* Allow OAuthClientProvider to control authentication to token endpoint w/ addClientAuthentication (exchange / refresh)
* Include mockProvider in exchangeAuthorization tests.
* feature. Add client_secret_basic and none authentication methods
---------
Co-authored-by: Jared Hanson <jaredhanson@gmail.com>
Co-authored-by: SightStudio <sdm3285@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Improve stdio test Windows compatibility and refactor command logic
I've pushed updates to address my own comments - thank you @HoberMin for this contribution!
- Moved getDefaultServerParameters from stdio.ts to stdio.test.ts since it's only used in tests
- Reverted unrelated changes to inMemory.ts and inMemory.test.ts
- Kept the core Windows compatibility fix for stdio tests
Co-authored-by: HoberMin <99346635+HoberMin@users.noreply.github.com>
• Tests callback is called when session is closed via DELETE
• Tests system works correctly when callback is not provided
• Tests callback is not called for invalid session DELETE requests
• Tests correct session ID is passed when multiple sessions exist
• Follows existing test patterns and includes proper cleanup
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Renamed ondelete callback to onsessionclosed for better clarity
- Moved callback from public property to private field following options pattern
- Added comprehensive JSDoc documentation explaining the callback's purpose
- Updated DELETE request handler to use the new callback structure
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Adds optional ondelete callback that fires when DELETE request is received, providing the sessionId for cleanup handling.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add cors middleware to example servers with Mcp-Session-Id exposed
- Add CORS documentation section to README
- Configure minimal CORS settings (only expose required headers)
This enables browser-based clients to connect to MCP servers by properly
exposing the Mcp-Session-Id header required for session management.
Reported-by: Jerome
- More specific expectations in test "uses custom fetch implementation from options"
* In sse.ts
- Import FetchLike from transport.ts
* In steramableHttp.ts
- Import FetchLike from transport.ts
- Export StartSSEOptions interface for testing
* In streamableHttp.test.ts
- import StartSSEOptions from streamableHttp.ts
- use StartSSEOptions instead of any in test "uses custom fetch implementation"
* In transport.ts
- Add FetchLike function type
nullish coalescing operator ?? instead of the logical OR operator || to handle the case where this?._eventSourceInit?.fetch or this._fetch might be null or undefined but not falsy
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
nullish coalescing operator ?? instead of the logical OR operator || to handle the case where this?._eventSourceInit?.fetch or this._fetch might be null or undefined but not falsy
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
nullish coalescing operator ?? instead of the logical OR operator || to handle the case where this?._eventSourceInit?.fetch or this._fetch might be null or undefined but not falsy
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
nullish coalescing operator ?? instead of the logical OR operator || to handle the case where this?._eventSourceInit?.fetch or this._fetch might be null or undefined but not falsy
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
nullish coalescing operator ?? instead of the logical OR operator || to handle the case where this?._eventSourceInit?.fetch or this._fetch might be null or undefined but not falsy
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* Returning undefined from `discoverOAuthMetadata` for CORS errors
This behaviour was already happening for the root URL, but the new `fetchWithCorsRetry` logic differed.
The issue was if the server returns a 404 for `/.well-known/oauth-authorization-server/xyz` that didn't have the `access-control-allow-origin`, a TypeError was being thrown. There was logic there already to handle a TypeError for a _preflight_ request (cause by custom headers), but not the fallback. I refactored so all combinations return `undefined`.
* Add test for CORS error handling that should return undefined
This test covers the scenario where both the initial request with headers
and the retry without headers fail with CORS TypeErrors. The desired
behavior is to return undefined instead of throwing.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix test comment
---------
Co-authored-by: Glen Maddern <glen@glenmaddern.com>
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
