@zackbart/connecta 0.8.1 → 0.9.1

package/src/catalog.ts

@@ -13,8 +13,19 @@ export function summarizeDescription(
   return `${compact.slice(0, DEFAULT_DESCRIPTION_LENGTH - 1).trimEnd()}…`;
 }
 
+function lexicalTokens(text: string): string[] {
+  return text
+    .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, " ")
+    .trim()
+    .split(/\s+/)
+    .filter(Boolean);
+}
+
 function normalized(text: string): string {
-  return text.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+  return lexicalTokens(text).join(" ");
 }
 
 /**
@@ -75,7 +86,14 @@ export function lexicalSearchQuery(query: string): string {
 interface SearchDocument {
   tool: ToolDef;
   name: string;
-  description: string;
+  nameTokens: string[];
+  descriptionTokens: string[];
+}
+
+interface SearchIndex {
+  documents: SearchDocument[];
+  nameTokenDocuments: ReadonlyMap<string, readonly ToolDef[]>;
+  descriptionTokenDocuments: ReadonlyMap<string, readonly ToolDef[]>;
 }
 
 export type LexicalMatchMode = "all" | "partial";
@@ -86,19 +104,174 @@ export interface RankedTool {
   order: number;
 }
 
-const searchDocuments = new WeakMap<ToolDef[], SearchDocument[]>();
+const searchIndexes = new WeakMap<ToolDef[], SearchIndex>();
+
+function indexFor(tools: ToolDef[]): SearchIndex {
+  let index = searchIndexes.get(tools);
+  if (!index) {
+    const nameTokenDocuments = new Map<string, ToolDef[]>();
+    const descriptionTokenDocuments = new Map<string, ToolDef[]>();
+    const addTokens = (
+      target: Map<string, ToolDef[]>,
+      tokens: string[],
+      tool: ToolDef,
+    ) => {
+      for (const token of new Set(tokens)) {
+        const documents = target.get(token) ?? [];
+        documents.push(tool);
+        target.set(token, documents);
+      }
+    };
+    const documents = tools.map((tool) => {
+      const nameTokens = lexicalTokens(tool.name);
+      const descriptionTokens = lexicalTokens(tool.description ?? "");
+      addTokens(nameTokenDocuments, nameTokens, tool);
+      addTokens(descriptionTokenDocuments, descriptionTokens, tool);
+      return {
+        tool,
+        name: nameTokens.join(" "),
+        nameTokens,
+        descriptionTokens,
+      };
+    });
+    index = {
+      documents,
+      nameTokenDocuments,
+      descriptionTokenDocuments,
+    };
+    searchIndexes.set(tools, index);
+  }
+  return index;
+}
 
