Fixed 5 instances of hardcoded "https://resource.example.com" in OAuth
protected resource metadata mocks to use the actual resourceBaseUrl.href.
This resolves test failures where the auth validation was rejecting
requests because the resource URL in the metadata didn't match the
actual test server URL.
The failing tests were:
- attempts auth flow on 401 during SSE connection
- attempts auth flow on 401 during POST request
- refreshes expired token during SSE connection
- refreshes expired token during POST request
- redirects to authorization if refresh token flow fails
All SSE tests now pass (17/17).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* add type and schema for protected resource metadata
* add private variable to keep track of
authorization server url to avoid fetching Protected Resource Metadata every time
* change auth flow to use authroization server and
add function to discover protected resource metadata
* add/modify tests for new added auth functions
* modify test to use the authorization server
* remove unused variable
* add resource parameter when building auth url
* Change resource to use the protected resource metadata
* resolve typo.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* Update src/client/sse.ts import.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove log.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* Update section title.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove log.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* make backwards compatibile
* s/resourceServerUrl/serverUrl/g for backwards compat
* fix test comment
---------
Co-authored-by: itsuki <itsuki.enjyoy@gmail.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Downgrade Ajv from v8.17.1 to v6.12.6 to resolve ESM/CJS module compatibility issues that were causing "does not provide an export named 'Ajv'" errors in projects using this SDK. This ensures consistent import patterns across different module systems.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update McpServer to support registering tools with outputSchema
- Add automatic content generation from structuredContent for backward compatibility
- Add validation to ensure proper usage of structuredContent vs content
- Add comprehensive tests for outputSchema functionality
- Add example servers demonstrating structured output usage
- Update existing test to match new backward compatibility behavior
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add outputSchema support to Tool interface with proper documentation
- Split CallToolResult into structured and unstructured variants
- Change structuredContent from string to object type
- Add validation that tools without outputSchema cannot return structuredContent
- Add validation that tools with outputSchema must return structuredContent
- Update client to validate structured content as object (no JSON parsing)
- Update tests to use object format for structuredContent
- Add tests for new validation constraints
- Update LATEST_PROTOCOL_VERSION to DRAFT-2025-v2
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Cache tool output schemas when listing tools
- Validate structuredContent against outputSchema during callTool
- Enforce that tools with outputSchema must return structuredContent
- Add json-schema-to-zod dependency for schema conversion
- Add comprehensive tests for validation scenarios
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
When an SSE client connects with a custom path (e.g., /api/v1/custom/sse),
ensure the endpoint URL maintains the same base path structure but with
/messages instead of /sse. This fixes issues where custom endpoints were
getting collapsed to the root path.
Should fix issues reported in modelcontextprotocol/inspector#313 and #296
Tests demonstrating the issue were added in PR #439🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add optional scope parameter to startAuthorization function signature
- Include scope in authorization URL query parameters when provided
- Update auth function to pass through scope from provider.clientMetadata
- Add tests to verify scope is correctly included/excluded from auth URL
This enhancement allows clients to specify authorization scopes during the OAuth flow.
* In src/client/index.test.ts added tests:
- "should connect new client to old, supported server version"
- should negotiate version when client is old, and newer server supports its version"
- "should throw when client is old, and server doesn't support its version"
* In src/client/index.test.ts added tests:
- "should connect new client to old, supported server version"
- should negotiate version when client is old, and newer server supports its version"
- "should throw when client is old, and server doesn't support its version"
* This fixes#378
* In types.ts
- set LATEST_PROTOCOL_VERSION to "2025-03-26"
- add "2025-03-26" to SUPPORTED_PROTOCOL_VERSIONS
* In auth.test.ts
- in test "returns metadata when discovery succeeds"
- expect "MCP-Protocol-Version" to be "2025-03-26"
