mcp-use 1.34.4 → 1.34.5

package/dist/src/browser.cjs

@@ -783,7 +783,7 @@ var ClientRemoveServerEvent = class extends BaseTelemetryEvent {
 };
 
 // src/version.ts
-var VERSION = "1.34.4";
+var VERSION = "1.34.5";
 function getPackageVersion() {
   return VERSION;
 }
@@ -3098,6 +3098,9 @@ var BrowserMCPClient = class _BrowserMCPClient extends BaseMCPClient {
   }
 };
 
+// src/auth/browser-provider.ts
+var import_auth_utils = require("@modelcontextprotocol/sdk/shared/auth-utils.js");
+
 // src/utils/url-sanitize.ts
 function sanitizeUrl(raw) {
   const abort = /* @__PURE__ */ __name(() => {
@@ -3715,6 +3718,43 @@ var BrowserOAuthClientProvider = class {
   invalidateCredentials(scope) {
     return this.session.invalidateCredentials(scope);
   }
+  /**
+   * Validate the protected resource discovered through the OAuth proxy.
+   *
+   * The proxy rewrites protected-resource metadata to the MCP connection URL
+   * so transport-anchored discovery remains valid. Manual authentication is
+   * anchored on the upstream MCP URL instead, so accept that rewrite and
+   * return the original upstream resource that the authorization server
+   * protects.
+   */
+  async validateResourceURL(serverUrl, resource) {
+    if (!resource) return void 0;
+    const requestedResource = (0, import_auth_utils.resourceUrlFromServerUrl)(serverUrl);
+    if ((0, import_auth_utils.checkResourceAllowed)({
+      requestedResource,
+      configuredResource: resource
+    })) {
+      return new URL(resource);
+    }
+    const isConnectionResource = this.connectionUrl && (0, import_auth_utils.checkResourceAllowed)({
+      requestedResource: (0, import_auth_utils.resourceUrlFromServerUrl)(this.connectionUrl),
+      configuredResource: resource
+    });
+    if (isConnectionResource) {
+      const upstreamResource = (0, import_auth_utils.resourceUrlFromServerUrl)(
+        this._lastOriginalResource ?? this.serverUrl
+      );
+      if ((0, import_auth_utils.checkResourceAllowed)({
+        requestedResource,
+        configuredResource: upstreamResource
+      })) {
+        return upstreamResource;
+      }
+    }
+    throw new Error(
+      `Protected resource ${resource} does not match expected ${requestedResource} (or origin)`
+    );
+  }
   /**
    * Resolve this server's OAuth token endpoint (via discovery, cached). Lets
    * consumers persist the endpoint alongside the tokens for server-side

package/dist/src/browser.js

@@ -2,22 +2,22 @@ import {
   BrowserMCPClient,
   BrowserOAuthClientProvider,
   onMcpAuthorization
-} from "../chunk-YYUZ7XGB.js";
+} from "../chunk-6P7JMLV2.js";
 import {
   HttpConnector,
   MCPSession
-} from "../chunk-LEWR3GBF.js";
+} from "../chunk-V7Q4HEFC.js";
 import "../chunk-URE3PRDB.js";
 import {
   BaseConnector
-} from "../chunk-GYSF6PR5.js";
+} from "../chunk-DAFFOVMW.js";
 import {
   Tel,
   Telemetry,
   VERSION,
   getPackageVersion,
   setTelemetrySource
-} from "../chunk-2J5OVVW6.js";
+} from "../chunk-VSSL5DL7.js";
 import {
   Logger,
   logger

package/dist/src/client.cjs

@@ -215,7 +215,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.34.4";
+    VERSION = "1.34.5";
     __name(getPackageVersion, "getPackageVersion");
   }
 });

package/dist/src/client.js

@@ -13,12 +13,12 @@ import {
   isVMAvailable,
   reject,
   validate
-} from "../chunk-CI6MW6DM.js";
+} from "../chunk-3BUU264G.js";
 import "../chunk-GKPKUKD6.js";
-import "../chunk-WJ2EMDBB.js";
-import "../chunk-7DSZJBE2.js";
+import "../chunk-LS73EEWA.js";
+import "../chunk-JFYUK3XX.js";
 import "../chunk-LG5NSHEL.js";
-import "../chunk-MKRTKKXV.js";
+import "../chunk-NDIVAYZ3.js";
 import "../chunk-BXZHMYMM.js";
 import "../chunk-MTHLLDCX.js";
 import "../chunk-QWQYAQCK.js";

package/dist/src/react/index.cjs

@@ -1110,7 +1110,7 @@ var ClientRemoveServerEvent = class extends BaseTelemetryEvent {
 };
 
