librechat-data-provider 0.8.502 → 0.8.504

package/dist/types/mcp.d.ts

@@ -34,21 +34,21 @@ export declare const StdioOptionsSchema: z.ZodObject<{
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -61,8 +61,45 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -78,6 +115,8 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -93,6 +132,42 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -113,12 +188,12 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -126,15 +201,24 @@ export declare const StdioOptionsSchema: z.ZodObject<{
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodDefault<z.ZodLiteral<"stdio">>;
+    obo: z.ZodOptional<z.ZodUndefined>;
     /**
      * The executable to run to start the server.
      */
@@ -160,14 +244,15 @@ export declare const StdioOptionsSchema: z.ZodObject<{
     type: "stdio";
     command: string;
     args: string[];
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
+    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -183,34 +268,38 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
-    env?: Record<string, string> | undefined;
+    obo?: undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
 }, {
     command: string;
     args: string[];
-    title?: string | undefined;
+    type?: "stdio" | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
+    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
-    type?: "stdio" | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -226,21 +315,24 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
-    env?: Record<string, string> | undefined;
+    obo?: undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
 }>;
 export declare const WebSocketOptionsSchema: z.ZodObject<{
@@ -277,21 +369,21 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -304,8 +396,45 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -321,6 +450,42 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -336,6 +501,8 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -356,12 +523,12 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -369,27 +536,36 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodDefault<z.ZodLiteral<"websocket">>;
+    obo: z.ZodOptional<z.ZodUndefined>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, "strip", z.ZodTypeAny, {
     type: "websocket";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -405,31 +581,35 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: undefined;
 }, {
     url: string;
-    title?: string | undefined;
+    type?: "websocket" | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
-    type?: "websocket" | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -445,20 +625,24 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: undefined;
 }>;
 export declare const SSEOptionsSchema: z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
@@ -494,21 +678,21 @@ export declare const SSEOptionsSchema: z.ZodObject<{
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -521,8 +705,45 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -538,6 +759,42 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -553,6 +810,8 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -573,12 +832,12 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -586,28 +845,53 @@ export declare const SSEOptionsSchema: z.ZodObject<{
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodDefault<z.ZodLiteral<"sse">>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * On-Behalf-Of (OBO) token exchange configuration.
+     * When configured, LibreChat exchanges the logged-in user's federated access token
+     * for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
+     * The exchanged token is injected as a Bearer Authorization header automatically.
+     * Requires the user to be authenticated via OpenID Connect (e.g., Entra ID).
+     */
+    obo: z.ZodOptional<z.ZodObject<{
+        /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
+        scopes: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        scopes: string;
+    }, {
+        scopes: string;
+    }>>;
+    /** Optional outbound proxy URL for this remote MCP transport */
+    proxy: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, "strip", z.ZodTypeAny, {
     type: "sse";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -623,32 +907,39 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }, {
     url: string;
-    title?: string | undefined;
+    type?: "sse" | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
-    type?: "sse" | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -664,21 +955,28 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }>;
 export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
@@ -714,21 +1012,21 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -741,8 +1039,45 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -758,6 +1093,42 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -773,6 +1144,8 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -793,12 +1166,12 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -806,28 +1179,53 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodUnion<[z.ZodLiteral<"streamable-http">, z.ZodLiteral<"http">]>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * On-Behalf-Of (OBO) token exchange configuration.
+     * When configured, LibreChat exchanges the logged-in user's federated access token
+     * for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
+     * The exchanged token is injected as a Bearer Authorization header automatically.
+     * Requires the user to be authenticated via OpenID Connect (e.g., Entra ID).
+     */
+    obo: z.ZodOptional<z.ZodObject<{
+        /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
+        scopes: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        scopes: string;
+    }, {
+        scopes: string;
+    }>>;
+    /** Optional outbound proxy URL for this remote MCP transport */
+    proxy: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, "strip", z.ZodTypeAny, {
     type: "streamable-http" | "http";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -843,32 +1241,39 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }, {
     type: "streamable-http" | "http";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -884,21 +1289,28 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }>;
 export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
@@ -934,21 +1346,21 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -961,8 +1373,45 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -978,6 +1427,42 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -993,6 +1478,8 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -1013,12 +1500,12 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -1026,15 +1513,24 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodDefault<z.ZodLiteral<"stdio">>;
+    obo: z.ZodOptional<z.ZodUndefined>;
     /**
      * The executable to run to start the server.
