fastmcp 4.12.8 → 4.13.1

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkU36NARZGcjs = require('./chunk-U36NARZG.cjs');
+var _chunkO72VCMGVcjs = require('./chunk-O72VCMGV.cjs');
 
 
 
@@ -24,7 +24,7 @@ var _chunkU36NARZGcjs = require('./chunk-U36NARZG.cjs');
 
 
 
-var _chunkKMG3C24Zcjs = require('./chunk-KMG3C24Z.cjs');
+var _chunk5FVNY65Mcjs = require('./chunk-5FVNY65M.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkKMG3C24Zcjs = require('./chunk-KMG3C24Z.cjs');
 
 
 
-exports.AuthProvider = _chunkKMG3C24Zcjs.AuthProvider; exports.AzureProvider = _chunkKMG3C24Zcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunkKMG3C24Zcjs.GitHubProvider; exports.GoogleProvider = _chunkKMG3C24Zcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkKMG3C24Zcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunkKMG3C24Zcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunkKMG3C24Zcjs.requireAll; exports.requireAny = _chunkKMG3C24Zcjs.requireAny; exports.requireAuth = _chunkKMG3C24Zcjs.requireAuth; exports.requireRole = _chunkKMG3C24Zcjs.requireRole; exports.requireScopes = _chunkKMG3C24Zcjs.requireScopes;
+exports.AuthProvider = _chunk5FVNY65Mcjs.AuthProvider; exports.AzureProvider = _chunk5FVNY65Mcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkO72VCMGVcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkO72VCMGVcjs.FastMCP; exports.FastMCPError = _chunkO72VCMGVcjs.FastMCPError; exports.FastMCPSession = _chunkO72VCMGVcjs.FastMCPSession; exports.GitHubProvider = _chunk5FVNY65Mcjs.GitHubProvider; exports.GoogleProvider = _chunk5FVNY65Mcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkO72VCMGVcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunk5FVNY65Mcjs.OAuthProvider; exports.ServerState = _chunkO72VCMGVcjs.ServerState; exports.SessionError = _chunkO72VCMGVcjs.SessionError; exports.UnexpectedStateError = _chunkO72VCMGVcjs.UnexpectedStateError; exports.UserError = _chunkO72VCMGVcjs.UserError; exports.audioContent = _chunkO72VCMGVcjs.audioContent; exports.getAuthSession = _chunk5FVNY65Mcjs.getAuthSession; exports.imageContent = _chunkO72VCMGVcjs.imageContent; exports.jsonSchemaAdapter = _chunkO72VCMGVcjs.jsonSchemaAdapter; exports.requireAll = _chunk5FVNY65Mcjs.requireAll; exports.requireAny = _chunk5FVNY65Mcjs.requireAny; exports.requireAuth = _chunk5FVNY65Mcjs.requireAuth; exports.requireRole = _chunk5FVNY65Mcjs.requireRole; exports.requireScopes = _chunk5FVNY65Mcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-zVRjvkf8.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-zVRjvkf8.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Bvt5a7yr.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Bvt5a7yr.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {
@@ -822,7 +822,12 @@ interface RouteOptions {
      */
     public?: boolean;
 }
-type Authenticate<T> = (request: http.IncomingMessage) => Promise<T>;
+/**
+ * Returning a nullish value signals that authentication failed; FastMCP turns
+ * it into a 401 rather than creating a session. This is what the built-in
+ * OAuth `AuthProvider` does for a missing or invalid bearer token.
+ */
+type Authenticate<T> = (request: http.IncomingMessage) => Promise<null | T | undefined>;
 type FastMCPSessionAuth = Record<string, unknown> | undefined;
 declare class FastMCPSessionEventEmitter extends FastMCPSessionEventEmitterBase {
 }

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-zVRjvkf8.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-zVRjvkf8.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Bvt5a7yr.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Bvt5a7yr.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {
@@ -822,7 +822,12 @@ interface RouteOptions {
      */
     public?: boolean;
 }
-type Authenticate<T> = (request: http.IncomingMessage) => Promise<T>;
+/**
+ * Returning a nullish value signals that authentication failed; FastMCP turns
+ * it into a 401 rather than creating a session. This is what the built-in
+ * OAuth `AuthProvider` does for a missing or invalid bearer token.
+ */
+type Authenticate<T> = (request: http.IncomingMessage) => Promise<null | T | undefined>;
 type FastMCPSessionAuth = Record<string, unknown> | undefined;
 declare class FastMCPSessionEventEmitter extends FastMCPSessionEventEmitterBase {
 }

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-HIIPZVNY.js";
+} from "./chunk-3BMGHXXY.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-Y7GSHCYB.js";
+} from "./chunk-ZOG7IPIX.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-zVRjvkf8.d.cts → OAuthProvider-Bvt5a7yr.d.cts}

