("Telemetry fetch captures flushed");
+    } catch (e) {
+      logger.debug(`Error flushing telemetry captures: ${e}`);
     }
   }
+};
+var Tel = Telemetry;
+function setTelemetrySource(source) {
+  Tel.getInstance().setSource(source);
+}
+function setProductVersion(version) {
+  Tel.getInstance().setProductVersion(version);
+}
+
+// src/telemetry/telemetry-node.ts
+function getCacheHome(os, path2) {
+  const envVar = process.env.XDG_CACHE_HOME;
+  if (envVar && path2.isAbsolute(envVar)) {
+    return envVar;
+  }
+  const homeDir = os.homedir();
+  if (process.platform === "win32") {
+    const appdata = process.env.LOCALAPPDATA || process.env.APPDATA;
+    if (appdata) return appdata;
+    return path2.join(homeDir, "AppData", "Local");
+  }
+  if (process.platform === "darwin") {
+    return path2.join(homeDir, "Library", "Caches");
+  }
+  return path2.join(homeDir, ".cache");
+}
+function createFsStorage() {
+  let fs2;
+  let os;
+  let path2;
   try {
-    const result = await runAuthPopup({
-      popup: null,
-      state,
-      tokensKey,
-      timeoutMs
-    });
-    switch (result.kind) {
-      case "success":
-        return;
-      case "cancelled":
-        throw new Error("OAuth authentication was cancelled.");
-      case "timeout":
-        throw new Error(
-          `OAuth callback not received within ${timeoutMs}ms. Ensure /oauth/callback calls onMcpAuthorization().`
-        );
-      case "error":
-        throw new Error(result.error);
-      default:
-        throw new Error("Unexpected OAuth popup result");
-    }
-  } finally {
-    provider.markFlowComplete?.();
+    fs2 = __require("fs");
+    os = __require("os");
+    path2 = __require("path");
+  } catch {
+    return {
+      getUserId: () => null,
+      setUserId: () => void 0
+    };
   }
+  const cacheHome = getCacheHome(os, path2);
+  const userIdPath = path2.join(cacheHome, "mcp_use_3", "telemetry_user_id");
+  return {
+    getUserId() {
+      try {
+        if (!fs2.existsSync(userIdPath)) return null;
+        return fs2.readFileSync(userIdPath, "utf-8").trim() || null;
+      } catch {
+        return null;
+      }
+    },
+    setUserId(id) {
+      try {
+        fs2.mkdirSync(path2.dirname(userIdPath), { recursive: true });
+        fs2.writeFileSync(userIdPath, id);
+      } catch {
+      }
+    }
+  };
 }
+configureTelemetryStorage(createFsStorage());
+
+// src/telemetry/configure-node.ts
+setClientTelemetryTracker({
+  addServer: (name, config) => Telemetry.getInstance().trackClientAddServer(name, config).catch(() => void 0),
+  removeServer: (name) => Telemetry.getInstance().trackClientRemoveServer(name).catch(() => void 0)
+});
+setConnectorTelemetryTracker(
+  (data) => Telemetry.getInstance().trackConnectorInit(data).catch(() => void 0)
+);
+
+// src/index.ts
+init_flow();
+import { auth as auth2, UnauthorizedError as UnauthorizedError3 } from "@modelcontextprotocol/client";
 
 // src/auth/node.ts
 import { createServer as createNetServer } from "net";
@@ -2840,16 +2923,19 @@ async function createOAuthProvider(serverUrl, options = {}) {
 }
 
