tiny-http-mcp-server 0.1.20 → 0.1.22

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.20",
+      "version": "0.1.22",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -40,10 +40,14 @@ const verifier = createJwksTokenVerifier({
 - `client`
   - `mode: "dynamic"` with optional `metadata`
   - `mode: "static"` with `clientId`, optional `clientSecret`, optional `metadata`
-- `browser.openBrowser(url)`
+- `allowInteractive: false` prevents interactive login while retaining cached tokens and silent refresh
+- `browser.openBrowser(url)` optional
 - `browser.readLine()` optional
 - `browser.createServer()` optional
 - `browser.landingPage` optional
+- `browser.redirectUri` optional exact registered HTTP loopback callback with a fixed port
+- `browser.signal` optional cancellation signal
+- `browser.timeoutMs` optional authorization deadline (default 120,000 ms)
 - `sessionStore` optional
 - `authStore` optional `auth-store` backend config for the default session store
 - `now()` optional clock override
@@ -62,6 +66,23 @@ const verifier = createJwksTokenVerifier({
 | `requireAccessTokenType` | `boolean`           | `false`        | Require the JWT `typ` protected header to be `at+jwt`.                                   |
 | `fetch`                  | `typeof fetch`      | global `fetch` | Custom fetch implementation.                                                             |
 
+Fixed redirects support `localhost`, `127.0.0.1`, and `::1` over HTTP. Their
+exact spelling, port, path and query are preserved through registration,
+authorization and code exchange. Credentials, fragments, port zero and reserved
+OAuth callback query parameters are rejected before binding a listener. Omit
+`redirectUri` to allocate a random loopback port. Standalone callback sessions
+accept the same `redirectUri`, `signal` and `timeoutMs` options. Cancellation,
+timeout and explicit close settle pending code waits and release listeners.
+Always close a successful standalone session in `finally`.
+
+Provider request inputs accept an optional `signal`. It reaches callback waits,
+registration, token requests and bounded token-body reads. Cancellation retains
+its original reason and does not retry authorization. Custom providers should
+observe the supplied signal and pass it to any work they start.
+
+Configure `client.metadata.scope` to request a precise scope set; broader
+discovery metadata does not override it.
+
 `createAuthStoreSessionStore(options)` accepts the standard `auth-store` config.
 
