[auth] Scenarios for scope selection

examples/clients/typescript/auth-test-bad-prm.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that always uses root-based PRM discovery.
+ * BUG: Ignores the resource_metadata URL from WWW-Authenticate header.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Use root-based PRM discovery exclusively
+ const resourceMetadataUrl = new URL(
+ '/.well-known/oauth-protected-resource',
+ typeof serverUrl === 'string' ? serverUrl : serverUrl.origin
+ );
+
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-bad-prm <server-url>');

examples/clients/typescript/auth-test-ignore-403.ts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that only responds to 401, not 403.
+ * BUG: Ignores 403 responses which are used for step-up auth.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Only respond to 401, not 403
+ if (response.status !== 401) {
+ return;
+ }
+
+ const { resourceMetadataUrl, scope } =
+ extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ // Call tool to trigger step-up auth
+ await client.callTool({ name: 'test-tool', arguments: {} });
+ logger.debug('✅ Successfully called tool');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-403 <server-url>');

examples/clients/typescript/auth-test-ignore-scope.ts

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that ignores the scope from WWW-Authenticate header.
+ * BUG: Doesn't pass the scope parameter from the 401 response.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Don't read the scope from the header
+ const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ // scope deliberately omitted
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-scope <server-url>');

examples/clients/typescript/auth-test-bad-prm.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that always uses root-based PRM discovery.
+ * BUG: Ignores the resource_metadata URL from WWW-Authenticate header.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Use root-based PRM discovery exclusively
+ const resourceMetadataUrl = new URL(
+ '/.well-known/oauth-protected-resource',
+ typeof serverUrl === 'string' ? serverUrl : serverUrl.origin
+ );
+
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-bad-prm <server-url>');

examples/clients/typescript/auth-test-ignore-403.ts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that only responds to 401, not 403.
+ * BUG: Ignores 403 responses which are used for step-up auth.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Only respond to 401, not 403
+ if (response.status !== 401) {
+ return;
+ }
+
+ const { resourceMetadataUrl, scope } =
+ extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ // Call tool to trigger step-up auth
+ await client.callTool({ name: 'test-tool', arguments: {} });
+ logger.debug('✅ Successfully called tool');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-403 <server-url>');

examples/clients/typescript/auth-test-ignore-scope.ts

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that ignores the scope from WWW-Authenticate header.
+ * BUG: Doesn't pass the scope parameter from the 401 response.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Don't read the scope from the header
+ const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ // scope deliberately omitted
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-scope <server-url>');

examples/clients/typescript/auth-test-bad-prm.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that always uses root-based PRM discovery.
+ * BUG: Ignores the resource_metadata URL from WWW-Authenticate header.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Use root-based PRM discovery exclusively
+ const resourceMetadataUrl = new URL(
+ '/.well-known/oauth-protected-resource',
+ typeof serverUrl === 'string' ? serverUrl : serverUrl.origin
+ );
+
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-bad-prm <server-url>');

examples/clients/typescript/auth-test-ignore-403.ts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that only responds to 401, not 403.
+ * BUG: Ignores 403 responses which are used for step-up auth.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Only respond to 401, not 403
+ if (response.status !== 401) {
+ return;
+ }
+
+ const { resourceMetadataUrl, scope } =
+ extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ // Call tool to trigger step-up auth
+ await client.callTool({ name: 'test-tool', arguments: {} });
+ logger.debug('✅ Successfully called tool');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-403 <server-url>');

examples/clients/typescript/auth-test-ignore-scope.ts

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that ignores the scope from WWW-Authenticate header.
+ * BUG: Doesn't pass the scope parameter from the 401 response.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Don't read the scope from the header
+ const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ // scope deliberately omitted
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-scope <server-url>');

examples/clients/typescript/auth-test-bad-prm.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that always uses root-based PRM discovery.
+ * BUG: Ignores the resource_metadata URL from WWW-Authenticate header.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Use root-based PRM discovery exclusively
+ const resourceMetadataUrl = new URL(
+ '/.well-known/oauth-protected-resource',
+ typeof serverUrl === 'string' ? serverUrl : serverUrl.origin
+ );
+
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-bad-prm <server-url>');

examples/clients/typescript/auth-test-ignore-403.ts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that only responds to 401, not 403.
+ * BUG: Ignores 403 responses which are used for step-up auth.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Only respond to 401, not 403
+ if (response.status !== 401) {
+ return;
+ }
+
+ const { resourceMetadataUrl, scope } =
+ extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ // Call tool to trigger step-up auth
+ await client.callTool({ name: 'test-tool', arguments: {} });
+ logger.debug('✅ Successfully called tool');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-403 <server-url>');

examples/clients/typescript/auth-test-ignore-scope.ts

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that ignores the scope from WWW-Authenticate header.
+ * BUG: Doesn't pass the scope parameter from the 401 response.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Don't read the scope from the header
+ const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ // scope deliberately omitted
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-scope <server-url>');

examples/clients/typescript/auth-test-bad-prm.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that always uses root-based PRM discovery.
+ * BUG: Ignores the resource_metadata URL from WWW-Authenticate header.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Use root-based PRM discovery exclusively
+ const resourceMetadataUrl = new URL(
+ '/.well-known/oauth-protected-resource',
+ typeof serverUrl === 'string' ? serverUrl : serverUrl.origin
+ );
+
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-bad-prm <server-url>');