 function documentsFor(tools: ToolDef[]): SearchDocument[] {
-  let docs = searchDocuments.get(tools);
-  if (!docs) {
-    docs = tools.map((tool) => ({
-      tool,
-      name: normalized(tool.name),
-      description: normalized(tool.description ?? ""),
-    }));
-    searchDocuments.set(tools, docs);
+  return indexFor(tools).documents;
+}
+
+/**
+ * Whole-token equality is the ordinary lexical match. A deliberately narrow
+ * inflection check retains useful singular/plural and past-tense recall
+ * without bringing back arbitrary substring matches (`list` must not match
+ * `enlist`, and `record` must not match the noun `recording`).
+ */
+function inflectionVariants(base: string): string[] {
+  return [
+    `${base}s`,
+    `${base}es`,
+    `${base}ed`,
+    ...(base.endsWith("e") ? [`${base}d`] : []),
+    ...(base.endsWith("y")
+      ? [
+          `${base.slice(0, -1)}ies`,
+          `${base.slice(0, -1)}ied`,
+        ]
+      : []),
+  ];
+}
+
+function matchingTokenCandidates(term: string): Set<string> {
+  const candidates = new Set([term, ...inflectionVariants(term)]);
+  const possibleBases = [
+    ...(term.endsWith("s") ? [term.slice(0, -1)] : []),
+    ...(term.endsWith("es") ? [term.slice(0, -2)] : []),
+    ...(term.endsWith("ed") ? [term.slice(0, -2)] : []),
+    ...(term.endsWith("d") ? [term.slice(0, -1)] : []),
+    ...(term.endsWith("ies")
+      ? [`${term.slice(0, -3)}y`]
+      : []),
+    ...(term.endsWith("ied")
+      ? [`${term.slice(0, -3)}y`]
+      : []),
+  ];
+  for (const base of possibleBases) {
+    if (base && inflectionVariants(base).includes(term)) {
+      candidates.add(base);
+    }
   }
-  return docs;
+  return candidates;
+}
+
+export interface LexicalCorpusStatistics {
+  documentCount: number;
+  documentFrequency: ReadonlyMap<string, number>;
+  nameMatches: ReadonlyMap<string, ReadonlySet<ToolDef>>;
+  descriptionMatches: ReadonlyMap<string, ReadonlySet<ToolDef>>;
+}
+
+/**
+ * Compute query-specific document frequencies across every available catalog.
+ * The caller does this once per search and shares the result with each
+ * connector rank, so ubiquitous words contribute less than discriminative
+ * ones without making any action word a stopword.
+ */
+export function lexicalCorpusStatistics(
+  toolSets: ToolDef[][],
+  query: string,
+): LexicalCorpusStatistics {
+  const terms = [...new Set(lexicalTokens(query))];
+  if (terms.length === 0) {
+    return {
+      documentCount: toolSets.reduce(
+        (total, tools) => total + tools.length,
+        0,
+      ),
+      documentFrequency: new Map(),
+      nameMatches: new Map(),
+      descriptionMatches: new Map(),
+    };
+  }
+  const nameMatches = new Map<string, Set<ToolDef>>();
+  const descriptionMatches = new Map<string, Set<ToolDef>>();
+  for (const term of terms) {
+    const termNameMatches = new Set<ToolDef>();
+    const termDescriptionMatches = new Set<ToolDef>();
+    for (const tools of toolSets) {
+      const index = indexFor(tools);
+      for (const candidate of matchingTokenCandidates(term)) {
+        for (const tool of index.nameTokenDocuments.get(candidate) ?? []) {
+          termNameMatches.add(tool);
+        }
+        for (
+          const tool of
+          index.descriptionTokenDocuments.get(candidate) ?? []
+        ) {
+          termDescriptionMatches.add(tool);
+        }
+      }
+    }
+    nameMatches.set(term, termNameMatches);
+    descriptionMatches.set(term, termDescriptionMatches);
+  }
+  const documentFrequency = new Map(
+    terms.map((term) => [
+      term,
+      new Set([
+        ...(nameMatches.get(term) ?? []),
+        ...(descriptionMatches.get(term) ?? []),
+      ]).size,
+    ]),
+  );
+  return {
+    documentCount: toolSets.reduce(
+      (total, tools) => total + tools.length,
+      0,
+    ),
+    documentFrequency,
+    nameMatches,
+    descriptionMatches,
+  };
+}
+
+function inverseDocumentFrequency(
+  term: string,
+  statistics: LexicalCorpusStatistics,
+): number {
+  const frequency = statistics.documentFrequency.get(term) ?? 0;
+  return Math.log(
+    1 +
+      (statistics.documentCount - frequency + 0.5) /
+        (frequency + 0.5),
+  );
 }
 
 function scoreDocument(
@@ -106,30 +279,45 @@ function scoreDocument(
   phrase: string,
   terms: string[],
   mode: LexicalMatchMode,
+  statistics: LexicalCorpusStatistics,
 ): number | null {
   if (!phrase) return 0;
-  const haystack = `${doc.name} ${doc.description}`;
-  const matchedTerms = terms.filter((term) => haystack.includes(term));
+  const matchedTerms = terms.filter((term) =>
+    statistics.nameMatches.get(term)?.has(doc.tool) ||
+    statistics.descriptionMatches.get(term)?.has(doc.tool),
+  );
   if (mode === "all" && matchedTerms.length !== terms.length) return null;
-  if (mode === "partial") {
-    if (matchedTerms.length === 0) return null;
-    const nameMatches = matchedTerms.filter((term) =>
-      doc.name.includes(term),
-    ).length;
-    // Coverage wins first, then the number of those terms found in the tool
-    // name. Catalog order breaks the remaining ties at the caller.
-    return matchedTerms.length * 1_000 + nameMatches;
+  if (matchedTerms.length === 0) return null;
+
+  // Coverage remains meaningful in partial mode, but is IDF-weighted rather
+  // than a raw term count: one rare domain term can beat several ubiquitous
+  // catalog verbs.
+  let score = matchedTerms.reduce(
+    (total, term) =>
+      total + 4 * inverseDocumentFrequency(term, statistics),
+    0,
+  );
+  const phraseWeight = terms.reduce(
+    (total, term) =>
+      total + inverseDocumentFrequency(term, statistics),
+    0,
+  );
+  if (doc.name === phrase) score += 40 * phraseWeight;
+  else if (doc.name.startsWith(`${phrase} `)) score += 24 * phraseWeight;
+  else if (` ${doc.name} `.includes(` ${phrase} `)) {
+    score += 16 * phraseWeight;
   }
 
