@zackbart/connecta 0.6.1 → 0.7.1

package/dist/connector-scope.js

@@ -0,0 +1,35 @@
+/** Enough for local transport abort/close without letting cleanup own latency. */
+const CONNECTOR_SCOPE_CLOSE_BUDGET_MS = 100;
+/**
+ * Tell a connector that a scope owned by the core has ended.
+ *
+ * Scope teardown is deliberately best-effort: a missing hook is a no-op and a
+ * rejected hook is swallowed so cleanup can never replace the probe result that
+ * caused it. The hook gets a small, fixed completion window so edge runtimes do
+ * not cut off a real close as the response ends, but one that never settles
+ * cannot hold the completed probe open indefinitely. Callers own the
+ * at-most-once guarantee and must not use the scope again after this returns.
+ */
+export async function closeConnectorScope(connector, ctx) {
+    try {
+        const closing = connector.closeScope?.(ctx);
+        if (!closing)
+            return;
+        await new Promise((resolve) => {
+            const timer = setTimeout(resolve, CONNECTOR_SCOPE_CLOSE_BUDGET_MS);
+            // Both handlers stay attached after the timer wins, so a late rejection
+            // is still consumed rather than becoming an unhandled rejection.
+            closing.then(() => {
+                clearTimeout(timer);
+                resolve();
+            }, () => {
+                clearTimeout(timer);
+                resolve();
+            });
+        });
+    }
+    catch {
+        // The scope is over whether or not the connector managed to clean it up.
+    }
+}
+//# sourceMappingURL=connector-scope.js.map

package/dist/connector-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-scope.js","sourceRoot":"","sources":["../src/connector-scope.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAoB,EACpB,GAAqB;IAErB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;YACnE,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,CAAC,IAAI,CACV,GAAG,EAAE;gBACH,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,EACD,GAAG,EAAE;gBACH,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC"}

package/dist/connectors/api.d.ts

@@ -20,9 +20,9 @@ export interface ApiOptions {
     /**
      * Max inline result size (bytes) for this connector's tools before
      * call_tool/batch_call truncate and stash the full text for get_result
-     * paging. Overrides the deployment's `maxResultBytes`; omit to inherit it.
-     * Must be a whole number of bytes >= 1; anything else warns at startup and
-     * is ignored.
+     * paging. Overrides the deployment's `calls.maxResultBytes`; omit to inherit
+     * it. Must be a whole number of bytes >= 1; anything else warns at startup
+     * and is ignored.
      */
     maxResultBytes?: number;
     /**
@@ -30,9 +30,9 @@ export interface ApiOptions {
      * meta-tool as `connector:<id>`. See `Connector.usageGuide`.
      */
     usageGuide?: string;
-    /** Optional operator-managed credential exposed through ctx.credential and /ui. */
+    /** Optional operator-managed credential exposed through ctx.credential and /credentials. */
     credential?: ConnectorCredentialConfig;
-    /** Optional validation behind /ui's Test action. */
+    /** Optional validation behind /credentials' Test action. */
     testCredential?: (value: string, ctx: ConnectorContext) => Promise<CredentialTestResult>;
     /** Optional validation for named multi-field credentials. */
     testCredentials?: (values: ConnectorCredentialValues, ctx: ConnectorContext) => Promise<CredentialTestResult>;

package/dist/connectors/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,yBAAyB,EACzB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,eAAe,EAEhB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC3E;AAED,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,oDAAoD;IACpD,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAkD3D"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,yBAAyB,EACzB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,eAAe,EAEhB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC3E;AAED,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,4DAA4D;IAC5D,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAkD3D"}

package/dist/connectors/remote-mcp.d.ts

@@ -1,4 +1,5 @@
-import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import type { FetchLike, Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import { ConnectorCallError } from "../errors.js";
 import type { Connector, ConnectorContext, Logger } from "../types.js";
 export type RemoteMcpAuth = {
     type: "headers";
@@ -6,6 +7,7 @@ export type RemoteMcpAuth = {
 } | {
     type: "oauth";
 };
+export type RemoteMcpRedirectPolicy = "none" | "same-origin";
 export interface RemoteMcpOptions {
     url: string;
     /** Human-readable display name; the connector id remains the address prefix. */
@@ -14,9 +16,9 @@ export interface RemoteMcpOptions {
     /**
      * Max inline result size (bytes) for this connector's tools before
      * call_tool/batch_call truncate and stash the full text for get_result
-     * paging. Overrides the deployment's `maxResultBytes`; omit to inherit it.