 // src/version.ts
-var VERSION = "1.34.4";
+var VERSION = "1.34.5";
 function getPackageVersion() {
   return VERSION;
 }
@@ -3635,6 +3635,9 @@ function sanitizeParam([k, v]) {
 }
 __name(sanitizeParam, "sanitizeParam");
 
+// src/auth/browser-provider.ts
+var import_auth_utils = require("@modelcontextprotocol/sdk/shared/auth-utils.js");
+
 // src/auth/kv-store.ts
 var LocalStorageKVStore = class {
   static {
@@ -4226,6 +4229,43 @@ var BrowserOAuthClientProvider = class {
   invalidateCredentials(scope) {
     return this.session.invalidateCredentials(scope);
   }
+  /**
+   * Validate the protected resource discovered through the OAuth proxy.
+   *
+   * The proxy rewrites protected-resource metadata to the MCP connection URL
+   * so transport-anchored discovery remains valid. Manual authentication is
+   * anchored on the upstream MCP URL instead, so accept that rewrite and
+   * return the original upstream resource that the authorization server
+   * protects.
+   */
+  async validateResourceURL(serverUrl, resource) {
+    if (!resource) return void 0;
+    const requestedResource = (0, import_auth_utils.resourceUrlFromServerUrl)(serverUrl);
+    if ((0, import_auth_utils.checkResourceAllowed)({
+      requestedResource,
+      configuredResource: resource
+    })) {
+      return new URL(resource);
+    }
+    const isConnectionResource = this.connectionUrl && (0, import_auth_utils.checkResourceAllowed)({
+      requestedResource: (0, import_auth_utils.resourceUrlFromServerUrl)(this.connectionUrl),
+      configuredResource: resource
+    });
+    if (isConnectionResource) {
+      const upstreamResource = (0, import_auth_utils.resourceUrlFromServerUrl)(
+        this._lastOriginalResource ?? this.serverUrl
+      );
+      if ((0, import_auth_utils.checkResourceAllowed)({
+        requestedResource,
+        configuredResource: upstreamResource
+      })) {
+        return upstreamResource;
+      }
+    }
+    throw new Error(
+      `Protected resource ${resource} does not match expected ${requestedResource} (or origin)`
+    );
+  }
   /**
    * Resolve this server's OAuth token endpoint (via discovery, cached). Lets
    * consumers persist the endpoint alongside the tokens for server-side
@@ -5553,6 +5593,7 @@ function useMcp(options) {
         addLog("info", "Triggering fresh OAuth authorization...");
         const parsedUrl = new URL(url);
         const baseUrl = parsedUrl.origin + parsedUrl.pathname.replace(/\/+$/, "");
+        let authFlowError = null;
         try {
           await (0, import_auth3.auth)(freshAuthProvider, {
             serverUrl: baseUrl,
@@ -5560,13 +5601,21 @@ function useMcp(options) {
           });
           addLog("info", "OAuth flow completed (tokens obtained)");
         } catch (err) {
+          authFlowError = err instanceof Error ? err : new Error(String(err));
           addLog(
             "info",
             "OAuth flow initiated (popup/redirect):",
-            err instanceof Error ? err.message : "Redirecting..."
+            authFlowError.message
           );
         }
         const newAuthUrl = freshAuthProvider.getLastAttemptedAuthUrl?.();
+        if (authFlowError && !capturedPopup && !newAuthUrl) {
+          failConnection(
+            `Authentication failed: ${authFlowError.message}`,
+            authFlowError
+          );
+          return;
+        }
         if (newAuthUrl) {
           setAuthUrl(newAuthUrl);
           addLog("info", "Updated auth URL for fallback:", newAuthUrl);