-  let score = 0;
-  if (doc.name === phrase) score += 1_000;
-  else if (doc.name.startsWith(phrase)) score += 800;
-  else if (doc.name.includes(phrase)) score += 600;
-  for (const term of terms) {
-    if (doc.name === term) score += 200;
-    else if (doc.name.startsWith(term)) score += 120;
-    else if (doc.name.includes(term)) score += 80;
-    if (doc.description.includes(term)) score += 10;
+  for (const term of matchedTerms) {
+    const weight = inverseDocumentFrequency(term, statistics);
+    if (doc.nameTokens.includes(term)) score += 12 * weight;
+    else if (statistics.nameMatches.get(term)?.has(doc.tool)) {
+      score += 8 * weight;
+    }
+    if (doc.descriptionTokens.includes(term)) score += 3 * weight;
+    else if (statistics.descriptionMatches.get(term)?.has(doc.tool)) {
+      score += 1.5 * weight;
+    }
   }
   return score;
 }
@@ -139,12 +327,16 @@ export function rankTools(
   tools: ToolDef[],
   query: string,
   mode: LexicalMatchMode = "all",
+  statistics: LexicalCorpusStatistics = lexicalCorpusStatistics(
+    [tools],
+    query,
+  ),
 ): RankedTool[] {
   const phrase = normalized(query);
-  const terms = phrase.split(/\s+/).filter(Boolean);
+  const terms = [...new Set(phrase.split(/\s+/).filter(Boolean))];
   const ranked: RankedTool[] = [];
   documentsFor(tools).forEach((doc, order) => {
-    const score = scoreDocument(doc, phrase, terms, mode);
+    const score = scoreDocument(doc, phrase, terms, mode, statistics);
     if (score !== null) ranked.push({ tool: doc.tool, score, order });
   });
   return ranked;
@@ -300,3 +492,105 @@ export function compactSchema(schema: JsonSchema): string {
   compactSchemas.set(schema, rendered);
   return rendered;
 }
+
+/** The property and required names a schema resolves to, or undefined. */
+export interface SchemaObjectKeys {
+  properties: string[];
+  required: string[];
+}
+
+/**
+ * Walk a schema the way renderSchema does — composing `allOf` and resolving
+ * `$ref` against the root's `$defs`/`definitions` — and collect the top-level
+ * property names it would render. A shallow `Object.keys(schema.properties)`
+ * disagrees with the rendered compact schema for exactly the shapes real
+ * connectors emit (a top-level `$ref` to a `$defs` entry, or the OpenAPI
+ * "extend this base" `allOf`), which is worse than no metadata at all: it
+ * reports an empty field list for a tool that plainly has fields.
+ *
+ * Returns undefined when the schema is not an object shape at all — a union,
+ * array, enum, or unresolvable `$ref`. Absent metadata tells a caller to read
+ * the rendered schema instead; an empty array would claim the tool takes no
+ * fields.
+ */
+export function schemaObjectKeys(
+  schema: JsonSchema | undefined,
+): SchemaObjectKeys | undefined {
+  if (!schema) return undefined;
+  const defs = {
+    ...(schema.$defs as Record<string, unknown>),
+    ...(schema.definitions as Record<string, unknown>),
+  };
+  try {
+    return objectKeys(schema, defs, new Set(), 0);
+  } catch {
+    return undefined;
+  }
+}
+
+/** Merge in declaration order, first occurrence winning, as renderSchema renders. */
+function mergedKeys(
+  parts: readonly SchemaObjectKeys[],
+): SchemaObjectKeys | undefined {
+  if (parts.length === 0) return undefined;
+  return {
+    properties: [...new Set(parts.flatMap((part) => part.properties))],
+    required: [...new Set(parts.flatMap((part) => part.required))],
+  };
+}
+
+/** The key-collecting twin of renderSchema; the branch order must match it. */
+function objectKeys(
+  schema: unknown,
+  defs: Record<string, unknown>,
+  seen: Set<string>,
+  depth: number,
+): SchemaObjectKeys | undefined {
+  if (depth > 4) return undefined;
+  if (schema === null || typeof schema !== "object") return undefined;
+  const s = schema as Record<string, unknown>;
+
+  if (Array.isArray(s.allOf)) {
+    const { allOf: _members, ...own } = s;
+    const parts = declaresShape(own)
+      ? [objectKeys(own, defs, seen, depth)]
+      : [];
+    for (const member of s.allOf) {
+      parts.push(objectKeys(member, defs, seen, depth + 1));
+    }
+    // An allOf whose members are not all object shapes renders as an
+    // intersection with a non-object half; no single key list describes it.
+    return parts.every((part) => part !== undefined)
+      ? mergedKeys(parts as SchemaObjectKeys[])
+      : undefined;
+  }
+
+  if (typeof s.$ref === "string") {
+    const name = refName(s.$ref);
+    if (seen.has(name)) return undefined;
+    const target = defs[name];
+    if (target === undefined) return undefined;
+    seen.add(name);
+    const resolved = objectKeys(target, defs, seen, depth);
+    seen.delete(name);
+    return resolved;
+  }
+
+  if (Array.isArray(s.oneOf ?? s.anyOf)) return undefined;
+  if (Array.isArray(s.enum)) return undefined;
+  if (s.const !== undefined) return undefined;
+  if (s.type === "array" || s.items) return undefined;
+  if (s.type === "object" || s.properties) {
+    const props = s.properties;
+    if (props === null || Array.isArray(props) || typeof props !== "object") {
+      return { properties: [], required: [] };
+    }
+    return {
+      properties: Object.keys(props as Record<string, unknown>),
+      required: Array.isArray(s.required)
+        ? s.required.filter((key): key is string => typeof key === "string")
+        : [],
+    };
+  }
+  return undefined;
+}