-     * Must be a whole number of bytes >= 1; anything else warns at startup and
-     * is ignored.
+     * paging. Overrides the deployment's `calls.maxResultBytes`; omit to inherit
+     * it. Must be a whole number of bytes >= 1; anything else warns at startup
+     * and is ignored.
      */
     maxResultBytes?: number;
     /**
@@ -25,6 +27,14 @@ export interface RemoteMcpOptions {
      */
     usageGuide?: string;
     auth?: RemoteMcpAuth;
+    /**
+     * Downstream HTTP redirect policy. Defaults to `"none"`: every redirect is
+     * rejected. `"same-origin"` follows at most five redirects while preserving
+     * standard 301/302/303/307/308 method semantics. Cross-origin redirects and
+     * HTTPS downgrades are always refused, so credentials never cross the
+     * configured request's origin.
+     */
+    redirects?: RemoteMcpRedirectPolicy;
     /**
      * Refuse to connect to a non-`https://` `url` at construction (default
      * false). Loopback hosts (`localhost`, `127.0.0.1`, `[::1]`) are always
@@ -45,6 +55,19 @@ export interface RemoteMcpOptions {
      */
     _transportFactory?: (ctx: ConnectorContext) => Transport;
 }
+export declare const MAX_REMOTE_REDIRECT_HOPS = 5;
+export declare class RemoteMcpRedirectError extends ConnectorCallError {
+    constructor(connectorId: string, reason: string);
+}
+/**
+ * Wrap fetch with explicit, bounded redirect handling.
+ *
+ * The starting URL of each fetch call is trusted by its caller (the configured
+ * MCP endpoint, or an OAuth URL discovered by the pinned SDK). Only Location
+ * values are policy-controlled here. No rejected target is ever fetched, so
+ * arbitrary static header names receive the same protection as Authorization.
+ */
+export declare function redirectSafeFetch(connectorId: string, policy?: RemoteMcpRedirectPolicy, baseFetch?: FetchLike): FetchLike;
 /**
  * Proxy a downstream remote MCP server. SDK clients and transports are scoped
  * to one inbound request: reused by calls within a batch/execute_code run, but

package/dist/connectors/remote-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,MAAM,EAEP,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAC1D;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAuUvE"}
+{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EACV,MAAM,+CAA+C,CAAC;AAGvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,MAAM,EAEP,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAC1D;AAwJD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAW1C,qBAAa,sBAAuB,SAAQ,kBAAkB;gBAChD,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAOhD;AAaD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,uBAAgC,EACxC,SAAS,GAAE,SAAiB,GAC3B,SAAS,CA2EX;AAiBD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAwfvE"}

package/dist/connectors/remote-mcp.js

@@ -5,15 +5,222 @@ import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validatio
 import { KvOAuthProvider } from "../auth/downstream-oauth.js";
 import { ConnectorCallError } from "../errors.js";
 import { CONNECTA_VERSION } from "../version.js";
+/**
+ * How long a downstream gets to answer the session-termination DELETE before
+ * teardown stops waiting. Deliberately a fraction of the core's scope-close
+ * budget (`closeConnectorScope`), so the whole teardown still lands inside the
+ * window that budget makes safe on an edge runtime: whatever is still in flight
+ * when this expires is aborted by the close that immediately follows. What that
+ * costs is only the acknowledgement — the DELETE is headers-only and has long
+ * since gone out — so a slow provider still usually ends the session; it just
+ * does not get to tell us so.
+ */
+const TERMINATE_SESSION_BUDGET_MS = 50;
+/**
+ * Ceiling on the tools one catalog refresh will accumulate while walking
+ * `tools/list`.
+ *
+ * This is the bound that matters, and pages are the wrong dimension to put it
+ * in: the *server* picks the page size, so a page ceiling is a tool ceiling
+ * multiplied by a number connecta can neither observe in advance nor control.
+ * At ten tools a page, 100 pages is 1,000 tools; at a hundred, 10,000 — and
+ * connecta's own large-catalog envelope is benchmarked to 100,000 (issue #82).