package/dist/src/react/index.js

@@ -6,16 +6,16 @@ import {
   onMcpAuthorization,
   runAuthPopup,
   sanitizeUrl
-} from "../../chunk-YYUZ7XGB.js";
-import "../../chunk-LEWR3GBF.js";
+} from "../../chunk-6P7JMLV2.js";
+import "../../chunk-V7Q4HEFC.js";
 import "../../chunk-URE3PRDB.js";
-import "../../chunk-GYSF6PR5.js";
+import "../../chunk-DAFFOVMW.js";
 import {
   Tel,
   Telemetry,
   getPackageVersion,
   setTelemetrySource
-} from "../../chunk-2J5OVVW6.js";
+} from "../../chunk-VSSL5DL7.js";
 import {
   clearRpcLogs,
   getAllRpcLogs,
@@ -1410,6 +1410,7 @@ function useMcp(options) {
         addLog("info", "Triggering fresh OAuth authorization...");
         const parsedUrl = new URL(url);
         const baseUrl = parsedUrl.origin + parsedUrl.pathname.replace(/\/+$/, "");
+        let authFlowError = null;
         try {
           await auth(freshAuthProvider, {
             serverUrl: baseUrl,
@@ -1417,13 +1418,21 @@ function useMcp(options) {
           });
           addLog("info", "OAuth flow completed (tokens obtained)");
         } catch (err) {
+          authFlowError = err instanceof Error ? err : new Error(String(err));
           addLog(
             "info",
             "OAuth flow initiated (popup/redirect):",
-            err instanceof Error ? err.message : "Redirecting..."
+            authFlowError.message
           );
         }
         const newAuthUrl = freshAuthProvider.getLastAttemptedAuthUrl?.();
+        if (authFlowError && !capturedPopup && !newAuthUrl) {
+          failConnection(
+            `Authentication failed: ${authFlowError.message}`,
+            authFlowError
+          );
+          return;
+        }
         if (newAuthUrl) {
           setAuthUrl(newAuthUrl);
           addLog("info", "Updated auth URL for fallback:", newAuthUrl);

package/dist/src/react/useMcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useMcp.d.ts","sourceRoot":"","sources":["../../../src/react/useMcp.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAwC9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAo1E3D"}
+{"version":3,"file":"useMcp.d.ts","sourceRoot":"","sources":["../../../src/react/useMcp.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAwC9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAi2E3D"}

package/dist/src/server/index.cjs

@@ -661,7 +661,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.34.4";
+    VERSION = "1.34.5";
     __name(getPackageVersion, "getPackageVersion");
   }
 });

package/dist/src/server/index.js

@@ -17,7 +17,7 @@ import {
   findSessionContext,
   isValidLogLevel,
   supportsApps
-} from "../../chunk-KO5XAWZ3.js";
+} from "../../chunk-MD7U5C3K.js";
 import {
   getRequestContext,
   hasRequestContext,
@@ -59,7 +59,7 @@ import {
   Telemetry,
   VERSION,
   getPackageVersion
-} from "../../chunk-MKRTKKXV.js";
+} from "../../chunk-NDIVAYZ3.js";
 import "../../chunk-BXZHMYMM.js";
 import {
   fsHelpers,
@@ -3332,7 +3332,7 @@ function registerPrompt(promptDefinition, callback) {
   }
   const wrappedCallback = /* @__PURE__ */ __name(async (params, extra) => {
     const { getRequestContext: getRequestContext2, runWithContext: runWithContext2 } = await import("../../context-storage-KMOAHEL7.js");
-    const { findSessionContext: findSessionContext2, createClientCapabilityChecker } = await import("../../tool-execution-helpers-ODJCEDUR.js");
+    const { findSessionContext: findSessionContext2, createClientCapabilityChecker } = await import("../../tool-execution-helpers-CEE337HP.js");
     const initialRequestContext = getRequestContext2();
     const sessions = this.sessions || /* @__PURE__ */ new Map();
     const { requestContext, session } = findSessionContext2(
@@ -3537,7 +3537,7 @@ function registerResource(resourceDefinition, callback) {
   const explicitMimeType = resourceDefinition.mimeType;
   const wrappedCallback = /* @__PURE__ */ __name(async () => {
     const { getRequestContext: getRequestContext2, runWithContext: runWithContext2 } = await import("../../context-storage-KMOAHEL7.js");
-    const { findSessionContext: findSessionContext2, createClientCapabilityChecker } = await import("../../tool-execution-helpers-ODJCEDUR.js");
+    const { findSessionContext: findSessionContext2, createClientCapabilityChecker } = await import("../../tool-execution-helpers-CEE337HP.js");
     const initialRequestContext = getRequestContext2();
     const sessions = this.sessions || /* @__PURE__ */ new Map();
     const { requestContext, session } = findSessionContext2(
@@ -3625,7 +3625,7 @@ function registerResourceTemplate(resourceTemplateDefinition, callback) {
     async (uri) => {
       const params = this.parseTemplateUri(uriTemplate, uri.toString());
       const { getRequestContext: getRequestContext2, runWithContext: runWithContext2 } = await import("../../context-storage-KMOAHEL7.js");
-      const { findSessionContext: findSessionContext2 } = await import("../../tool-execution-helpers-ODJCEDUR.js");
+      const { findSessionContext: findSessionContext2 } = await import("../../tool-execution-helpers-CEE337HP.js");
       const initialRequestContext = getRequestContext2();
       const sessions = this.sessions || /* @__PURE__ */ new Map();
       const { requestContext } = findSessionContext2(
@@ -6987,7 +6987,7 @@ var MCPServerClass = class _MCPServerClass {
       onSampling: /* @__PURE__ */ __name(async (params) => {
         try {
           const { getRequestContext: getRequestContext2 } = await import("../../context-storage-KMOAHEL7.js");
-          const { findSessionContext: findSessionContext2 } = await import("../../tool-execution-helpers-ODJCEDUR.js");
+          const { findSessionContext: findSessionContext2 } = await import("../../tool-execution-helpers-CEE337HP.js");
           const ctx = getRequestContext2();
           if (!ctx) throw new Error("No request context");
           const { session } = findSessionContext2(
@@ -7015,7 +7015,7 @@ var MCPServerClass = class _MCPServerClass {
       onElicitation: /* @__PURE__ */ __name(async (params) => {
         try {
           const { getRequestContext: getRequestContext2 } = await import("../../context-storage-KMOAHEL7.js");
-          const { findSessionContext: findSessionContext2 } = await import("../../tool-execution-helpers-ODJCEDUR.js");
+          const { findSessionContext: findSessionContext2 } = await import("../../tool-execution-helpers-CEE337HP.js");
           const ctx = getRequestContext2();
           if (!ctx) throw new Error("No request context");
           const { session } = findSessionContext2(