@@ -205,6 +205,22 @@ interface OAuthProxyConfig {
      * https URLs enables CWE-601 open-redirect / authorization-code theft.
      */
     allowedRedirectUriPatterns?: string[];
+    /**
+     * Accept `code_challenge_method=plain` at /oauth/authorize (default: true).
+     *
+     * `plain` is the weaker PKCE mode by RFC 7636 §7.2: the challenge *is* the
+     * verifier, so anyone who observes the authorization request — a proxy, a
+     * server log, browser history — can replay a stolen authorization code. S256
+     * sends only a hash and has no such exposure. OAuth 2.1 §7.5.2 and the MCP
+     * authorization spec both require S256.
+     *
+     * Set to `false` to refuse `plain`: it is dropped from
+     * `codeChallengeMethodsSupported` in the discovery metadata, rejected with
+     * `invalid_request` at /oauth/authorize, and any code already issued under it
+     * is refused at /oauth/token. Recommended for new deployments; it stays on by
+     * default because turning it off breaks clients that still ask for `plain`.
+     */
+    allowPlainPkce?: boolean;
     /** Authorization code TTL in seconds (default: 300) */
     authorizationCodeTtl?: number;
     /** Base URL of this proxy server */

package/dist/{OAuthProvider-zVRjvkf8.d.ts → OAuthProvider-Bvt5a7yr.d.ts}

@@ -205,6 +205,22 @@ interface OAuthProxyConfig {
      * https URLs enables CWE-601 open-redirect / authorization-code theft.
      */
     allowedRedirectUriPatterns?: string[];
+    /**
+     * Accept `code_challenge_method=plain` at /oauth/authorize (default: true).
+     *
+     * `plain` is the weaker PKCE mode by RFC 7636 §7.2: the challenge *is* the
+     * verifier, so anyone who observes the authorization request — a proxy, a
+     * server log, browser history — can replay a stolen authorization code. S256
+     * sends only a hash and has no such exposure. OAuth 2.1 §7.5.2 and the MCP
+     * authorization spec both require S256.
+     *
+     * Set to `false` to refuse `plain`: it is dropped from
+     * `codeChallengeMethodsSupported` in the discovery metadata, rejected with
+     * `invalid_request` at /oauth/authorize, and any code already issued under it
+     * is refused at /oauth/token. Recommended for new deployments; it stays on by
+     * default because turning it off breaks clients that still ask for `plain`.
+     */
+    allowPlainPkce?: boolean;
     /** Authorization code TTL in seconds (default: 300) */
     authorizationCodeTtl?: number;
     /** Base URL of this proxy server */

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkKMG3C24Zcjs = require('../chunk-KMG3C24Z.cjs');
+var _chunk5FVNY65Mcjs = require('../chunk-5FVNY65M.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkKMG3C24Zcjs = require('../chunk-KMG3C24Z.cjs');
 
 
 