+ * A page ceiling low enough to be a real defense therefore sits *inside* the
+ * catalog sizes this product exists to serve. Worse, the common conformant
+ * idiom is to advertise a `nextCursor` whenever a page came back full and then
+ * serve one empty page to terminate, so a perfectly well-behaved 10,000-tool
+ * server paging at 100 spends 101 requests: bound the pages and its entire
+ * catalog fails, for doing nothing wrong.
+ *
+ * So the ceiling goes on accumulated tools — the thing actually held in memory
+ * — and it sits at the top of the benchmarked envelope rather than below it.
+ * Deliberately the same philosophy as issue #82's discovery-response bounds:
+ * cap the bytes a caller can be made to hold, not the number of round trips it
+ * took to get them.
+ */
+const MAX_TOOLS = 100_000;
+/**
+ * Absolute backstop on `tools/list` pages in one refresh — a runaway guard, not
+ * the primary defense.
+ *
+ * The walk terminates on its own well before this: a cursor handed back twice
+ * is a definite loop, two consecutive pages that add no new tools are a server
+ * going nowhere, and MAX_TOOLS caps what any of it can accumulate. This exists
+ * only so the loop is finite even if a downstream somehow satisfies all three
+ * forever, because the caller's probe deadline abandons the *caller*, not the
+ * loop. Set high enough that no honest server reaches it.
+ */
+const MAX_TOOL_PAGES = 10_000;
+/**
+ * Re-prime an SDK client's tool-metadata cache from the *full* walked catalog.
+ *
+ * `Client.listTools()` ends by calling its private `cacheToolMetadata`, which
+ * **clears** the output-schema validators and the task-support sets before
+ * repopulating them from the page it just received. Call it once per page —
+ * which walking the chain necessarily does — and the request-scoped client is
+ * left holding metadata for the *last* page alone. `callTool` then finds no
+ * validator for every earlier-page tool and silently skips both the "declared
+ * an outputSchema but returned no structuredContent" check and the
+ * structured-content validation, and finds no task requirement so a
+ * required-task tool is dispatched as a plain `tools/call`. Enforcement would
+ * depend on which page a tool happened to land on, which is not enforcement.
+ *
+ * So hand the whole aggregated list back deliberately, once, at the end. The
+ * SDK types the method `private`, hence the cast; the SDK version is pinned
+ * exactly and `test/remote-mcp-pagination.test.ts` asserts the method still
+ * exists, so a bump that renames it fails CI rather than quietly restoring the
+ * bug.
+ */
+function primeToolMetadata(client, tools) {
+    const prime = client.cacheToolMetadata;
+    if (typeof prime !== "function")
+        return;
+    prime.call(client, tools);
+}
+/**
+ * True for a result-parse failure caused by the page's `nextCursor` itself —
+ * in practice `nextCursor: null`, a very common JSON idiom for "no more pages"
+ * that the MCP schema does not accept (the chain ends on an *absent* cursor).
+ * Duck-typed rather than `instanceof ZodError`: the SDK may parse with its own
+ * zod instance, and cross-instance `instanceof` is a coin flip.
+ */
+function isCursorShapeError(err) {
+    const issues = err?.issues;
+    return (Array.isArray(issues) &&
+        issues.some((issue) => {
+            const path = issue.path;
+            return Array.isArray(path) && path[0] === "nextCursor";
+        }));
+}
 function msg(err) {
     return err instanceof Error ? err.message : String(err);
 }
+/**
+ * End the downstream's session before the connection is torn down.
+ *
+ * `Client.close()` only unwinds our side — it aborts the transport's controller
+ * and fires `onclose`. Spec session termination is a separate DELETE carrying
+ * `Mcp-Session-Id`, and without it a stateful provider keeps the session alive
+ * until its own (often hour-long) timeout, which a periodic probe would then
+ * accumulate several of per connector.
+ *
+ * Ordering is load-bearing: the SDK sends that DELETE on the transport's
+ * AbortSignal, so calling this *after* close would abort the request on issue
+ * and silently do nothing. Everything else is best-effort — a transport with no
+ * `terminateSession` (a custom one, or an older SDK), a downstream that refuses
+ * (405 is a legal answer), errors, or never replies all fall through to the
+ * close with the session left to age out as it did before.