 // src/transport/http.ts
+init_flow();
 init_json_schema_validator();
 init_logging();
 init_base();
 import {
   Client,
+  discoverOAuthProtectedResourceMetadata,
   SdkError,
   SdkHttpError,
   StreamableHTTPClientTransport,
   UnauthorizedError as UnauthorizedError2
 } from "@modelcontextprotocol/client";
+var MIXED_AUTH_DISCOVERY_TIMEOUT_MS = 2e3;
 function detectUnauthorized(err, depth = 0) {
   if (!err || depth > 5) return false;
   if (err instanceof UnauthorizedError2) return true;
@@ -2863,6 +2949,11 @@ function detectUnauthorized(err, depth = 0) {
   }
   return false;
 }
+function isOAuthClientProvider(provider) {
+  return Boolean(
+    provider && "redirectToAuthorization" in provider && typeof provider.redirectToAuthorization === "function" && "tokens" in provider && typeof provider.tokens === "function"
+  );
+}
 function createMcpProxyFetch(logicalServerUrl, proxyUrl, baseFetch, serverId) {
   const logical = new URL(logicalServerUrl);
   const proxy = proxyUrl.replace(/\/$/, "");
@@ -2888,6 +2979,31 @@ function createMcpProxyFetch(logicalServerUrl, proxyUrl, baseFetch, serverId) {
     );
   };
 }
+function createDeadlineFetch(baseFetch, deadlineSignal) {
+  return async (input, init) => {
+    const requestSignal = init?.signal;
+    if (!requestSignal) {
+      return baseFetch(input, { ...init, signal: deadlineSignal });
+    }
+    const controller = new AbortController();
+    const abortFromRequest = () => controller.abort(requestSignal.reason);
+    const abortFromDeadline = () => controller.abort(deadlineSignal.reason);
+    if (requestSignal.aborted) abortFromRequest();
+    else
+      requestSignal.addEventListener("abort", abortFromRequest, { once: true });
+    if (deadlineSignal.aborted) abortFromDeadline();
+    else
+      deadlineSignal.addEventListener("abort", abortFromDeadline, {
+        once: true
+      });
+    try {
+      return await baseFetch(input, { ...init, signal: controller.signal });
+    } finally {
+      requestSignal.removeEventListener("abort", abortFromRequest);
+      deadlineSignal.removeEventListener("abort", abortFromDeadline);
+    }
+  };
+}
 var HttpConnector = class extends BaseConnector {
   baseUrl;
   headers;
@@ -2898,8 +3014,12 @@ var HttpConnector = class extends BaseConnector {
   gatewayUrl;
   serverId;
   reconnectionOptions;
+  detectMixedAuth;
   transportType = null;
   streamableTransport = null;
+  hadAccessTokenAtConnect = false;
+  pendingOAuthCompletion = null;
+  authorizationDiscovery = null;
   /**
    * Creates an HTTP connector.
    *
@@ -2930,6 +3050,103 @@ var HttpConnector = class extends BaseConnector {
     };
     this.protocolNegotiation = opts.protocolNegotiation ?? "auto";
     this.reconnectionOptions = opts.reconnectionOptions;
+    this.detectMixedAuth = opts.detectMixedAuth ?? true;
+  }
+  get oauthProvider() {
+    return isOAuthClientProvider(this.opts.authProvider) ? this.opts.authProvider : void 0;
+  }
+  async completeInteractiveAuthorization() {
+    const provider = this.oauthProvider;
+    if (!provider) {
+      throw new Error("No OAuth client provider is configured");
+    }
+    if (!this.pendingOAuthCompletion) {
+      this.pendingOAuthCompletion = completeOAuthFlow(provider, this.baseUrl, {
+        fetchFn: this.customFetch,
+        finishAuthorization: async (code, iss) => {
+          const transport = this.streamableTransport;
+          if (!transport) {
+            throw new Error("OAuth transport is no longer connected");
+          }
+          await transport.finishAuth(code, iss);
+        }
+      }).then(() => {
+        if (this.authorizationCache) {
+          this.authorizationCache = {
+            ...this.authorizationCache,
+            authenticated: true
+          };
+        }
+      }).finally(() => {
+        this.pendingOAuthCompletion = null;
+      });
+    }
+    await this.pendingOAuthCompletion;
+  }
+  async executeRequest(operation) {
+    try {
+      return await operation();
+    } catch (error) {
+      const provider = this.oauthProvider;
+      if (!provider || provider.preventAutoAuth === true || !isOAuthInteractionRequired(error)) {
+        throw error;
+      }
+      await this.completeInteractiveAuthorization();
+      return operation();
+    }
+  }
+  /** Authenticate an already-connected server without requiring a 401 first. */
+  async authenticate() {
+    if (!this.connected || !this.streamableTransport) {
+      throw new Error("MCP client is not connected");
+    }
+    await this.completeInteractiveAuthorization();
+  }
+  async discoverAuthorization() {
+    if (!this.detectMixedAuth || !this.oauthProvider || this.hadAccessTokenAtConnect) {
+      return this.authorizationCache;
+    }
+    if (this.authorizationDiscovery) return this.authorizationDiscovery;
+    this.authorizationDiscovery = this.discoverMixedAuthorization();
+    return this.authorizationDiscovery;
+  }
+  async discoverMixedAuthorization() {
+    const controller = new AbortController();
+    let timeout;
+    const discoveryTimeout = new Promise((_, reject) => {
+      timeout = setTimeout(() => {
+        const error = new Error(
+          `Mixed-auth metadata discovery timed out after ${MIXED_AUTH_DISCOVERY_TIMEOUT_MS}ms`
+        );
+        controller.abort(error);
+        reject(error);
+      }, MIXED_AUTH_DISCOVERY_TIMEOUT_MS);
+    });
+    const baseFetch = this.customFetch ?? globalThis.fetch.bind(globalThis);
+    try {
+      const metadata = await Promise.race([
+        discoverOAuthProtectedResourceMetadata(
+          this.baseUrl,
+          { protocolVersion: this.negotiatedProtocolVersion },
+          createDeadlineFetch(baseFetch, controller.signal)
+        ),
+        discoveryTimeout
+      ]);
+      this.authorizationCache = {
+        mode: "mixed",
+        authenticated: false,
+        ...metadata.resource ? { resource: metadata.resource } : {},
+        ...metadata.scopes_supported ? { scopesSupported: [...metadata.scopes_supported] } : {}
+      };
+      logger.info(
+        "OAuth protected-resource metadata found after anonymous connection; server uses mixed auth"
+      );
+    } catch (error) {
+      logger.debug("Mixed-auth metadata was not discovered:", error);
+    } finally {
+      if (timeout) clearTimeout(timeout);
+    }
+    return this.authorizationCache;
   }
   buildClientOptions() {
     return {
@@ -3036,6 +3253,16 @@ var HttpConnector = class extends BaseConnector {
     }
     const baseUrl = this.baseUrl;
     logger.debug(`Connecting to MCP implementation via HTTP: ${baseUrl}`);
+    const oauthProvider = this.oauthProvider;
+    if (oauthProvider) {
+      try {
+        this.hadAccessTokenAtConnect = Boolean(
+          (await oauthProvider.tokens())?.access_token
+        );
+      } catch {
+        this.hadAccessTokenAtConnect = false;
+      }
+    }
     try {
       await this.connectWithStreamableHttp(baseUrl);
       logger.debug("\u2705 Successfully connected via streamable HTTP");
@@ -3306,6 +3533,7 @@ var HttpConnector = class extends BaseConnector {
       }
     }
     await super.cleanupResources();
+    this.authorizationDiscovery = null;
   }
 };
 