      */
@@ -1060,14 +1556,15 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     type: "stdio";
     command: string;
     args: string[];
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
+    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1083,34 +1580,38 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
-    env?: Record<string, string> | undefined;
+    obo?: undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
 }, {
     command: string;
     args: string[];
-    title?: string | undefined;
+    type?: "stdio" | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
+    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
-    type?: "stdio" | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1126,21 +1627,24 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
-    env?: Record<string, string> | undefined;
+    obo?: undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
 }>, z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
@@ -1176,21 +1680,21 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -1203,8 +1707,45 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -1220,6 +1761,8 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1235,9 +1778,45 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
-    }>>;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>>;
     /** Custom headers to send with OAuth requests (registration, discovery, token exchange, etc.) */
     oauth_headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     /**
@@ -1255,12 +1834,12 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -1268,27 +1847,36 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodDefault<z.ZodLiteral<"websocket">>;
+    obo: z.ZodOptional<z.ZodUndefined>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, "strip", z.ZodTypeAny, {
     type: "websocket";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1304,31 +1892,35 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: undefined;
 }, {
     url: string;
-    title?: string | undefined;
+    type?: "websocket" | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
-    type?: "websocket" | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1344,20 +1936,24 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: undefined;
 }>, z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
     title: z.ZodOptional<z.ZodString>;
@@ -1392,21 +1988,21 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -1419,8 +2015,45 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -1436,6 +2069,42 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1451,6 +2120,8 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -1471,12 +2142,12 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -1484,28 +2155,53 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodDefault<z.ZodLiteral<"sse">>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * On-Behalf-Of (OBO) token exchange configuration.
+     * When configured, LibreChat exchanges the logged-in user's federated access token
+     * for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
+     * The exchanged token is injected as a Bearer Authorization header automatically.
+     * Requires the user to be authenticated via OpenID Connect (e.g., Entra ID).
+     */
+    obo: z.ZodOptional<z.ZodObject<{
+        /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
+        scopes: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        scopes: string;
+    }, {
+        scopes: string;
+    }>>;
+    /** Optional outbound proxy URL for this remote MCP transport */
+    proxy: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, "strip", z.ZodTypeAny, {
     type: "sse";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1521,32 +2217,39 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }, {
     url: string;
-    title?: string | undefined;
+    type?: "sse" | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
-    type?: "sse" | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1562,21 +2265,28 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }>, z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
     title: z.ZodOptional<z.ZodString>;
@@ -1611,21 +2321,21 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -1638,8 +2348,45 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -1655,6 +2402,42 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1670,6 +2453,8 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -1690,12 +2475,12 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -1703,28 +2488,53 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodUnion<[z.ZodLiteral<"streamable-http">, z.ZodLiteral<"http">]>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * On-Behalf-Of (OBO) token exchange configuration.
+     * When configured, LibreChat exchanges the logged-in user's federated access token
+     * for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
+     * The exchanged token is injected as a Bearer Authorization header automatically.
+     * Requires the user to be authenticated via OpenID Connect (e.g., Entra ID).
+     */
+    obo: z.ZodOptional<z.ZodObject<{
+        /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
+        scopes: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        scopes: string;
+    }, {
+        scopes: string;
+    }>>;
+    /** Optional outbound proxy URL for this remote MCP transport */
+    proxy: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, "strip", z.ZodTypeAny, {
     type: "streamable-http" | "http";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1740,32 +2550,39 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }, {
     type: "streamable-http" | "http";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1781,21 +2598,28 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }>]>;
 export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
@@ -1831,21 +2655,21 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -1858,8 +2682,45 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -1875,6 +2736,42 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1890,6 +2787,8 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -1910,12 +2809,12 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -1923,15 +2822,24 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodDefault<z.ZodLiteral<"stdio">>;
+    obo: z.ZodOptional<z.ZodUndefined>;
     /**
      * The executable to run to start the server.
