librechat-data-provider 0.8.522 → 0.8.524

package/dist/types/mcp.d.ts

@@ -1,5 +1,13 @@
 import { z } from 'zod';
 import { TokenExchangeMethodEnum } from './types/agents';
+/**
+ * Upper bound on a stored MCP `iconPath` (URL or data URI). Enforced by
+ * `sanitizeMcpIconPath`, not a schema `.max()`, so re-submitting a server whose
+ * stored icon predates the cap clears the icon instead of rejecting the update.
+ */
+export declare const MAX_MCP_ICON_PATH_LENGTH: number;
+/** Keep persistence admission waits below the shared lease's 15-minute lifetime. */
+export declare const MAX_MCP_OAUTH_PERSISTENCE_WAIT_MS: number;
 export declare const MCP_SERVER_TITLE_PATTERN: RegExp;
 export declare const MCP_SERVER_TITLE_ERROR = "Title must start with a letter or number and can include spaces, hyphens, and apostrophes";
 export declare function isProcessMCPServerField(field: string): boolean;
@@ -22,6 +30,21 @@ export declare const StdioOptionsSchema: z.ZodObject<{
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -110,6 +133,27 @@ export declare const StdioOptionsSchema: z.ZodObject<{
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -129,6 +173,7 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -146,6 +191,7 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -163,6 +209,7 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -180,6 +227,7 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -264,12 +312,14 @@ export declare const StdioOptionsSchema: z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
-    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -287,6 +337,7 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -302,6 +353,7 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         title: string;
         sensitive?: boolean | undefined;
     }> | undefined;
+    env?: Record<string, string> | undefined;
     cwd?: string | undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
     obo?: undefined;
@@ -312,12 +364,14 @@ export declare const StdioOptionsSchema: z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
-    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -335,6 +389,7 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -350,6 +405,7 @@ export declare const StdioOptionsSchema: z.ZodObject<{
         title: string;
         sensitive?: boolean | undefined;
     }> | undefined;
+    env?: Record<string, string> | undefined;
     cwd?: string | undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
     obo?: undefined;
@@ -371,6 +427,21 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -459,6 +530,27 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -478,6 +570,7 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -495,6 +588,7 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -512,6 +606,7 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -529,6 +624,7 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -587,11 +683,14 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -609,6 +708,7 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -631,11 +731,14 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -653,6 +756,7 @@ export declare const WebSocketOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -687,6 +791,21 @@ export declare const SSEOptionsSchema: z.ZodObject<{
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -775,6 +894,27 @@ export declare const SSEOptionsSchema: z.ZodObject<{
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -794,6 +934,7 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -811,6 +952,7 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -828,6 +970,7 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -845,6 +988,7 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -896,6 +1040,13 @@ export declare const SSEOptionsSchema: z.ZodObject<{
 } & {
     type: z.ZodDefault<z.ZodLiteral<"sse">>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Headers resolved from the live chat request and merged over `headers`.
+     * Omitted during catalog discovery, which has no request context, so a
+     * `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+     * On a duplicate header name the resolved `requestHeaders` value wins.
+     */
+    requestHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     /**
      * On-Behalf-Of (OBO) token exchange configuration.
      * When configured, LibreChat exchanges the logged-in user's federated access token
@@ -920,11 +1071,14 @@ export declare const SSEOptionsSchema: z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -942,6 +1096,7 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -961,6 +1116,7 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }, {
     url: string;
@@ -968,11 +1124,14 @@ export declare const SSEOptionsSchema: z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -990,6 +1149,7 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -1009,6 +1169,7 @@ export declare const SSEOptionsSchema: z.ZodObject<{
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }>;
 export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
@@ -1028,6 +1189,21 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -1116,6 +1292,27 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -1135,6 +1332,7 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1152,6 +1350,7 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -1169,6 +1368,7 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1186,6 +1386,7 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -1237,6 +1438,13 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
 } & {
     type: z.ZodUnion<[z.ZodLiteral<"streamable-http">, z.ZodLiteral<"http">]>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Headers resolved from the live chat request and merged over `headers`.