package/src/connectors/remote-mcp.ts

@@ -1,13 +1,17 @@
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import {
+  Client,
+  isInputRequiredResult,
+  specTypeSchemas,
+  StreamableHTTPClientTransport,
+  UnauthorizedError,
+} from "@modelcontextprotocol/client";
 import type {
   FetchLike,
+  ListToolsResult,
+  StandardSchemaV1,
+  Tool,
   Transport,
-} from "@modelcontextprotocol/sdk/shared/transport.js";
-import { ListToolsResultSchema } from "@modelcontextprotocol/sdk/types.js";
-import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
-import { z } from "zod";
+} from "@modelcontextprotocol/client";
 import { KvOAuthProvider } from "../auth/downstream-oauth.js";
 import { MAX_CATALOG_TOOLS } from "../catalog-limits.js";
 import { ConnectorCallError } from "../errors.js";
@@ -131,36 +135,29 @@ type ListedTool = Awaited<ReturnType<Client["listTools"]>>["tools"][number];
  * end-of-pagination as `null`. Only the cursor is widened; every tool and every
  * other result field still passes through the SDK's pinned schema.
  */
-const CompatibleListToolsResultSchema = ListToolsResultSchema.extend({
-  nextCursor: z.string().nullable().optional(),
-});
-
-/**
- * Re-prime an SDK client's tool-metadata cache from the *full* walked catalog.
- *
- * The SDK's `Client.listTools()` caches one page at a time and **clears** the
- * output-schema validators and task-support sets before each replacement.
- * This walk uses `Client.request()` so it can make the narrow null-cursor
- * compatibility concession above, then primes the metadata exactly once from
- * the complete chain. Otherwise `callTool` would find no validator or task
- * requirement for earlier-page tools and enforcement would depend on where a
- * tool happened to land, which is not enforcement.
- *
- * So hand the whole aggregated list back deliberately, once, at the end. The
- * SDK types the method `private`, hence the cast; the SDK version is pinned
- * exactly and `test/remote-mcp-pagination.test.ts` asserts the method still
- * exists, so a bump that renames it fails CI rather than quietly restoring the
- * bug.
- */
-function primeToolMetadata(client: Client, tools: ListedTool[]): void {
-  const prime = (
-    client as unknown as {
-      cacheToolMetadata?: (tools: ListedTool[]) => void;
-    }
-  ).cacheToolMetadata;
-  if (typeof prime !== "function") return;
-  prime.call(client, tools);
-}
+const CompatibleListToolsResultSchema: StandardSchemaV1<
+  unknown,
+  ListToolsResult
+> = {
+  "~standard": {
+    version: 1,
+    vendor: "connecta",
+    validate(value) {
+      const normalized =
+        typeof value === "object" &&
+        value !== null &&
+        "nextCursor" in value &&
+        value.nextCursor === null
+          ? (() => {
+              const copy = { ...value };
+              delete copy.nextCursor;
+              return copy;
+            })()
+          : value;
+      return specTypeSchemas.ListToolsResult["~standard"].validate(normalized);
+    },
+  },
+};
 