@@ -3387,6 +3615,7 @@ function createConnectorFromConfig(serverConfig, connectorOptions) {
       fetch: serverConfig.fetch,
       authToken: serverConfig.authToken,
       authProvider: serverConfig.authProvider,
+      detectMixedAuth: serverConfig.detectMixedAuth,
       protocolNegotiation: serverConfig.protocolNegotiation,
       timeout: serverConfig.timeout,
       roots: serverConfig.roots,
@@ -3404,6 +3633,7 @@ import fs from "fs";
 import path from "path";
 
 // src/core/base.ts
+init_flow();
 init_logging();
 
 // src/core/skills.ts
@@ -3636,6 +3866,18 @@ var MCPConnection = class {
   get serverInfo() {
     return this.connector.serverInfo;
   }
+  /** OAuth state discovered for this connection, when available. */
+  get authorization() {
+    return this.connector.authorization;
+  }
+  /** Discover optional OAuth metadata without delaying MCP readiness. */
+  async discoverAuthorization() {
+    return this.connector.discoverAuthorization();
+  }
+  /** Authenticate an already-connected mixed-auth server. */
+  async authenticate() {
+    await this.connector.authenticate();
+  }
   /**
    * The negotiated protocol era for this session's connection:
    * `"legacy"` (2025-era) or `"modern"` (2026-07-28-era).
@@ -3668,7 +3910,8 @@ var MCPConnection = class {
       ...server ? { server } : {},
       capabilities,
       instructions: this.connector.instructions,
-      extensions
+      extensions,
+      ...this.authorization ? { authorization: this.authorization } : {}
     };
   }
   /**
@@ -3899,7 +4142,7 @@ var MCPConnection = class {
 };
 
 // src/core/base.ts
-function isOAuthClientProvider(provider) {
+function isOAuthClientProvider2(provider) {
   return !!provider && typeof provider === "object" && "redirectUrl" in provider && "clientMetadata" in provider;
 }
 var BaseMCPClient = class {
@@ -4132,7 +4375,7 @@ var BaseMCPClient = class {
         ...serverConfig,
         authProvider: oauthProvider
       };
-    } else if ("authProvider" in serverConfig && serverConfig.authProvider && isOAuthClientProvider(serverConfig.authProvider)) {
+    } else if ("authProvider" in serverConfig && serverConfig.authProvider && isOAuthClientProvider2(serverConfig.authProvider)) {
       oauthProvider = serverConfig.authProvider;
     }
     const openSession = async () => {
@@ -5818,6 +6061,7 @@ export {
   createOAuthProvider,
   decline,
   getDefaults,
+  isOAuthInteractionRequired,
   isUnauthorized,
   isVMAvailable,
   loadConfigFile,