+     * Omitted during catalog discovery, which has no request context, so a
+     * `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+     * On a duplicate header name the resolved `requestHeaders` value wins.
+     */
+    requestHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     /**
      * On-Behalf-Of (OBO) token exchange configuration.
      * When configured, LibreChat exchanges the logged-in user's federated access token
@@ -1261,11 +1469,14 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1283,6 +1494,7 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -1302,6 +1514,7 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }, {
     type: "streamable-http" | "http";
@@ -1309,11 +1522,14 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1331,6 +1547,7 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -1350,6 +1567,7 @@ export declare const StreamableHTTPOptionsSchema: z.ZodObject<{
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }>;
 export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
@@ -1369,6 +1587,21 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -1457,6 +1690,27 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -1476,6 +1730,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1493,6 +1748,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -1510,6 +1766,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1527,6 +1784,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -1611,12 +1869,14 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
-    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1634,6 +1894,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -1649,6 +1910,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         title: string;
         sensitive?: boolean | undefined;
     }> | undefined;
+    env?: Record<string, string> | undefined;
     cwd?: string | undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
     obo?: undefined;
@@ -1659,12 +1921,14 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
-    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1682,6 +1946,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -1697,6 +1962,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         title: string;
         sensitive?: boolean | undefined;
     }> | undefined;
+    env?: Record<string, string> | undefined;
     cwd?: string | undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
     obo?: undefined;
@@ -1717,6 +1983,21 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -1805,6 +2086,27 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -1824,6 +2126,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1841,6 +2144,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -1858,6 +2162,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -1875,6 +2180,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -1933,11 +2239,14 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1955,6 +2264,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -1977,11 +2287,14 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -1999,6 +2312,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -2032,6 +2346,21 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -2120,6 +2449,27 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -2139,6 +2489,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -2156,6 +2507,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -2173,6 +2525,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -2190,6 +2543,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -2241,6 +2595,13 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
 } & {
     type: z.ZodDefault<z.ZodLiteral<"sse">>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Headers resolved from the live chat request and merged over `headers`.
+     * Omitted during catalog discovery, which has no request context, so a
+     * `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+     * On a duplicate header name the resolved `requestHeaders` value wins.
+     */
+    requestHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     /**
      * On-Behalf-Of (OBO) token exchange configuration.
      * When configured, LibreChat exchanges the logged-in user's federated access token
@@ -2265,11 +2626,14 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2287,6 +2651,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -2306,6 +2671,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }, {
     url: string;
@@ -2313,11 +2679,14 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2335,6 +2704,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -2354,6 +2724,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }>, z.ZodObject<{
     /** Display name for the MCP server */
@@ -2372,6 +2743,21 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -2460,6 +2846,27 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -2479,6 +2886,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -2496,6 +2904,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -2513,6 +2922,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -2530,6 +2940,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -2581,6 +2992,13 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
 } & {
     type: z.ZodUnion<[z.ZodLiteral<"streamable-http">, z.ZodLiteral<"http">]>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Headers resolved from the live chat request and merged over `headers`.
+     * Omitted during catalog discovery, which has no request context, so a
+     * `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+     * On a duplicate header name the resolved `requestHeaders` value wins.
+     */
+    requestHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     /**
      * On-Behalf-Of (OBO) token exchange configuration.