-exports.AuthProvider = _chunkKMG3C24Zcjs.AuthProvider; exports.AzureProvider = _chunkKMG3C24Zcjs.AzureProvider; exports.ConsentManager = _chunkKMG3C24Zcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkKMG3C24Zcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkKMG3C24Zcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkKMG3C24Zcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkKMG3C24Zcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkKMG3C24Zcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkKMG3C24Zcjs.DiskStore; exports.EncryptedTokenStorage = _chunkKMG3C24Zcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkKMG3C24Zcjs.GitHubProvider; exports.GoogleProvider = _chunkKMG3C24Zcjs.GoogleProvider; exports.JWKSVerifier = _chunkKMG3C24Zcjs.JWKSVerifier; exports.JWTIssuer = _chunkKMG3C24Zcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkKMG3C24Zcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkKMG3C24Zcjs.OAuthProvider; exports.OAuthProxy = _chunkKMG3C24Zcjs.OAuthProxy; exports.OAuthProxyError = _chunkKMG3C24Zcjs.OAuthProxyError; exports.PKCEUtils = _chunkKMG3C24Zcjs.PKCEUtils; exports.getAuthSession = _chunkKMG3C24Zcjs.getAuthSession; exports.requireAll = _chunkKMG3C24Zcjs.requireAll; exports.requireAny = _chunkKMG3C24Zcjs.requireAny; exports.requireAuth = _chunkKMG3C24Zcjs.requireAuth; exports.requireRole = _chunkKMG3C24Zcjs.requireRole; exports.requireScopes = _chunkKMG3C24Zcjs.requireScopes;
+exports.AuthProvider = _chunk5FVNY65Mcjs.AuthProvider; exports.AzureProvider = _chunk5FVNY65Mcjs.AzureProvider; exports.ConsentManager = _chunk5FVNY65Mcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunk5FVNY65Mcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunk5FVNY65Mcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunk5FVNY65Mcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunk5FVNY65Mcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunk5FVNY65Mcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunk5FVNY65Mcjs.DiskStore; exports.EncryptedTokenStorage = _chunk5FVNY65Mcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunk5FVNY65Mcjs.GitHubProvider; exports.GoogleProvider = _chunk5FVNY65Mcjs.GoogleProvider; exports.JWKSVerifier = _chunk5FVNY65Mcjs.JWKSVerifier; exports.JWTIssuer = _chunk5FVNY65Mcjs.JWTIssuer; exports.MemoryTokenStorage = _chunk5FVNY65Mcjs.MemoryTokenStorage; exports.OAuthProvider = _chunk5FVNY65Mcjs.OAuthProvider; exports.OAuthProxy = _chunk5FVNY65Mcjs.OAuthProxy; exports.OAuthProxyError = _chunk5FVNY65Mcjs.OAuthProxyError; exports.PKCEUtils = _chunk5FVNY65Mcjs.PKCEUtils; exports.getAuthSession = _chunk5FVNY65Mcjs.getAuthSession; exports.requireAll = _chunk5FVNY65Mcjs.requireAll; exports.requireAny = _chunk5FVNY65Mcjs.requireAny; exports.requireAuth = _chunk5FVNY65Mcjs.requireAuth; exports.requireRole = _chunk5FVNY65Mcjs.requireRole; exports.requireScopes = _chunk5FVNY65Mcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-zVRjvkf8.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-zVRjvkf8.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Bvt5a7yr.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Bvt5a7yr.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-zVRjvkf8.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-zVRjvkf8.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Bvt5a7yr.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Bvt5a7yr.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-Y7GSHCYB.js";
+} from "../chunk-ZOG7IPIX.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-HIIPZVNY.js → chunk-3BMGHXXY.js}

@@ -1844,7 +1844,7 @@ var FastMCP = class extends FastMCPEventEmitter {
         try {
           auth = await this.#authenticate(
             void 0
-          );
+          ) ?? void 0;
         } catch (error) {
           this.#logger.error(
             "[FastMCP error] Authentication failed for stdio transport:",
@@ -1922,12 +1922,9 @@ var FastMCP = class extends FastMCPEventEmitter {
           createServer: async (request) => {
             let auth;
             if (this.#authenticate) {
-              auth = await this.#authenticate(request);
-              if (auth === void 0 || auth === null) {
-                throw this.#createUnauthorizedResponse(
-                  "Authentication required"
-                );
-              }
+              auth = this.#requireAuthenticated(
+                await this.#authenticate(request)
+              );
             }
             const sessionId = Array.isArray(request.headers["mcp-session-id"]) ? request.headers["mcp-session-id"][0] : request.headers["mcp-session-id"];
             return this.#createSession(auth, sessionId, true);
@@ -1974,7 +1971,9 @@ var FastMCP = class extends FastMCPEventEmitter {
           createServer: async (request) => {
             let auth;
             if (this.#authenticate) {
-              auth = await this.#authenticate(request);
+              auth = this.#requireAuthenticated(
+                await this.#authenticate(request)
+              );
             }
             const sessionId = Array.isArray(request.headers["mcp-session-id"]) ? request.headers["mcp-session-id"][0] : request.headers["mcp-session-id"];
             return this.#createSession(auth, sessionId);
@@ -2615,6 +2614,28 @@ var FastMCP = class extends FastMCPEventEmitter {
       });
     }
   }
+  /**
+   * Rejects a failed authentication result before it can become a session.
+   *
+   * Authentication is REQUIRED whenever an `authenticate` function is
+   * configured. mcp-proxy gates the HTTP Stream endpoint before `createServer`
+   * runs, but it does not gate the SSE endpoint it serves at `/sse` by default:
+   * `handleSSERequest` never receives `authenticate`. Throwing here is what
+   * stops `/sse` from handing out a session — with access to every tool, since
+   * `#createSession` skips `canAccess` filtering when `auth` is falsy — to a
+   * client that `/mcp` would have answered with a 401.
+   *
+   * The falsy test matches mcp-proxy's own check so that both endpoints agree
+   * on what counts as a failed authentication. Returning a nullish value is the
+   * idiomatic way to signal failure, and is what the built-in OAuth
+   * `AuthProvider` does for a missing or invalid bearer token.
+   */
+  #requireAuthenticated(auth) {
+    if (!auth) {
+      throw this.#createUnauthorizedResponse("Authentication required");
+    }
+    return auth;
+  }
   /**
    * Notifies all sessions that the resources list has changed.
    */
@@ -2655,4 +2676,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-HIIPZVNY.js.map
+//# sourceMappingURL=chunk-3BMGHXXY.js.map