+ */
+async function terminateSession(transport) {
+    const terminate = transport.terminateSession;
+    if (typeof terminate !== "function")
+        return;
+    // The SDK issues no request at all when no `mcp-session-id` was captured, so
+    // a stateless downstream never sees a spurious DELETE.
+    const done = (async () => terminate.call(transport))().catch(() => {
+        // The session is being abandoned either way; a refusal changes nothing.
+        // Caught here rather than at the await below so a late rejection — one
+        // arriving after the budget expired — is still consumed.
+    });
+    await new Promise((resolve) => {
+        const timer = setTimeout(resolve, TERMINATE_SESSION_BUDGET_MS);
+        done.then(() => {
+            clearTimeout(timer);
+            resolve();
+        });
+    });
+}
 function isLoopbackHost(hostname) {
     return (hostname === "localhost" ||
         hostname === "127.0.0.1" ||
         hostname === "[::1]" ||
         hostname === "::1");
 }
+export const MAX_REMOTE_REDIRECT_HOPS = 5;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const BODY_HEADERS = [
+    "content-encoding",
+    "content-language",
+    "content-length",
+    "content-location",
+    "content-type",
+    "transfer-encoding",
+];
+export class RemoteMcpRedirectError extends ConnectorCallError {
+    constructor(connectorId, reason) {
+        super("connector_call_failed", `Connector "${connectorId}" redirect policy rejected the downstream response: ${reason}.`);
+        this.name = "RemoteMcpRedirectError";
+    }
+}
+function redirectedInit(init, status) {
+    const method = (init.method ?? "GET").toUpperCase();
+    const becomesGet = (status === 303 && method !== "GET" && method !== "HEAD") ||
+        ((status === 301 || status === 302) && method === "POST");
+    if (!becomesGet)
+        return init;
+    const headers = new Headers(init.headers);
+    for (const name of BODY_HEADERS)
+        headers.delete(name);
+    return { ...init, method: "GET", body: undefined, headers };
+}
+/**
+ * Wrap fetch with explicit, bounded redirect handling.
+ *
+ * The starting URL of each fetch call is trusted by its caller (the configured
+ * MCP endpoint, or an OAuth URL discovered by the pinned SDK). Only Location
+ * values are policy-controlled here. No rejected target is ever fetched, so
+ * arbitrary static header names receive the same protection as Authorization.
+ */
+export function redirectSafeFetch(connectorId, policy = "none", baseFetch = fetch) {
+    return async (input, initialInit = {}) => {
+        let current = new URL(input);
+        let init = initialInit;
+        const seen = new Set([current.href]);
+        let hops = 0;
+        while (true) {
+            const response = await baseFetch(current, {
+                ...init,
+                redirect: "manual",
+            });
+            if (!REDIRECT_STATUSES.has(response.status))
+                return response;
+            const location = response.headers.get("location");
+            await response.body?.cancel().catch(() => { });
+            if (!location) {
+                throw new RemoteMcpRedirectError(connectorId, `HTTP ${response.status} carried no Location header`);
+            }
+            if (policy === "none") {
+                throw new RemoteMcpRedirectError(connectorId, `HTTP ${response.status} redirects are disabled`);
+            }
+            if (hops >= MAX_REMOTE_REDIRECT_HOPS) {
+                throw new RemoteMcpRedirectError(connectorId, `the redirect chain exceeded ${MAX_REMOTE_REDIRECT_HOPS} hops`);
+            }
+            let next;
+            try {
+                next = new URL(location, current);
+            }
+            catch {
+                throw new RemoteMcpRedirectError(connectorId, `HTTP ${response.status} carried an invalid Location header`);
+            }
+            if (current.protocol === "https:" && next.protocol !== "https:") {
+                throw new RemoteMcpRedirectError(connectorId, "an HTTPS-to-HTTP downgrade is not allowed");
+            }
+            if (next.origin !== current.origin) {
+                throw new RemoteMcpRedirectError(connectorId, "a cross-origin redirect is not allowed");
+            }
+            if (next.username || next.password) {
+                throw new RemoteMcpRedirectError(connectorId, "a redirect target containing URL credentials is not allowed");
+            }
+            if (seen.has(next.href)) {
+                throw new RemoteMcpRedirectError(connectorId, "the redirect chain loops");
+            }
+            seen.add(next.href);
+            hops++;
+            init = redirectedInit(init, response.status);
+            current = next;
+        }
+    };
+}
 /**
  * Proxy a downstream remote MCP server. SDK clients and transports are scoped
  * to one inbound request: reused by calls within a batch/execute_code run, but
@@ -47,6 +254,25 @@ export function remoteMcp(id, opts) {
     }
     /** Typed per-call auth signal; the SDK's UnauthorizedError stays as cause. */
     const authRequiredError = (cause) => new ConnectorCallError("auth_required", `Connector "${id}" requires authorization — call authorize_connector({ connector: "${id}" }) and open the returned URL.`, { cause });
+    const scopeEndedError = () => new Error(`Connector "${id}" scope ended during connection.`);
+    /**
+     * One `tools/list` request. The only thing wrapped here is the diagnosis of a
+     * `nextCursor` the MCP result schema refuses — overwhelmingly `null`, which
+     * plenty of servers use to mean "no more pages" but the spec spells as an
+     * *absent* cursor. The SDK surfaces that as a raw validation dump about a
+     * field the operator never sees; say which server broke which rule instead.