 ## Environment Variables

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -25,7 +25,7 @@ export function createDefaultOAuthClientProvider(options) {
         async authorizeRequest(input) {
             assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
             const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
-            const session = await ensureAuthorizedSession(requestUrl, undefined, input.fetch, false);
+            const session = await ensureAuthorizedSession(requestUrl, undefined, input.fetch, false, false, input.signal);
             const accessToken = session?.tokens?.accessToken;
             if (session === null ||
                 accessToken === undefined ||
@@ -47,13 +47,14 @@ export function createDefaultOAuthClientProvider(options) {
                 const session = await ensureAuthorizedSession(resource, {
                     ...input.discovery,
                     resource
-                }, input.fetch, true, forceRefresh);
+                }, input.fetch, true, forceRefresh, input.signal);
                 if (session?.tokens?.accessToken === undefined) {
                     return { action: "fail" };
                 }
                 return { action: "retry" };
             }
             catch (error) {
+                input.signal?.throwIfAborted();
                 return {
                     action: "fail",
                     error: error instanceof Error ? error : new Error(String(error))
@@ -61,9 +62,11 @@ export function createDefaultOAuthClientProvider(options) {
             }
         }
     };
-    async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false) {
+    async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false, signal) {
+        signal?.throwIfAborted();
         const canonicalResource = canonicalizeResourceIndicator(resource);
         let session = await loadSession(canonicalResource);
+        signal?.throwIfAborted();
         if (discovery !== undefined && getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
             throw new Error("OAuth discovery authorization-server issuer mismatch");
         }
@@ -80,7 +83,7 @@ export function createDefaultOAuthClientProvider(options) {
         if (session?.tokens?.refreshToken !== undefined &&
             sessionDiscovery !== undefined &&
             (forceRefresh || isExpired(session.tokens, now))) {
-            session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch);
+            session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
             if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
                 return session;
             }
@@ -92,9 +95,12 @@ export function createDefaultOAuthClientProvider(options) {
         if (!allowInteractive || sessionDiscovery === undefined) {
             return session;
         }
-        return authorizeSession(canonicalResource, session, sessionDiscovery, fetch);
+        if (options.allowInteractive === false)
+            throw new Error("OAuth interactive authorization is disabled");
+        return authorizeSession(canonicalResource, session, sessionDiscovery, fetch, signal);
     }
-    async function refreshSession(resource, session, discovery, fetch) {
+    async function refreshSession(resource, session, discovery, fetch, signal) {
+        signal?.throwIfAborted();
         assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
         const inFlight = refreshPromises.get(resource);
         if (inFlight !== undefined) {
@@ -115,12 +121,13 @@ export function createDefaultOAuthClientProvider(options) {
                             clientSecret: session.client.clientSecret,
                             refreshToken: session.tokens.refreshToken,
                             resource,
-                            fetch,
+                            fetch, signal,
                             now
                         });
                         break;
                     }
                     catch (error) {
+                        signal?.throwIfAborted();
                         if (error instanceof OAuthError && error.error === "invalid_grant") {
                             const clearedSession = clearSessionTokens(session);
                             await saveSession(resource, clearedSession);
@@ -156,7 +163,8 @@ export function createDefaultOAuthClientProvider(options) {
         refreshPromises.set(resource, promise);
         return promise;
     }
-    async function authorizeSession(resource, existingSession, discovery, fetch) {
+    async function authorizeSession(resource, existingSession, discovery, fetch, signal) {
+        signal?.throwIfAborted();
         const inFlight = authorizationPromises.get(resource);
         if (inFlight !== undefined) {
             return inFlight;
@@ -172,11 +180,14 @@ export function createDefaultOAuthClientProvider(options) {
                     openBrowser: options.browser.openBrowser,
                     readLine: options.browser.readLine,
                     createServer: options.browser.createServer,
-                    landingPage: options.browser.landingPage
+                    landingPage: options.browser.landingPage,
+                    redirectUri: options.browser.redirectUri,
+                    signal: options.browser.signal === undefined ? signal : signal === undefined ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
+                    timeoutMs: options.browser.timeoutMs
                 });
                 let resolvedClient = null;
                 try {
-                    resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch);
+                    resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
                     const sessionWithoutTokens = {
                         resource,
                         authorizationServer: discovery.authorizationServer,
@@ -203,7 +214,7 @@ export function createDefaultOAuthClientProvider(options) {
                         codeVerifier: verifier,
                         redirectUri: loopback.redirectUri,
                         resource,
-                        fetch,
+                        fetch, signal,
                         now
                     });
                     const session = {
@@ -214,6 +225,7 @@ export function createDefaultOAuthClientProvider(options) {
                     return session;
                 }
                 catch (error) {
+                    signal?.throwIfAborted();
                     if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
                         reRegistrationAttempted = true;
                         await clearRegisteredClient(discovery.authorizationServer);
@@ -240,7 +252,8 @@ export function createDefaultOAuthClientProvider(options) {
         authorizationPromises.set(resource, finalPromise);
         return finalPromise;
     }
-    async function resolveClient(existingSession, discovery, redirectUri, fetch) {
+    async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
+        parentSignal?.throwIfAborted();
         const configuredClient = normalizeConfiguredClient(options.client);
         if (options.client.mode === "static") {
             if (configuredClient === null) {
@@ -292,7 +305,8 @@ export function createDefaultOAuthClientProvider(options) {
             }
         }
         const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
-        const signal = AbortSignal.timeout(30_000);
+        const deadline = AbortSignal.timeout(30_000);
+        const signal = parentSignal === undefined ? deadline : AbortSignal.any([parentSignal, deadline]);
         const response = await fetchMcpResponse(fetch, registrationEndpoint, {
             method: "POST",
             headers: {

package/node_modules/mcp-oauth/dist/client/loopback-authorization.d.ts

@@ -9,6 +9,11 @@ export interface LoopbackAuthorizationOptions {
     createServer?: () => http.Server;
     landingPage?: OAuthLandingPage;
     callbackPath?: string;
+    /** Exact registered HTTP loopback redirect, including its fixed port and query. */
+    redirectUri?: string;
+    signal?: AbortSignal;
+    /** Bounds listener setup and authorization; defaults to two minutes. */
+    timeoutMs?: number;
 }
 export interface LoopbackAuthorizationSession {
     redirectUri: string;