      */
@@ -1957,14 +2865,15 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     type: "stdio";
     command: string;
     args: string[];
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
+    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1980,34 +2889,38 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
-    env?: Record<string, string> | undefined;
+    obo?: undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
 }, {
     command: string;
     args: string[];
-    title?: string | undefined;
+    type?: "stdio" | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
+    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
-    type?: "stdio" | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2023,21 +2936,24 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
-    env?: Record<string, string> | undefined;
+    obo?: undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
 }>, z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
@@ -2073,21 +2989,21 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -2100,8 +3016,45 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -2117,6 +3070,42 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -2132,6 +3121,8 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -2152,12 +3143,12 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -2165,27 +3156,36 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodDefault<z.ZodLiteral<"websocket">>;
+    obo: z.ZodOptional<z.ZodUndefined>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, "strip", z.ZodTypeAny, {
     type: "websocket";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2201,31 +3201,35 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: undefined;
 }, {
     url: string;
-    title?: string | undefined;
+    type?: "websocket" | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
-    type?: "websocket" | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2241,20 +3245,24 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: undefined;
 }>, z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
     title: z.ZodOptional<z.ZodString>;
@@ -2289,21 +3297,21 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -2316,8 +3324,45 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -2333,6 +3378,8 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -2348,12 +3395,48 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
-    }>>;
-    /** Custom headers to send with OAuth requests (registration, discovery, token exchange, etc.) */
-    oauth_headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    /**
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>>;
+    /** Custom headers to send with OAuth requests (registration, discovery, token exchange, etc.) */
+    oauth_headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
      * API Key authentication configuration for SSE and Streamable HTTP transports
      * - source: 'admin' means the key is provided by admin and shared by all users
      * - source: 'user' means each user provides their own key via customUserVars
@@ -2368,12 +3451,12 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -2381,28 +3464,53 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodDefault<z.ZodLiteral<"sse">>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * On-Behalf-Of (OBO) token exchange configuration.
+     * When configured, LibreChat exchanges the logged-in user's federated access token
+     * for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
+     * The exchanged token is injected as a Bearer Authorization header automatically.
+     * Requires the user to be authenticated via OpenID Connect (e.g., Entra ID).
+     */
+    obo: z.ZodOptional<z.ZodObject<{
+        /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
+        scopes: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        scopes: string;
+    }, {
+        scopes: string;
+    }>>;
+    /** Optional outbound proxy URL for this remote MCP transport */
+    proxy: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, "strip", z.ZodTypeAny, {
     type: "sse";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2418,32 +3526,39 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }, {
     url: string;
-    title?: string | undefined;
+    type?: "sse" | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
-    type?: "sse" | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2459,21 +3574,28 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }>, z.ZodObject<{
     /** Display name for the MCP server - only letters, numbers, and spaces allowed */
     title: z.ZodOptional<z.ZodString>;
@@ -2508,21 +3630,21 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     /**
      * OAuth configuration for SSE and Streamable HTTP transports
      * - Optional: OAuth can be auto-discovered on 401 responses
-     * - Pre-configured values will skip discovery steps
+     * - Pre-configured confidential clients must pin both OAuth endpoints
      */
-    oauth: z.ZodOptional<z.ZodObject<{
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         /** OAuth authorization endpoint (optional - can be auto-discovered) */
-        authorization_url: z.ZodOptional<z.ZodString>;
+        authorization_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth token endpoint (optional - can be auto-discovered) */
-        token_url: z.ZodOptional<z.ZodString>;
+        token_url: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth client ID (optional - can use dynamic registration) */
         client_id: z.ZodOptional<z.ZodString>;
-        /** OAuth client secret (optional - can use dynamic registration) */
+        /** OAuth client secret (requires explicit authorization and token endpoints) */
         client_secret: z.ZodOptional<z.ZodString>;
         /** OAuth scopes to request */
         scope: z.ZodOptional<z.ZodString>;
         /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-        redirect_uri: z.ZodOptional<z.ZodString>;
+        redirect_uri: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** Token exchange method */
         token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
         /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -2535,8 +3657,45 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Skip code challenge validation and force S256 (useful for providers like AWS Cognito that support S256 but don't advertise it) */
         skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Auth0/Cognito-style `audience` parameter. Authorization servers that pre-date
+         * RFC 8707 — most prominently Auth0 — issue API-scoped access tokens only when
+         * the `/authorize` request advertises an `audience`. RFC 8707 `resource` (set
+         * automatically from Protected Resource Metadata) is the standards-conformant
+         * route; `audience` covers the providers that ignore it.
+         *
+         * When set, the value is forwarded as-is on `/authorize` (both pre-configured
+         * and DCR-discovered paths). Whether it is also forwarded on the
+         * `refresh_token` grant is controlled by `forward_audience_on_refresh` below.
+         *
+         * The `authorization_code` exchange intentionally never receives `audience` —
+         * Auth0 binds audience from the original `/authorize` request and embeds it
+         * in the issued access token; sending it again is redundant.
+         *
+         * No canonicalization is applied — the audience identifier is provider-defined
+         * and may differ from the MCP server URL. This field is only accepted from
+         * trusted/admin MCP configuration and is rejected from user-managed servers.