+     * Accepting `null` as end-of-chain outright is issue #99.
+     */
+    const listPage = async (client, cursor) => {
+        try {
+            return await client.listTools(cursor === undefined ? undefined : { cursor });
+        }
+        catch (err) {
+            if (!isCursorShapeError(err))
+                throw err;
+            throw new Error(`Connector "${id}" returned a tools/list page whose nextCursor is neither a string nor absent (a null cursor is the usual culprit) — MCP ends pagination on an absent nextCursor, so this catalog cannot be walked.`, { cause: err });
+        }
+    };
     const stateFor = (ctx) => {
         const scope = ctx.requestScope ?? ctx;
         let state = states.get(scope);
@@ -58,6 +284,7 @@ export function remoteMcp(id, opts) {
                 authRequired: false,
                 provider: null,
                 connectedGeneration: null,
+                closed: false,
             };
             states.set(scope, state);
         }
@@ -67,25 +294,22 @@ export function remoteMcp(id, opts) {
         state.provider ??= new KvOAuthProvider(id, ctx.storage, `${ctx.baseUrl}/oauth/callback/${id}`);
         return state.provider;
     };
-    // NOTE: StreamableHTTPClientTransport speaks over fetch, which transparently
-    // follows 3xx redirects. A malicious or compromised downstream MCP could
-    // redirect to an internal address (e.g. http://169.254.169.254/…) and fetch
-    // would re-issue the request — potentially carrying static auth headers. The
-    // scheme check above only guards the first hop; a fully robust guard (manual
-    // redirect handling + per-hop re-validation + stripping auth headers cross-
-    // origin) lives in the SDK transport and is deferred to a future non-patch
-    // release rather than reimplemented here.
     const buildTransport = (ctx, state) => {
         if (opts._transportFactory)
             return opts._transportFactory(ctx);
         const url = new URL(opts.url);
+        const guardedFetch = redirectSafeFetch(id, opts.redirects);
         if (opts.auth?.type === "oauth") {
             return new StreamableHTTPClientTransport(url, {
                 authProvider: getProvider(ctx, state),
+                fetch: guardedFetch,
             });
         }
         const headers = opts.auth?.type === "headers" ? opts.auth.headers : undefined;
-        return new StreamableHTTPClientTransport(url, headers ? { requestInit: { headers } } : undefined);
+        return new StreamableHTTPClientTransport(url, {
+            ...(headers ? { requestInit: { headers } } : {}),
+            fetch: guardedFetch,
+        });
     };
     const reset = (state) => {
         state.client = null;
@@ -93,22 +317,29 @@ export function remoteMcp(id, opts) {
         state.connecting = null;
         state.authRequired = false;
         state.connectedGeneration = null;
+        // `closed` is deliberately not cleared — see ConnectionState.