package/node_modules/mcp-oauth/dist/client/loopback-authorization.js

@@ -1,77 +1,150 @@
 import http from "node:http";
 import { parseAuthorizationState } from "./authorization-state.js";
 export async function createLoopbackAuthorizationSession(options = {}) {
-    const callbackPath = options.callbackPath ?? "/callback";
+    options.signal?.throwIfAborted();
+    const timeoutMs = options.timeoutMs ?? 120_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
+        throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
+    const target = loopbackTarget(options);
     const server = options.createServer ? options.createServer() : http.createServer();
-    const port = await startServer(server);
-    const redirectUri = `http://127.0.0.1:${port}${callbackPath}`;
+    const controller = new AbortController();
+    let closed = false;
+    let used = false;
+    const callerAbort = () => controller.abort(options.signal?.reason);
+    const teardown = () => {
+        if (closed)
+            return;
+        closed = true;
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", callerAbort);
+        server.closeAllConnections?.();
+        server.close();
+    };
+    const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+    timer.unref?.();
+    controller.signal.addEventListener("abort", teardown, { once: true });
+    options.signal?.addEventListener("abort", callerAbort, { once: true });
+    if (options.signal?.aborted)
+        callerAbort();
+    let port;
+    try {
+        port = await startServer(server, target.port, target.host, controller.signal);
+    }
+    catch (error) {
+        controller.abort(error);
+        throw error;
+    }
+    const redirectUri = options.redirectUri ?? `http://127.0.0.1:${port}${target.callbackPath}`;
     return {
         redirectUri,
         async waitForCode(authorizationUrl) {
-            return waitForAuthorizationCode(server, authorizationUrl, options, callbackPath);
+            controller.signal.throwIfAborted();
+            if (used)
+                throw new Error("OAuth authorization session has already been used");
+            used = true;
+            try {
+                return await waitForAuthorizationCode(server, authorizationUrl, options, target.callbackPath, controller.signal);
+            }
+            finally {
+                clearTimeout(timer);
+            }
         },
         close() {
-            server.closeAllConnections?.();
-            server.close();
+            controller.abort(new Error("OAuth authorization session closed"));
         }
     };
 }
-async function startServer(server) {
+function loopbackTarget(options) {
+    if (options.redirectUri !== undefined) {
+        let url;
+        try {
+            url = new URL(options.redirectUri);
+        }
+        catch (cause) {
+            throw new Error("Invalid OAuth loopback redirect URI", { cause });
+        }
+        const forbiddenQuery = ["code", "state", "error", "error_description", "iss"];
+        if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)
+            || url.username || url.password || url.hash || url.port === "0"
+            || forbiddenQuery.some(name => url.searchParams.has(name))
+            || [...options.redirectUri].some(char => char.codePointAt(0) <= 32)
+            || (options.callbackPath !== undefined && options.callbackPath !== url.pathname))
+            throw new Error("Invalid OAuth loopback redirect URI");
+        return { port: url.port ? Number(url.port) : 80, host: url.hostname === "[::1]" ? "::1" : url.hostname, callbackPath: url.pathname };
+    }
+    const callbackPath = options.callbackPath ?? "/callback";
+    const parsed = new URL(callbackPath, "http://127.0.0.1");
+    if (!callbackPath.startsWith("/") || parsed.origin !== "http://127.0.0.1" || parsed.pathname !== callbackPath || parsed.search || parsed.hash)
+        throw new Error("Invalid OAuth loopback callback path");
+    return { port: 0, host: "127.0.0.1", callbackPath };
+}
+async function startServer(server, port, host, signal) {
+    signal.throwIfAborted();
     return new Promise((resolve, reject) => {
-        const handleError = (error) => {
-            server.off("error", handleError);
-            reject(error);
-        };
+        const cleanup = () => { server.off("error", handleError); signal.removeEventListener("abort", aborted); };
+        const handleError = (error) => { cleanup(); reject(error); };
+        const aborted = () => { cleanup(); reject(signal.reason); };
         server.once("error", handleError);
-        server.listen(0, "127.0.0.1", () => {
-            server.off("error", handleError);
-            const address = server.address();
-            resolve(address.port);
-        });
+        signal.addEventListener("abort", aborted, { once: true });
+        try {
+            server.listen(port, host, () => {
+                cleanup();
+                if (signal.aborted) {
+                    server.close();
+                    reject(signal.reason);
+                    return;
+                }
+                const address = server.address();
+                if (address === null || typeof address === "string") {
+                    reject(new Error("OAuth listener has no TCP address"));
+                    return;
+                }
+                resolve(address.port);
+            });
+        }
+        catch (error) {
+            cleanup();
+            reject(error);
+        }
     });
 }
-function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath) {
+function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath, signal) {
+    signal.throwIfAborted();
     const expectedAuthorization = readExpectedAuthorizationCallback(authorizationUrl);