      * When configured, LibreChat exchanges the logged-in user's federated access token
@@ -2605,11 +3023,14 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2627,6 +3048,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -2646,6 +3068,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }, {
     type: "streamable-http" | "http";
@@ -2653,11 +3076,14 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2675,6 +3101,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -2694,6 +3121,7 @@ export declare const MCPOptionsSchema: z.ZodUnion<[z.ZodObject<{
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }>]>;
 export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
@@ -2713,6 +3141,21 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -2801,6 +3244,27 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -2820,6 +3284,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -2837,6 +3302,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -2854,6 +3320,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -2871,6 +3338,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -2955,12 +3423,14 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
-    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -2978,6 +3448,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -2993,6 +3464,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         title: string;
         sensitive?: boolean | undefined;
     }> | undefined;
+    env?: Record<string, string> | undefined;
     cwd?: string | undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
     obo?: undefined;
@@ -3003,12 +3475,14 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
-    env?: Record<string, string> | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -3026,6 +3500,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -3041,6 +3516,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         title: string;
         sensitive?: boolean | undefined;
     }> | undefined;
+    env?: Record<string, string> | undefined;
     cwd?: string | undefined;
     stderr?: number | "pipe" | "ignore" | "inherit" | undefined;
     obo?: undefined;
@@ -3061,6 +3537,21 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -3149,6 +3640,27 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -3168,6 +3680,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -3185,6 +3698,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -3202,6 +3716,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -3219,6 +3734,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -3277,11 +3793,14 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -3299,6 +3818,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -3321,11 +3841,14 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -3343,6 +3866,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -3376,6 +3900,21 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -3464,6 +4003,27 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -3483,6 +4043,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -3500,6 +4061,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -3517,6 +4079,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -3534,6 +4097,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -3585,6 +4149,13 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
 } & {
     type: z.ZodDefault<z.ZodLiteral<"sse">>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Headers resolved from the live chat request and merged over `headers`.
+     * Omitted during catalog discovery, which has no request context, so a
+     * `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+     * On a duplicate header name the resolved `requestHeaders` value wins.
+     */
+    requestHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     /**
      * On-Behalf-Of (OBO) token exchange configuration.
      * When configured, LibreChat exchanges the logged-in user's federated access token
@@ -3609,11 +4180,14 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -3631,6 +4205,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -3650,6 +4225,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }, {
     url: string;
@@ -3657,11 +4233,14 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -3679,6 +4258,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -3698,6 +4278,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }>, z.ZodObject<{
     /** Display name for the MCP server */
@@ -3716,6 +4297,21 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     /** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
     sseReadTimeout: z.ZodOptional<z.ZodNumber>;
     initTimeout: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+     * before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+     * faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+     * redemption aborts itself, because this wait runs inside the redemption that window governs.
+     *
+     * Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+     * contended refresh instead of adopting the rotation a peer is about to store, and that is the
+     * common case this wait exists to serve. Omit the field to take the default.
+     */
+    oauthRefreshWaitTimeout: z.ZodOptional<z.ZodNumber>;
+    /** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+    oauthRefreshCoordination: z.ZodOptional<z.ZodBoolean>;
+    /** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+    oauthPersistenceWaitTimeout: z.ZodOptional<z.ZodNumber>;
     /**
      * Whether the server is offered in chat.
      *
@@ -3804,6 +4400,27 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
          * Ignored when `audience` itself is not configured.
          */
         forward_audience_on_refresh: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+         * `authorization_code` exchange and the `refresh_token` grant. The value is the
+         * canonical resource identifier from the MCP server's Protected Resource Metadata
+         * (RFC 9728), never an operator-supplied string.
+         *
+         * Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+         * that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+         * fails an `/authorize` request carrying both `resource` and `scope` with
+         * `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+         * `audience` above) to obtain an API-scoped token.
+         *
+         * Opting out suppresses the parameter only. Protected Resource Metadata is still
+         * discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+         * still recorded on the stored client binding, so scope discovery, authorization
+         * server discovery and re-authentication checks are unaffected.
+         *
+         * This field is only accepted from trusted/admin MCP configuration and is rejected
+         * from user-managed servers.
+         */
+        send_resource_parameter: z.ZodOptional<z.ZodBoolean>;
         /** OAuth revocation endpoint (optional - can be auto-discovered) */
         revocation_endpoint: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>>;
         /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -3823,6 +4440,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -3840,6 +4458,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -3857,6 +4476,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -3874,6 +4494,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -3925,6 +4546,13 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
 } & {
     type: z.ZodUnion<[z.ZodLiteral<"streamable-http">, z.ZodLiteral<"http">]>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Headers resolved from the live chat request and merged over `headers`.