+         */
+        audience: z.ZodOptional<z.ZodString>;
+        /**
+         * Whether to also forward `audience` on the `refresh_token` grant body.
+         *
+         * Default: `true`. Required for Auth0, which strips the API audience from
+         * refreshed access tokens unless `audience` is re-supplied on every refresh
+         * — without it the next MCP call 401s once the initial access token expires.
+         *
+         * Set to `false` for providers that document refresh requests as
+         * `grant_type` + `client_id` + `refresh_token` only (Cognito and other
+         * strict OAuth 2.0 token endpoints). Those providers maintain the original
+         * `aud` claim across refreshes when the initial token was resource-bound,
+         * so the extra parameter is redundant and may be rejected as
+         * `invalid_request`.
+         *
+         * Ignored when `audience` itself is not configured.
+         */
+        forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
-        revocation_endpoint: z.ZodOptional<z.ZodString>;
+        revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
         revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -2552,6 +3711,42 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -2567,6 +3762,8 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -2587,12 +3784,12 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         /** Custom header name when authorization_type is 'custom' */
         custom_header: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     }, {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
@@ -2600,28 +3797,53 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     customUserVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         title: z.ZodString;
         description: z.ZodString;
+        /**
+         * Whether the field holds a secret and should be masked in the UI.
+         * Defaults to masked when omitted; set to `false` for non-secret setup
+         * values (e.g. username, project key, base URL) to render as plain text.
+         */
+        sensitive: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        title: string;
         description: string;
-    }, {
         title: string;
+        sensitive?: boolean | undefined;
+    }, {
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }>>>;
 } & {
     type: z.ZodUnion<[z.ZodLiteral<"streamable-http">, z.ZodLiteral<"http">]>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * On-Behalf-Of (OBO) token exchange configuration.
+     * When configured, LibreChat exchanges the logged-in user's federated access token
+     * for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
+     * The exchanged token is injected as a Bearer Authorization header automatically.
+     * Requires the user to be authenticated via OpenID Connect (e.g., Entra ID).
+     */
+    obo: z.ZodOptional<z.ZodObject<{
+        /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
+        scopes: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        scopes: string;
+    }, {
+        scopes: string;
+    }>>;
+    /** Optional outbound proxy URL for this remote MCP transport */
+    proxy: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, "strip", z.ZodTypeAny, {
     type: "streamable-http" | "http";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2637,32 +3859,39 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }, {
     type: "streamable-http" | "http";
     url: string;
-    title?: string | undefined;
     description?: string | undefined;
+    title?: string | undefined;
+    chatMenu?: boolean | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
     timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
-    chatMenu?: boolean | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2678,27 +3907,35 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         response_types_supported?: string[] | undefined;
         code_challenge_methods_supported?: string[] | undefined;
         skip_code_challenge_check?: boolean | undefined;
+        audience?: string | undefined;
+        forward_audience_on_refresh?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
     oauth_headers?: Record<string, string> | undefined;
     apiKey?: {
-        source: "admin" | "user";
+        source: "user" | "admin";
         authorization_type: "custom" | "basic" | "bearer";
         key?: string | undefined;
         custom_header?: string | undefined;
     } | undefined;
     customUserVars?: Record<string, {
-        title: string;
         description: string;
+        title: string;
+        sensitive?: boolean | undefined;
     }> | undefined;
+    obo?: {
+        scopes: string;
+    } | undefined;
     headers?: Record<string, string> | undefined;
+    proxy?: string | undefined;
 }>]>>;
 export type MCPOptions = z.infer<typeof MCPOptionsSchema>;
 /**
  * MCP Server configuration that comes from UI/API input only.
  * Omits server-managed fields like startup, timeout, customUserVars, etc.
- * Allows: title, description, url, iconPath, oauth (user credentials)
+ * Allows: title, description, url, iconPath, oauth (user credentials).
+ * Admin-only OAuth audience fields are rejected for user-managed servers.
  *
  * SECURITY: Stdio transport is intentionally excluded from user input.