examples/clients/typescript/auth-test-ignore-403.ts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that only responds to 401, not 403.
+ * BUG: Ignores 403 responses which are used for step-up auth.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Only respond to 401, not 403
+ if (response.status !== 401) {
+ return;
+ }
+
+ const { resourceMetadataUrl, scope } =
+ extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ // Call tool to trigger step-up auth
+ await client.callTool({ name: 'test-tool', arguments: {} });
+ logger.debug('✅ Successfully called tool');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-403 <server-url>');

examples/clients/typescript/auth-test-ignore-scope.ts

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that ignores the scope from WWW-Authenticate header.
+ * BUG: Doesn't pass the scope parameter from the 401 response.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Don't read the scope from the header
+ const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ // scope deliberately omitted
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-scope <server-url>');

examples/clients/typescript/auth-test-bad-prm.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that always uses root-based PRM discovery.
+ * BUG: Ignores the resource_metadata URL from WWW-Authenticate header.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Use root-based PRM discovery exclusively
+ const resourceMetadataUrl = new URL(
+ '/.well-known/oauth-protected-resource',
+ typeof serverUrl === 'string' ? serverUrl : serverUrl.origin
+ );
+
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-bad-prm <server-url>');

examples/clients/typescript/auth-test-ignore-403.ts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that only responds to 401, not 403.
+ * BUG: Ignores 403 responses which are used for step-up auth.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Only respond to 401, not 403
+ if (response.status !== 401) {
+ return;
+ }
+
+ const { resourceMetadataUrl, scope } =
+ extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ // Call tool to trigger step-up auth
+ await client.callTool({ name: 'test-tool', arguments: {} });
+ logger.debug('✅ Successfully called tool');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-403 <server-url>');

examples/clients/typescript/auth-test-ignore-scope.ts

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that ignores the scope from WWW-Authenticate header.
+ * BUG: Doesn't pass the scope parameter from the 401 response.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Don't read the scope from the header
+ const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ // scope deliberately omitted
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-scope <server-url>');

examples/clients/typescript/auth-test-bad-prm.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that always uses root-based PRM discovery.
+ * BUG: Ignores the resource_metadata URL from WWW-Authenticate header.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Use root-based PRM discovery exclusively
+ const resourceMetadataUrl = new URL(
+ '/.well-known/oauth-protected-resource',
+ typeof serverUrl === 'string' ? serverUrl : serverUrl.origin
+ );
+
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-bad-prm <server-url>');

examples/clients/typescript/auth-test-ignore-403.ts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that only responds to 401, not 403.
+ * BUG: Ignores 403 responses which are used for step-up auth.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Only respond to 401, not 403
+ if (response.status !== 401) {
+ return;
+ }
+
+ const { resourceMetadataUrl, scope } =
+ extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ // Call tool to trigger step-up auth
+ await client.callTool({ name: 'test-tool', arguments: {} });
+ logger.debug('✅ Successfully called tool');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-403 <server-url>');

examples/clients/typescript/auth-test-ignore-scope.ts

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that ignores the scope from WWW-Authenticate header.
+ * BUG: Doesn't pass the scope parameter from the 401 response.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Don't read the scope from the header
+ const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ // scope deliberately omitted
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-scope <server-url>');

examples/clients/typescript/auth-test-bad-prm.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that always uses root-based PRM discovery.
+ * BUG: Ignores the resource_metadata URL from WWW-Authenticate header.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Use root-based PRM discovery exclusively
+ const resourceMetadataUrl = new URL(
+ '/.well-known/oauth-protected-resource',
+ typeof serverUrl === 'string' ? serverUrl : serverUrl.origin
+ );
+
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-bad-prm <server-url>');

examples/clients/typescript/auth-test-ignore-403.ts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that only responds to 401, not 403.
+ * BUG: Ignores 403 responses which are used for step-up auth.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Only respond to 401, not 403
+ if (response.status !== 401) {
+ return;
+ }
+
+ const { resourceMetadataUrl, scope } =
+ extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ scope,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ // Call tool to trigger step-up auth
+ await client.callTool({ name: 'test-tool', arguments: {} });
+ logger.debug('✅ Successfully called tool');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-403 <server-url>');

examples/clients/typescript/auth-test-ignore-scope.ts

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+ auth,
+ extractWWWAuthenticateParams,
+ UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that ignores the scope from WWW-Authenticate header.
+ * BUG: Doesn't pass the scope parameter from the 401 response.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+ const handle401Broken = async (
+ response: Response,
+ provider: ConformanceOAuthProvider,
+ next: FetchLike,
+ serverUrl: string | URL
+ ): Promise<void> => {
+ // BUG: Don't read the scope from the header
+ const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+ let result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ // scope deliberately omitted
+ fetchFn: next
+ });
+
+ if (result === 'REDIRECT') {
+ const authorizationCode = await provider.getAuthCode();
+ result = await auth(provider, {
+ serverUrl,
+ resourceMetadataUrl,
+ authorizationCode,
+ fetchFn: next
+ });
+ if (result !== 'AUTHORIZED') {
+ throw new UnauthorizedError(
+ `Authentication failed with result: ${result}`
+ );
+ }
+ }
+ };
+
+ const client = new Client(
+ { name: 'test-auth-client-broken', version: '1.0.0' },
+ { capabilities: {} }
+ );
+
+ const oauthFetch = withOAuthRetry(
+ 'test-auth-client-broken',
+ new URL(serverUrl),
+ handle401Broken
+ )(fetch);
+
+ const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+ fetch: oauthFetch
+ });
+
+ await client.connect(transport);
+ logger.debug('✅ Successfully connected to MCP server');
+
+ await client.listTools();
+ logger.debug('✅ Successfully listed tools');
+
+ await transport.close();
+ logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-scope <server-url>');