+     * Omitted during catalog discovery, which has no request context, so a
+     * `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+     * On a duplicate header name the resolved `requestHeaders` value wins.
+     */
+    requestHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     /**
      * On-Behalf-Of (OBO) token exchange configuration.
      * When configured, LibreChat exchanges the logged-in user's federated access token
@@ -3949,11 +4577,14 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -3971,6 +4602,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -3990,6 +4622,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }, {
     type: "streamable-http" | "http";
@@ -3997,11 +4630,14 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
     description?: string | undefined;
     title?: string | undefined;
     chatMenu?: boolean | undefined;
-    timeout?: number | undefined;
     startup?: boolean | undefined;
     iconPath?: string | undefined;
+    timeout?: number | undefined;
     sseReadTimeout?: number | undefined;
     initTimeout?: number | undefined;
+    oauthRefreshWaitTimeout?: number | undefined;
+    oauthRefreshCoordination?: boolean | undefined;
+    oauthPersistenceWaitTimeout?: number | undefined;
     serverInstructions?: string | boolean | undefined;
     requiresOAuth?: boolean | undefined;
     oauth?: {
@@ -4019,6 +4655,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         skip_code_challenge_check?: boolean | undefined;
         audience?: string | undefined;
         forward_audience_on_refresh?: boolean | undefined;
+        send_resource_parameter?: boolean | undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     } | undefined;
@@ -4038,6 +4675,7 @@ export declare const MCPServersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<[z.Zo
         scopes: string;
     } | undefined;
     headers?: Record<string, string> | undefined;
+    requestHeaders?: Record<string, string> | undefined;
     proxy?: string | undefined;
 }>]>>;
 export type MCPOptions = z.infer<typeof MCPOptionsSchema>;
@@ -4079,6 +4717,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         revocation_endpoint: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
         audience: z.ZodOptional<z.ZodNever>;
         forward_audience_on_refresh: z.ZodOptional<z.ZodNever>;
+        send_resource_parameter: z.ZodOptional<z.ZodNever>;
     }, "strip", z.ZodTypeAny, {
         authorization_url?: string | undefined;
         scope?: string | undefined;
@@ -4094,6 +4733,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -4111,6 +4751,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -4128,6 +4769,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -4145,6 +4787,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -4181,6 +4824,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         revocation_endpoint: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
         audience: z.ZodOptional<z.ZodNever>;
         forward_audience_on_refresh: z.ZodOptional<z.ZodNever>;
+        send_resource_parameter: z.ZodOptional<z.ZodNever>;
     }, "strip", z.ZodTypeAny, {
         authorization_url?: string | undefined;
         scope?: string | undefined;
@@ -4196,6 +4840,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -4213,6 +4858,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -4230,6 +4876,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -4247,6 +4894,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;
@@ -4286,6 +4934,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         revocation_endpoint: z.ZodOptional<z.ZodEffects<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodString>, string, string>>;
         audience: z.ZodOptional<z.ZodNever>;
         forward_audience_on_refresh: z.ZodOptional<z.ZodNever>;
+        send_resource_parameter: z.ZodOptional<z.ZodNever>;
     }, "strip", z.ZodTypeAny, {
         authorization_url?: string | undefined;
         scope?: string | undefined;
@@ -4301,6 +4950,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -4318,6 +4968,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>, {
@@ -4335,6 +4986,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }, {
@@ -4352,6 +5004,7 @@ export declare const MCPServerUserInputSchema: z.ZodUnion<[z.ZodObject<{
         skip_code_challenge_check?: boolean | undefined;
         audience?: undefined;
         forward_audience_on_refresh?: undefined;
+        send_resource_parameter?: undefined;
         revocation_endpoint?: string | undefined;
         revocation_endpoint_auth_methods_supported?: string[] | undefined;
     }>>;