     return new Promise((resolve, reject) => {
         let settled = false;
         const settle = (fn) => {
-            if (!settled) {
-                settled = true;
-                fn();
-            }
+            if (settled)
+                return;
+            settled = true;
+            server.off("request", request);
+            signal.removeEventListener("abort", aborted);
+            fn();
         };
-        server.on("request", (req, res) => {
-            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        const aborted = () => settle(() => reject(signal.reason));
+        const request = (req, res) => {
+            let url;
+            try {
+                url = new URL(req.url ?? "/", "http://127.0.0.1");
+            }
+            catch {
+                res.writeHead(400);
+                res.end("Invalid callback URL");
+                return;
+            }
             if (url.pathname !== callbackPath) {
                 res.writeHead(404);
                 res.end("Not found");
                 return;
             }
             const callbackParameters = {
-                code: url.searchParams.get("code"),
-                error: url.searchParams.get("error"),
-                errorDescription: url.searchParams.get("error_description"),
-                state: url.searchParams.get("state"),
-                iss: url.searchParams.get("iss")
+                code: url.searchParams.get("code"), error: url.searchParams.get("error"),
+                errorDescription: url.searchParams.get("error_description"), state: url.searchParams.get("state"), iss: url.searchParams.get("iss")
             };
             try {
                 validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
-            }
-            catch (error) {
-                res.writeHead(400);
-                res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
-                settle(() => reject(error instanceof Error ? error : new Error(String(error))));
-                return;
-            }
-            const authorizationError = callbackParameters.error;
-            if (authorizationError !== null) {
-                const description = callbackParameters.errorDescription ?? authorizationError;
-                res.writeHead(400);
-                res.end(`Authorization failed: ${description}`);
-                settle(() => reject(createAuthorizationError(authorizationError, description)));
-                return;
-            }
-            try {
+                if (callbackParameters.error !== null)
+                    throw createAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
                 const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
                 res.writeHead(200, { "Content-Type": "text/html" });
                 res.end(buildSuccessPage(options.landingPage));
@@ -80,39 +153,28 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
             catch (error) {
                 res.writeHead(400);
                 res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
-                settle(() => reject(error instanceof Error ? error : new Error(String(error))));
+                settle(() => reject(error));
             }
-        });
+        };
+        server.on("request", request);
+        signal.addEventListener("abort", aborted, { once: true });
         if (options.readLine !== undefined) {
-            options
-                .readLine()
-                .then((input) => {
-                const callbackParameters = extractCallbackParametersFromInput(input);
-                if (callbackParameters === null) {
-                    settle(() => reject(new Error("OAuth callback missing authorization code")));
+            void Promise.resolve().then(() => settled ? undefined : options.readLine()).then(input => {
+                if (settled)
                     return;
-                }
-                try {
-                    validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
-                    if (callbackParameters.error !== null) {
-                        const description = callbackParameters.errorDescription ?? callbackParameters.error;
-                        throw createAuthorizationError(callbackParameters.error, description);
-                    }
-                    const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
-                    settle(() => resolve(code));
-                }
-                catch (error) {
-                    settle(() => reject(error instanceof Error ? error : new Error(String(error))));
-                }
-            })
-                .catch((error) => {
-                settle(() => reject(error instanceof Error ? error : new Error(String(error))));
-            });
+                const callbackParameters = extractCallbackParametersFromInput(input);
+                if (callbackParameters === null)
+                    throw new Error("OAuth callback missing authorization code");
+                validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+                if (callbackParameters.error !== null)
+                    throw createAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
+                const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+                settle(() => resolve(code));
+            }).catch(error => settle(() => reject(error)));
         }
         if (options.openBrowser !== undefined) {
-            options.openBrowser(authorizationUrl).catch((error) => {
-                settle(() => reject(error));
-            });
+            void Promise.resolve().then(() => settled ? undefined : options.openBrowser(authorizationUrl))
+                .catch(error => settle(() => reject(error)));
         }
     });
 }