     };
     const ensureConnected = async (ctx, state) => {
         // Cross-isolate force re-auth: another isolate bumped the KV generation and
         // wiped credentials. This request's cached client still speaks the old
         // token — drop it so the next connect runs against current state.
         if (state.client && isOauth && state.connectedGeneration !== null) {
-            if ((await getProvider(ctx, state).generation()) !==
-                state.connectedGeneration) {
+            const generation = await getProvider(ctx, state).generation();
+            if (state.closed)
+                throw scopeEndedError();
+            if (generation !== state.connectedGeneration) {
                 reset(state);
             }
         }
+        if (state.closed)
+            throw scopeEndedError();
         if (state.client)
             return;
         state.connecting ??= (async () => {
             const provider = isOauth ? getProvider(ctx, state) : null;
             const genAtStart = provider ? await provider.generation() : 0;
+            if (state.closed)
+                throw scopeEndedError();
             // Stamp the provider so any saveTokens/saveClientInformation the SDK fires
             // during this connect (code exchange, DCR) — or during a later refresh on
             // the resulting client — is dropped if a concurrent force bumps the
@@ -123,19 +354,47 @@ export function remoteMcp(id, opts) {
             state.transport = t;
             try {
                 await c.connect(t);
+                // A probe deadline can end its scope while connect is still in flight.
+                // The transport is closed immediately by closeScope; if connect wins
+                // that race anyway, close the resulting client rather than resurrecting
+                // a session in the detached state object.
+                if (state.closed) {
+                    try {
+                        await c.close();
+                    }
+                    catch {
+                        // The scope has already been discarded either way.
+                    }
+                    throw scopeEndedError();
+                }
                 // A force re-auth that landed WHILE we were connecting wiped the creds
                 // this client just bound to. Discard it rather than cache a connection
                 // that resurrects the wiped-and-reauthorized connector from a stale
                 // isolate. Surfaces as auth_required — the connector genuinely needs
                 // re-consent now.
-                if (provider && (await provider.generation()) !== genAtStart) {
-                    try {
-                        await c.close();
+                if (provider) {
+                    const generation = await provider.generation();
+                    // closeScope can land while the generation read is pending, after
+                    // connect succeeded but before this client is cached. Discard the
+                    // client on that side of the await too.
+                    if (state.closed) {
+                        try {
+                            await c.close();
+                        }
+                        catch {
+                            // The scope has already been discarded either way.
+                        }
+                        throw scopeEndedError();
                     }
-                    catch {
-                        // discarding either way
+                    if (generation !== genAtStart) {
+                        try {
+                            await c.close();
+                        }
+                        catch {
+                            // discarding either way
+                        }
+                        throw new UnauthorizedError("Connector was re-authorized during connect; reconnect required.");
                     }
-                    throw new UnauthorizedError("Connector was re-authorized during connect; reconnect required.");
                 }
                 state.client = c;
                 state.connectedGeneration = genAtStart;
@@ -164,11 +423,102 @@ export function remoteMcp(id, opts) {
         description: opts.description,
         maxResultBytes: opts.maxResultBytes,
         usageGuide: opts.usageGuide,
+        // `tools/list` is cursor-paginated: the server chooses the page size and
+        // signals "there is more" with a `nextCursor`, which the SDK's
+        // Client.listTools() returns without following. Collect the whole chain
+        // here, because a half-collected catalog is indistinguishable from a small
+        // one — later-page tools would simply appear not to exist, unsearchable and
+        // unaddressable, with nothing anywhere saying why.
+        //
+        // All pages ride the one request-scoped client already connected above, and
+        // the accumulator is returned rather than stored: a cursor is opaque and
+        // session-bound, so nothing here may outlive this call.
         async listTools(ctx) {
             const state = stateFor(ctx);
             await ensureConnected(ctx, state);
-            const res = await state.client.listTools();
-            return res.tools.map((t) => ({
+            // Bind the client once so the whole walk provably rides one session — a
+            // cursor is only meaningful to the connection that issued it, and a
+            // re-read could in principle pick up a different one. It is NOT guarding
+            // against closeScope nulling state.client mid-loop: closeScope sets
+            // `closed` and nulls `client` in one synchronous run, and the loop
+            // re-checks `closed` before every page, so the nulled client is
+            // unreachable from here.
+            const client = state.client;
+            // Raw SDK tools, not ToolDefs: the metadata re-prime below needs fields
+            // (task support) that a ToolDef deliberately does not carry.
+            const listed = [];
+            const names = new Set();
+            const spent = new Set();
+            let cursor;
+            /** Consecutive pages that advertised a successor but added nothing. */
+            let barren = 0;
+            let complete = false;
+            for (let page = 0; page < MAX_TOOL_PAGES; page++) {
+                // The scope can end between pages (probe timeout, teardown). Stop
+                // rather than keep paging into a transport that is being closed.
