Kenneth Sinder
806d7cf9c0
registerTool: accept ZodType<object> for input and output schema (#816 )
2025-11-07 16:22:58 +00:00
Matt
4463737330
FIX: use a nightly spec.types.ts ( #1087 )
2025-11-07 14:16:11 +00:00
Matt
11f04e1b0b
Check script which typechecks using Typescripts new Go port ( #1075 )
2025-11-06 18:23:37 +00:00
Matt
9757ace06e
move CLI script to dedicated scripts directory ( #1073 )
2025-11-04 17:52:28 +00:00
Chip
ee9fed28cc
fix: Support WWW-Authenticate scope param for SEP-835 ( #983 )
...
Co-authored-by: OtotheA <oscar@otothea.com>
2025-11-03 15:24:42 +00:00
adam jones
216604720b
Add @deprecated annotations to legacy APIs ( #1018 )
...
Co-authored-by: Claude <noreply@anthropic.com>
2025-11-03 15:21:18 +00:00
Vinay Dandekar
664e66e575
Only use path-based discovery URLs from the authorization server to discover metadata ( #1070 )
2025-11-03 14:52:33 +00:00
Konstantin Konstantinov
7387c44bf5
Fix: Non-existent tool, disabled tool and inputSchema validation return MCP protocol level instead of CallToolResult with isError: true ( #1044 )
2025-10-28 15:00:04 +00:00
Chip
874aa27a89
fix: Prefer the token_endpoint_auth_method response from DCR registration ( #1022 )
2025-10-28 11:24:46 +00:00
Paul Carleton
e74a358728
Update metadata.ts ( #1010 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
2025-10-27 17:40:23 +00:00
Matt
5a8fb39430
feat: pluggable JSON schema validator providers ( #1012 )
2025-10-25 11:56:42 -04:00
Pierre-Élie Fauché
c543095985
fix: Zod to JSONSchema pipe strategies ( #962 )
2025-10-18 08:12:42 +01:00
Frédéric Barthelet
caa25503cd
Allow empty string as valid URL in DCR workflow ( #987 )
2025-10-13 15:43:58 +01:00
Simon Vestergaard Laursen
8f4150e5a0
fix: Add Accept header to auth metadata request ( #901 )
2025-10-13 15:29:47 +01:00
Luca Chang
59cb50463a
Default to S256 code challenge if not specified in authorization server metadata ( #992 )
2025-10-07 15:29:44 +01:00
Inna Harper
1150b1d843
run prettier ( #995 )
2025-10-02 18:21:00 +01:00
Konstantin Konstantinov
856d9ec9dd
MCP: Icons type as per SEP-973, spec types test improvements, ImplementationSchema use IconsSchema ( #947 )
2025-09-30 22:15:32 +01:00
adam jones
7d29cee2ba
fix: change Icon.sizes from string to string[] ( #981 )
2025-09-29 19:40:12 +01:00
Arjun Kumar
7146eede0b
fix: prevent infinite recursion when server throws 401 after successful authentication ( #945 )
...
Co-authored-by: Vinicius Costa <viniciuscsouza@yahoo.com.br>
Co-authored-by: Tyler James Leonhardt <2644648+TylerLeonhardt@users.noreply.github.com>
Co-authored-by: Blust.AI <159488814+blustAI@users.noreply.github.com>
Co-authored-by: Eugene <eugene@blust.ai>
2025-09-27 17:40:59 +01:00
Blust.AI
1d475bb3f7
fix(auth-router): correct Protected Resource Metadata for pathful RS and add explicit resourceServerUrl (RFC 9728) ( #858 )
...
Co-authored-by: Eugene <eugene@blust.ai>
2025-09-22 15:32:29 +01:00
Tyler James Leonhardt
9841a6cf29
Use redirect Uri passed in in demoInMemoryOAuthProvider ( #931 )
2025-09-22 15:29:39 +01:00
Jakub Kopecký
24b3972931
fix: prevent streamable http wite after end from crashing the node process ( #933 )
2025-09-17 10:51:37 +01:00
Inna Harper
b28c297184
ignore icons for now ( #938 )
2025-09-11 20:34:09 +01:00
Cliff Hall
ebf39330f3
Fix automatic log level handling for sessionless connections ( #917 )
2025-09-09 21:35:08 +01:00
Khanh Nguyen
5dd7a2b700
feat: add _meta field support to tool definitions ( #922 )
...
