* Allow OAuthClientProvider to control authentication to token endpoint w/ addClientAuthentication (exchange / refresh)
* Include mockProvider in exchangeAuthorization tests.
* feature. Add client_secret_basic and none authentication methods
---------
Co-authored-by: Jared Hanson <jaredhanson@gmail.com>
Co-authored-by: SightStudio <sdm3285@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Updated StreamableHTTPServerTransport to support both sync and async callbacks:
- Changed callback types to return void | Promise<void>
- Used await Promise.resolve() to handle both sync and async callbacks
- Added comprehensive tests for async callback functionality
- Errors in callbacks now properly propagate to HTTP responses
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Improve stdio test Windows compatibility and refactor command logic
I've pushed updates to address my own comments - thank you @HoberMin for this contribution!
- Moved getDefaultServerParameters from stdio.ts to stdio.test.ts since it's only used in tests
- Reverted unrelated changes to inMemory.ts and inMemory.test.ts
- Kept the core Windows compatibility fix for stdio tests
Co-authored-by: HoberMin <99346635+HoberMin@users.noreply.github.com>
• Tests callback is called when session is closed via DELETE
• Tests system works correctly when callback is not provided
• Tests callback is not called for invalid session DELETE requests
• Tests correct session ID is passed when multiple sessions exist
• Follows existing test patterns and includes proper cleanup
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Renamed ondelete callback to onsessionclosed for better clarity
- Moved callback from public property to private field following options pattern
- Added comprehensive JSDoc documentation explaining the callback's purpose
- Updated DELETE request handler to use the new callback structure
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Adds optional ondelete callback that fires when DELETE request is received, providing the sessionId for cleanup handling.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add cors middleware to example servers with Mcp-Session-Id exposed
- Add CORS documentation section to README
- Configure minimal CORS settings (only expose required headers)
This enables browser-based clients to connect to MCP servers by properly
exposing the Mcp-Session-Id header required for session management.
Reported-by: Jerome