package/dist/src/version.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "1.34.4";
+export declare const VERSION = "1.34.5";
 /**
  * Get the package version.
  * The version is embedded at build time via scripts/generate-version.mjs

package/dist/{stdio-4SNFIKTV.js → stdio-I5TXQ4ET.js}

@@ -1,9 +1,9 @@
 import {
   StdioConnector
-} from "./chunk-XNWBPRVB.js";
+} from "./chunk-ZDC5CD3L.js";
 import "./chunk-GKPKUKD6.js";
-import "./chunk-7DSZJBE2.js";
-import "./chunk-MKRTKKXV.js";
+import "./chunk-JFYUK3XX.js";
+import "./chunk-NDIVAYZ3.js";
 import "./chunk-BXZHMYMM.js";
 import "./chunk-MTHLLDCX.js";
 import "./chunk-QWQYAQCK.js";

package/dist/{stdio-ZAOHF4EV.js → stdio-OFLQV3DJ.js}

@@ -1,8 +1,8 @@
 import {
   BaseConnector,
   ConnectionManager
-} from "./chunk-GYSF6PR5.js";
-import "./chunk-2J5OVVW6.js";
+} from "./chunk-DAFFOVMW.js";
+import "./chunk-VSSL5DL7.js";
 import {
   logger
 } from "./chunk-QWQYAQCK.js";

package/dist/{tool-execution-helpers-ODJCEDUR.js → tool-execution-helpers-CEE337HP.js}

@@ -7,10 +7,10 @@ import {
   findSessionContext,
   isValidLogLevel,
   supportsApps
-} from "./chunk-KO5XAWZ3.js";
+} from "./chunk-MD7U5C3K.js";
 import "./chunk-G7JEMXJW.js";
 import "./chunk-KUEVOU4M.js";
-import "./chunk-MKRTKKXV.js";
+import "./chunk-NDIVAYZ3.js";
 import "./chunk-BXZHMYMM.js";
 import "./chunk-MTHLLDCX.js";
 import "./chunk-QWQYAQCK.js";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-use",
   "type": "module",
-  "version": "1.34.4",
+  "version": "1.34.5",
   "description": "Opinionated MCP Framework for TypeScript (@modelcontextprotocol/sdk compatible) - Build MCP Agents, Clients and Servers with support for ChatGPT Apps, Code Mode, OAuth, Notifications, Sampling, Observability and more.",
   "author": "mcp-use, Inc.",
   "license": "MIT",
@@ -158,8 +158,8 @@
     "node-mocks-http": "1.17.2",
     "posthog-js": "1.351.3",
     "posthog-node": "5.24.17",
-    "@mcp-use/cli": "3.6.5",
-    "@mcp-use/inspector": "12.0.4"
+    "@mcp-use/cli": "3.6.6",
+    "@mcp-use/inspector": "12.0.5"
   },
   "optionalDependencies": {
     "cli-highlight": "2.1.11",