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
2025-09-09 14:39:52 +01:00
David Soria Parra
4de54fed0c
Add the checkIcon test, so that tests aren't failing anymore
2025-09-09 14:30:40 +01:00
Jesse Lumarie
217756edf7
mcp: update SDK for SEP 973 + add to example server ( #904 )
...
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
2025-09-09 12:21:03 +01:00
Cliff Hall
3dd074f8a2
Fix the SDK vs Spec types test that is breaking CI ( #908 )
2025-08-29 14:03:19 -04:00
Cliff Hall
79d11dc53f
Automatic handling of logging level ( #882 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
2025-08-27 15:09:07 -04:00
Paul Carleton
1f5950be01
[auth] OAuth protected-resource-metadata: fallback on 4xx not just 404 ( #879 )
...
Co-authored-by: adam jones <domdomegg+git@gmail.com>
2025-08-19 15:43:09 +01:00
Paul Carleton
64f7cdd09b
restrict url schemes allowed in oauth metadata ( #877 )
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-08-19 14:39:21 +00:00
Marcelo Paternostro
abb2f0aa14
feature(middleware): Composable fetch middleware for auth and cross‑cutting concerns ( #485 )
...
Co-authored-by: David Soria Parra <davidsp@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-08-18 14:11:15 +01:00
Arjun Kumar
aad33a15a8
fix: pass fetchfn parameter to registerClient and refreshAuthorizatio… ( #850 )
2025-08-14 15:06:18 +01:00
Dale Seo
4d0977bc91
Fix quit command in Example client with OAuth ( #864 )
2025-08-11 19:23:07 +01:00
Xiao Yijun
f657ead472
fix: retry next endpoint on CORS error during auth server discovery ( #827 )
2025-08-04 15:43:09 +01:00
Grimmer Kang
31acdcbb18
fix: prevent responses being sent to wrong client when multiple transports connect ( #820 )
2025-07-29 14:07:01 +01:00
Frédéric Barthelet
ee16173865
(fix): Update fallbackRequestHandler type to match _requestHandlers leaves type ( #784 )
2025-07-29 14:06:27 +01:00
Xiao Yijun
bb7cccc3ba
feat: support oidc discovery in client sdk ( #652 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-07-24 14:11:48 +01:00
Jonathan Wang
62c608d8ce
fix: Explicitly declare accpet type to json when exchanging oauth token ( #801 )
2025-07-24 13:50:54 +01:00
Mason Chen
83168250f5
Fix indent ( #807 )
2025-07-24 12:49:47 +00:00
Cliff Hall
c7887c082c
Add more robust base64 check ( #786 )
2025-07-21 09:57:40 +01:00
Christian Daguerre
2db0dbebe7
fix client id issuance date should only be sent when generated ( #775 )
2025-07-17 18:51:51 +01:00
Luca Chang
9d2a0aeb7b
fix: consistently use consumer-provided fetch function ( #767 )
2025-07-17 17:57:54 +01:00
Jesse
16ea27783c
fix(731): StreamableHTTPClientTransport Fails to Reconnect on Non-Resumable Streams ( #732 )
2025-07-15 17:43:02 +01:00
Jesse
af61a086ae
feat(protocol): Debounce notifications to improve network efficiancy ( #746 )
2025-07-15 09:40:17 +01:00
Jonathan Wang
f3584f2a41
fix: use authorization_server_url as issuer when fetching metadata ( #763 )
2025-07-14 17:24:10 +01:00
Glen Maddern
4b2ad0385d
Adding invalidateCredentials() to OAuthClientProvider ( #570 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
2025-07-14 17:11:52 +01:00
Christian Daguerre
cc9ea7fd21
make client side client_id generation configurable in the oauth router ( #734 )
2025-07-14 17:07:50 +01:00
Daniel Kelleher
a9c907dd70
Add prompt=consent for OIDC offline_access scope ( #681 )
2025-07-14 14:47:09 +01:00
Daniel Kelleher
5b99c24bda
Add OIDC ID token support ( #680 )
2025-07-14 12:22:04 +00:00