package/node_modules/mcp-oauth/dist/client/token-endpoint.d.ts

@@ -25,6 +25,7 @@ export declare function exchangeAuthorizationCode(input: {
     redirectUri: string;
     resource: string;
     fetch: OAuthMetadataFetch;
+    signal?: AbortSignal;
     now: () => number;
 }): Promise<StoredOAuthTokens>;
 export declare function refreshAccessToken(input: {
@@ -34,6 +35,7 @@ export declare function refreshAccessToken(input: {
     refreshToken: string;
     resource: string;
     fetch: OAuthMetadataFetch;
+    signal?: AbortSignal;
     now: () => number;
 }): Promise<StoredOAuthTokens>;
 export declare function readOAuthJsonObjectResponse(response: Response, signal?: AbortSignal): Promise<Record<string, unknown>>;

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -44,6 +44,7 @@ export async function exchangeAuthorizationCode(input) {
             resource
         },
         fetch: input.fetch,
+        signal: input.signal,
         now: input.now
     });
 }
@@ -59,6 +60,7 @@ export async function refreshAccessToken(input) {
             resource
         },
         fetch: input.fetch,
+        signal: input.signal,
         now: input.now
     });
 }
@@ -70,7 +72,9 @@ async function requestTokens(input) {
     if (input.clientSecret !== undefined) {
         body.set("client_secret", input.clientSecret);
     }
-    const signal = AbortSignal.timeout(30_000);
+    input.signal?.throwIfAborted();
+    const deadline = AbortSignal.timeout(30_000);
+    const signal = input.signal === undefined ? deadline : AbortSignal.any([input.signal, deadline]);
     const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
         method: "POST",
         headers: {

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -32,6 +32,7 @@ export interface OAuthClientProvider {
         requestUrl: URL;
         headers: Headers;
         fetch: OAuthMetadataFetch;
+        signal?: AbortSignal;
     }): Promise<void> | void;
     handleUnauthorized(input: {
         requestUrl: URL;
@@ -39,6 +40,7 @@ export interface OAuthClientProvider {
         challenge: OAuthUnauthorizedChallenge | null;
         discovery: OAuthDiscoveryResult;
         fetch: OAuthMetadataFetch;
+        signal?: AbortSignal;
     }): Promise<{
         action: "retry";
     } | {
@@ -95,8 +97,14 @@ export interface DefaultOAuthClientProviderOptions {
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
     };
+    /** Disable interactive authorization while allowing cached tokens and silent refresh. */
+    allowInteractive?: boolean;
     browser: {
-        openBrowser(url: string): Promise<void>;
+        openBrowser?(url: string): Promise<void>;
+        /** Exact registered HTTP loopback redirect URI. */
+        redirectUri?: string;
+        signal?: AbortSignal;
+        timeoutMs?: number;
         readLine?: () => Promise<string>;
         createServer?: () => http.Server;
         landingPage?: {

package/node_modules/tiny-mcp-client/README.md

@@ -36,6 +36,8 @@ Legacy SSE mode opens a GET stream and posts messages to the endpoint announced
 by the server. Announced endpoints must remain on the original origin without
 embedded credentials or fragments; endpoint changes close the connection.
 Both transports accept the same headers, OAuth provider and response limits.
+HTTP failures expose `HttpTransportError.status` and `.method`, so callers can
+make transport decisions without parsing error messages.
 