 /**
  * True for a result-parse failure caused by the page's `nextCursor` itself.
@@ -171,13 +168,18 @@ function primeToolMetadata(client: Client, tools: ListedTool[]): void {
  */
 function isCursorShapeError(err: unknown): boolean {
   const issues = (err as { issues?: unknown } | null)?.issues;
-  return (
+  if (
     Array.isArray(issues) &&
     issues.some((issue) => {
       const path = (issue as { path?: unknown }).path;
       return Array.isArray(path) && path[0] === "nextCursor";
     })
-  );
+  ) {
+    return true;
+  }
+  // SDK v2 wraps Standard Schema failures in a ProtocolError and preserves the
+  // failing path in the message rather than exposing the validator's issues.
+  return msg(err).startsWith("Invalid result for tools/list: nextCursor:");
 }
 
 function msg(err: unknown): string {
@@ -393,6 +395,14 @@ export function redirectSafeFetch(
 interface ConnectionState {
   client: Client | null;
   transport: Transport | null;
+  /**
+   * The last complete raw catalog, retained only for this request scope.
+   *
+   * SDK v2 exposes `toolDefinition` as the public call-time seam for output
+   * validation and header mirroring, replacing the v1 private
+   * `cacheToolMetadata` reach-through.
+   */
+  toolDefinitions: Map<string, Tool>;
   connecting: Promise<void> | null;
   authRequired: boolean;
   provider: KvOAuthProvider | null;
@@ -511,6 +521,7 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
       state = {
         client: null,
         transport: null,
+        toolDefinitions: new Map(),
         connecting: null,
         authRequired: false,
         provider: null,
@@ -549,29 +560,23 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
     const url = new URL(opts.url);
     const guardedFetch = redirectSafeFetch(id, opts.redirects);
     if (opts.auth?.type === "oauth") {
-      // The SDK class declares `sessionId` as an own `string | undefined`
-      // property while its Transport interface declares it optional. They are
-      // runtime-compatible; exact optional types only exposes that declaration
-      // mismatch at this boundary.
       return new StreamableHTTPClientTransport(url, {
         authProvider: provider ?? newProvider(ctx),
         fetch: guardedFetch,
-      }) as unknown as Transport;
+      });
     }
     const headers =
       opts.auth?.type === "headers" ? opts.auth.headers : undefined;
-    return new StreamableHTTPClientTransport(
-      url,
-      {
-        ...(headers ? { requestInit: { headers } } : {}),
-        fetch: guardedFetch,
-      },
-    ) as unknown as Transport;
+    return new StreamableHTTPClientTransport(url, {
+      ...(headers ? { requestInit: { headers } } : {}),
+      fetch: guardedFetch,
+    });
   };
 