  * Stdio allows arbitrary command execution and should only be configured
@@ -2714,41 +3951,329 @@ export type MCPOptions = z.infer<typeof MCPOptionsSchema>;
 export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
     [x: string]: z.ZodTypeAny;
     [x: number]: z.ZodTypeAny;
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        client_id: z.ZodOptional<z.ZodString>;
+        client_secret: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+        token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
+        grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    } & {
+        authorization_url: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        token_url: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        redirect_uri: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        revocation_endpoint: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        audience: z.ZodOptional<z.ZodNever>;
+        forward_audience_on_refresh: z.ZodOptional<z.ZodNever>;
+    }, "strip", z.ZodTypeAny, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>>;
 } & {
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, z.UnknownKeysParam, z.ZodTypeAny, {
     [x: string]: any;
     [x: number]: any;
+    oauth?: unknown;
     url?: unknown;
 }, {
     [x: string]: any;
     [x: number]: any;
+    oauth?: unknown;
     url?: unknown;
 }>, z.ZodObject<{
     [x: string]: z.ZodTypeAny;
     [x: number]: z.ZodTypeAny;
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        client_id: z.ZodOptional<z.ZodString>;
+        client_secret: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+        token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
+        grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    } & {
+        authorization_url: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        token_url: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        redirect_uri: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        revocation_endpoint: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        audience: z.ZodOptional<z.ZodNever>;
+        forward_audience_on_refresh: z.ZodOptional<z.ZodNever>;
+    }, "strip", z.ZodTypeAny, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>>;
 } & {
+    proxy: z.ZodOptional<z.ZodNever>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, z.UnknownKeysParam, z.ZodTypeAny, {
     [x: string]: any;
     [x: number]: any;
+    oauth?: unknown;
+    proxy?: unknown;
     url?: unknown;
 }, {
     [x: string]: any;
     [x: number]: any;
+    oauth?: unknown;
+    proxy?: unknown;
     url?: unknown;
 }>, z.ZodObject<{
     [x: string]: z.ZodTypeAny;
     [x: number]: z.ZodTypeAny;
+    oauth: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        client_id: z.ZodOptional<z.ZodString>;
+        client_secret: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+        token_exchange_method: z.ZodOptional<z.ZodNativeEnum<typeof TokenExchangeMethodEnum>>;
+        grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        response_types_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        skip_code_challenge_check: z.ZodOptional<z.ZodBoolean>;
+        revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    } & {
+        authorization_url: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        token_url: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        redirect_uri: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        revocation_endpoint: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
+        audience: z.ZodOptional<z.ZodNever>;
+        forward_audience_on_refresh: z.ZodOptional<z.ZodNever>;
+    }, "strip", z.ZodTypeAny, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }, {
+        authorization_url?: string | undefined;
+        token_url?: string | undefined;
+        client_id?: string | undefined;
+        client_secret?: string | undefined;
+        scope?: string | undefined;
+        redirect_uri?: string | undefined;
+        token_exchange_method?: TokenExchangeMethodEnum | undefined;
+        grant_types_supported?: string[] | undefined;
+        token_endpoint_auth_methods_supported?: string[] | undefined;
+        response_types_supported?: string[] | undefined;
+        code_challenge_methods_supported?: string[] | undefined;
+        skip_code_challenge_check?: boolean | undefined;
+        audience?: undefined;
+        forward_audience_on_refresh?: undefined;
+        revocation_endpoint?: string | undefined;
+        revocation_endpoint_auth_methods_supported?: string[] | undefined;
+    }>>;
 } & {
+    proxy: z.ZodOptional<z.ZodNever>;
     url: z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>;
 }, z.UnknownKeysParam, z.ZodTypeAny, {
     [x: string]: any;
     [x: number]: any;
+    oauth?: unknown;
+    proxy?: unknown;
     url?: unknown;
 }, {
     [x: string]: any;
     [x: number]: any;
+    oauth?: unknown;
+    proxy?: unknown;
     url?: unknown;
 }>]>;
 export type MCPServerUserInput = z.infer<typeof MCPServerUserInputSchema>;
+/**
+ * Set of every field name that may appear in a user-submitted MCP server config,
+ * derived from `MCPServerUserInputSchema`'s union members. Used as the comparison
+ * surface for the OBO lockdown check in `updateMCPServerController` so that
+ * server-managed fields on the existing config (`dbId`, `source`, `author`,
+ * `requiresOAuth`, `oauthMetadata`, etc.) don't show up as differences and
+ * cause spurious 403s on legitimate saves.
+ *
+ * Schema-derived rather than hand-maintained: when a new field is added to
+ * `BaseOptionsSchema` or any transport variant, it flows into this set
+ * automatically. The OBO lockdown then locks the new field by default
+ * (since it won't be in the hand-curated `OBO_USER_EDITABLE_FIELDS`
+ * allowlist), preventing a silent privilege regression.
+ */
+export declare const MCP_USER_INPUT_FIELDS: ReadonlySet<string>;