+                if (state.closed)
+                    throw scopeEndedError();
+                // Page one sends no params at all, so a non-paginated server sees
+                // exactly the request it saw before pagination existed.
+                const res = await listPage(client, cursor);
+                let added = 0;
+                for (const t of res.tools) {
+                    // First page wins. An unstable cursor can serve the same tool on two
+                    // pages — a failure mode that did not exist while only page one was
+                    // read — and a duplicate would inflate `toolCount`, double the tool's
+                    // `search_tools` row, and churn the registry's catalog-changed
+                    // comparison into a persistence write on every refresh.
+                    if (names.has(t.name))
+                        continue;
+                    names.add(t.name);
+                    listed.push(t);
+                    added++;
+                }
+                // Pagination ends when `nextCursor` is ABSENT — not when it is falsy.
+                // An empty string is a legal cursor and means "keep going"; `if
+                // (!next)` here would silently truncate that server's catalog.
+                const next = res.nextCursor;
+                if (typeof next !== "string") {
+                    complete = true;
+                    break;
+                }
+                // A page that adds nothing and still claims a successor made no
+                // progress. Allow exactly one: the widespread idiom is to advertise a
+                // cursor whenever a page came back full and then serve one empty page
+                // to terminate, and that server is conformant. Two in a row is a
+                // downstream going nowhere, and this kills a "fresh cursor forever, no
+                // tools" adversary in a couple of round trips instead of thousands.
+                if (added === 0 && ++barren > 1) {
+                    throw new Error(`Connector "${id}" returned two consecutive tools/list pages that added no tools and still advertised another — the catalog is not advancing.`);
+                }
+                if (added > 0)
+                    barren = 0;
+                // A cursor handed back a second time is not a slow server, it is a
+                // loop. Fail now rather than walking it until a ceiling notices.
+                if (spent.has(next)) {
+                    throw new Error(`Connector "${id}" handed back a tools/list cursor it had already issued — the pagination chain loops.`);
+                }
+                // Checked here rather than on arrival: this bounds what a *walk* may
+                // accumulate, and a server that answers in one page was always free to
+                // send whatever it sends.
+                if (listed.length > MAX_TOOLS) {
+                    throw new Error(`Connector "${id}" advertised further tools/list pages past ${listed.length} tools, over the ${MAX_TOOLS}-tool ceiling one catalog refresh will collect.`);
+                }
+                // Opaque by contract: handed straight back, never parsed, rewritten,
+                // or persisted.
+                spent.add(next);
+                cursor = next;
+            }
+            // Fail the refresh outright. Returning what we have would publish a
+            // partial catalog that looks complete; throwing lets the registry keep
+            // serving the last complete one via its stale fallback.
+            if (!complete) {
+                throw new Error(`Connector "${id}" kept advertising more tools/list pages after ${MAX_TOOL_PAGES} — refusing to page further.`);
+            }
+            // Repair what the per-page listTools calls left behind before any of
+            // these tools can be called. See primeToolMetadata.
+            primeToolMetadata(client, listed);
+            return listed.map((t) => ({
                 name: t.name,
                 description: t.description,
                 inputSchema: t.inputSchema,
@@ -199,6 +549,37 @@ export function remoteMcp(id, opts) {
                 throw err;
             }
         },
+        async closeScope(ctx) {
+            const scope = ctx.requestScope ?? ctx;
+            const state = states.get(scope);
+            if (!state)
+                return;
+            // Delete before awaiting: a duplicate teardown is a no-op, and no later
+            // lookup can reuse the state while its client is closing.
+            states.delete(scope);
+            state.closed = true;
+            const client = state.client;
+            const transport = state.transport;
+            state.client = null;
+            state.transport = null;
+            state.connecting = null;
+            state.authRequired = false;
+            state.connectedGeneration = null;
+            // Ask the downstream to drop its session first — closing only aborts our
+            // side, and the DELETE that frees the server's rides on the very
+            // AbortSignal the close is about to trip.
+            if (transport)
+                await terminateSession(transport);
+            // Client.close() owns its connected transport. During an unfinished or
+            // failed connect there is no cached client yet, so close the transport
+            // directly to abort/release that half-open session.
+            if (client) {
+                await client.close();
+            }
+            else {
+                await transport?.close();
+            }
+        },
         async status(ctx) {
             const state = stateFor(ctx);
             try {