   const reset = (state: ConnectionState) => {
     state.client = null;
     state.transport = null;
+    state.toolDefinitions.clear();
     state.connecting = null;
     state.authRequired = false;
     state.provider = null;
@@ -652,13 +657,17 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
           throw operatorDisconnectedError();
         }
         provider?.captureGeneration(genAtStart);
-        // The SDK defaults to AJV, which compiles every advertised outputSchema
-        // with `new Function`. Cloudflare Workers prohibit dynamic code
-        // generation, so a remote such as Stripe fails during tools/list unless
-        // the SDK's edge-safe validator is selected explicitly.
+        // SDK v2 selects its validator by runtime export condition: AJV on
+        // Node and @cfworker/json-schema under workerd. The Workers-safe path
+        // no longer needs Connecta-specific wiring.
         const c = new Client(
           { name: "connecta", version: CONNECTA_VERSION },
-          { jsonSchemaValidator: new CfWorkerJsonSchemaValidator() },
+          {
+            versionNegotiation: { mode: "auto" },
+            // Connecta has no interactive relay. Surface the result manually
+            // below as one structured, non-retryable connector failure.
+            inputRequired: { autoFulfill: false },
+          },
         );
         const t = buildTransport(ctx, provider);
         if (!ownsAttempt()) await abandon(t);
@@ -871,9 +880,9 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
           `Connector "${id}" kept advertising more tools/list pages after ${MAX_TOOL_PAGES} — refusing to page further.`,
         );
       }
-      // Repair what the per-page listTools calls left behind before any of
-      // these tools can be called. See primeToolMetadata.
-      primeToolMetadata(client, listed);
+      // Publish definitions only after the full walk succeeds. A later-page
+      // failure must not leave a partial validation/header view behind.
+      state.toolDefinitions = new Map(listed.map((tool) => [tool.name, tool]));
       return listed.map((t) => ({
         name: t.name,
         ...(t.description !== undefined ? { description: t.description } : {}),
@@ -906,14 +915,32 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
       await ensureConnected(ctx, state);
       const client = state.client!;
       try {
-        return await client.callTool(
+        const toolDefinition = state.toolDefinitions.get(name);
+        if (toolDefinition?.execution?.taskSupport === "required") {
+          throw new Error(
+            `Tool "${name}" requires task-based execution, which Connecta does not support.`,
+          );
+        }
+        const result = await client.callTool(
           {
             name,
             arguments: (args ?? {}) as Record<string, unknown>,
           },
-          undefined,
-          requestOptions(ctx),
+          {
+            ...requestOptions(ctx),
+            allowInputRequired: true,
+            ...(toolDefinition ? { toolDefinition } : {}),
+          },
         );
+        if (isInputRequiredResult(result)) {
+          throw new ConnectorCallError(
+            "input_required_unsupported",
+            `Connector "${id}" returned input_required for "${name}". ` +
+              "Connecta cannot relay multi-round-trip input yet; this " +
+              "capability is gated pending real host and downstream adoption.",
+          );
+        }
+        return result;
       } catch (err) {
         // A grant revoked after connect surfaces here, not in ensureConnected.
         if (err instanceof UnauthorizedError) {
@@ -939,6 +966,7 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
       const transport = state.transport;
       state.client = null;
       state.transport = null;
+      state.toolDefinitions.clear();
       state.connecting = null;
       state.authRequired = false;
       state.connectedGeneration = null;
@@ -979,7 +1007,7 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
       }
     },
 
-    async finishAuth(code, ctx) {
+    async finishAuth(code, ctx, callbackParams) {
       const state = stateFor(ctx);
       const provider = getProvider(ctx, state);
       // verifyState ran on this request-scoped provider first and captured the
@@ -987,7 +1015,11 @@ export function remoteMcp(id: string, opts: RemoteMcpOptions): Connector {
       // token write remains tagged with that older generation and is unreadable.
       const t = (state.transport ??
         buildTransport(ctx, provider)) as StreamableHTTPClientTransport;
-      await t.finishAuth(code);
+      if (callbackParams !== undefined) {
+        await t.finishAuth(callbackParams);
+      } else {
+        await t.finishAuth(code);
+      }
       await provider.clearPending();
       // Reset so the next use reconnects with the freshly stored tokens.
       reset(state);