 ## OAuth HTTP support
 
@@ -64,7 +66,9 @@ const transport = new HttpTransport({
 });
 ```
 
-You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache.
+You can also call `discoverOAuthMetadata(resourceUrl, options)` directly, or instantiate `OAuthMetadataDiscovery` with a custom `fetch` implementation and shared cache. Lookup options accept `signal`; cancellation stops metadata fetches and body reads without trying another discovery candidate.
+
+OAuth provider inputs receive the originating request's `signal`, covering header authorization and unauthorized handling. Modern request cancellation stops its OAuth work while leaving other requests usable; transport disposal cancels all pending OAuth operations. The default provider propagates this signal to callback, registration and token work. Custom providers must observe it for their own operations.
 
 ## Testing helpers
 

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -109,6 +109,7 @@ interface OAuthClientProvider {
         requestUrl: URL;
         headers: Headers;
         fetch: OAuthMetadataFetch;
+        signal?: AbortSignal;
     }): Promise<void> | void;
     handleUnauthorized(input: {
         requestUrl: URL;
@@ -116,6 +117,7 @@ interface OAuthClientProvider {
         challenge: OAuthUnauthorizedChallenge | null;
         discovery: OAuthDiscoveryResult;
         fetch: OAuthMetadataFetch;
+        signal?: AbortSignal;
     }): Promise<{
         action: "retry";
     } | {
@@ -172,8 +174,14 @@ interface DefaultOAuthClientProviderOptions {
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
     };
+    /** Disable interactive authorization while allowing cached tokens and silent refresh. */
+    allowInteractive?: boolean;
     browser: {
-        openBrowser(url: string): Promise<void>;
+        openBrowser?(url: string): Promise<void>;
+        /** Exact registered HTTP loopback redirect URI. */
+        redirectUri?: string;
+        signal?: AbortSignal;
+        timeoutMs?: number;
         readLine?: () => Promise<string>;
         createServer?: () => http.Server;
         landingPage?: {
@@ -202,6 +210,7 @@ interface OAuthMetadataDiscoveryOptions {
 }
 interface OAuthMetadataLookupOptions {
     resourceMetadataUrl?: string | URL;
+    signal?: AbortSignal;
 }
 declare class OAuthMetadataDiscovery {
     private readonly fetchImpl;
@@ -209,7 +218,7 @@ declare class OAuthMetadataDiscovery {
     private readonly memoryCache;
     constructor({ fetch, cache }?: OAuthMetadataDiscoveryOptions);
     private discoverProtectedResource;
-    discover(resourceUrl: string | URL, { resourceMetadataUrl }?: OAuthMetadataLookupOptions): Promise<OAuthDiscoveryResult>;
+    discover(resourceUrl: string | URL, { resourceMetadataUrl, signal }?: OAuthMetadataLookupOptions): Promise<OAuthDiscoveryResult>;
 }
 declare function discoverOAuthMetadata(resourceUrl: string | URL, options?: OAuthMetadataDiscoveryOptions & OAuthMetadataLookupOptions): Promise<OAuthDiscoveryResult>;
 
@@ -583,6 +592,11 @@ interface StdioTransportOptions {
     spawn?: StdioSpawn;
 }
 type HttpTransportFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+declare class HttpTransportError extends Error {
+    readonly status: number;
+    readonly method: "GET" | "POST" | "DELETE";
+    constructor(message: string, status: number, method: "GET" | "POST" | "DELETE");
+}
 interface HttpTransportOptions {
     url: string;
     /** Legacy SSE uses a GET stream that announces the RPC POST endpoint. */
@@ -629,6 +643,7 @@ declare class HttpTransport implements McpTransport {
     private readonly oauthProvider;
     private readonly oauthMetadataDiscovery;
     private readonly inFlightFetchAbortControllers;
+    private readonly inFlightOAuthAbortControllers;
     private readonly openResponseReaders;
     private readonly modernRequests;
     private modernMode;
@@ -743,5 +758,5 @@ declare class JsonRpcMessageLayer {
     private handleCancellationNotification;
 }
 
-export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, JsonRpcMessageLayer, McpClient, McpError, OAuthMetadataDiscovery, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse };
+export { ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, HttpTransportError, JsonRpcMessageLayer, McpClient, McpError, OAuthMetadataDiscovery, StdioTransport, createInMemoryTransportPair, createSdkTestPair, createTestPair, discoverOAuthMetadata, fetchMcpResponse };
 export type { AudioContent, BlobResourceContents, CacheableResultMetadata, CallToolOptions, CallToolParams, CallToolResult, ClientCapabilities, CompleteArgument, CompleteParams, CompleteResult, Completion, ConnectResult, ContentItem, CreateMessageParams, CreateMessageResult, ElicitationParams, ElicitationResult, EmbeddedResource, GetPromptParams, GetPromptResult, HttpTransportFetch, HttpTransportOptions, ImageContent, InMemoryTransportPair, IncludeContext, InitializeParams, InitializeResult, JsonRpcErrorObject, JsonRpcErrorResponse, JsonRpcMessage, JsonRpcNotification, JsonRpcRequest, JsonRpcRequestOptions, JsonRpcResponse, JsonRpcSuccessResponse, LogLevel, LogMessage, McpClientConnection, McpClientOptions, McpRequestContext, McpSubscription, McpTransport, McpTransportClosedEvent, ModelHint, ModelPreferences, NotificationFilter, OAuthAuthorizationServerMetadata, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryCache, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, PaginatedParams, PaginatedResult, ProgressParams, ProgressToken, PromptMessage, PromptReference, ReadResourceParams, RequestId, ResourceContents, ResourceReference, ResultMetadata, Root, SamplingContent, SamplingMessage, SdkTestPair, ServerCapabilities, StdioSpawn, StdioTransportOptions, StoredOAuthSession, SubscriptionOptions, TextContent, TextResourceContents, Tool, ToolResultContent, ToolUseContent };