The MCP TypeScript SDK followed redirects to any origin; a Claude Code change also attached transport custom headers to OAuth requests, so a redirecting authorization server could leak API keys.

@@ -1,4 +1,4 @@-import { Transport, FetchLike } from '../shared/transport.js';+import { Transport, FetchLike, createFetchWithInit, normalizeHeaders } from '../shared/transport.js'; import { isInitializedNotification, isJSONRPCRequest, isJSONRPCResponse, JSONRPCMessage, JSONRPCMessageSchema } from '../types.js'; import { auth, AuthResult, extractWWWAuthenticateParams, OAuthClientProvider, UnauthorizedError } from './auth.js'; import { EventSourceParserStream } from 'eventsource-parser/stream';@@ -156,11 +156,14 @@ export class StreamableHTTPClientTransport implements Transport {          let result: AuthResult;         try {+            // Wrap fetch to automatically include base RequestInit options+            const fetchFn = createFetchWithInit(this._fetch, this._requestInit);+             result = await auth(this._authProvider, {                 serverUrl: this._url,

                 resourceMetadataUrl: this._resourceMetadataUrl,                 scope: this._scope,-                fetchFn: this._fetch+                fetchFn

             });         } catch (error) {             this.onerror?.(error as Error);@@ -190,7 +193,7 @@ export class StreamableHTTPClientTransport implements Transport {             headers['mcp-protocol-version'] = this._protocolVersion;         } 

-        const extraHeaders = this._normalizeHeaders(this._requestInit?.headers);+        const extraHeaders = normalizeHeaders(this._requestInit?.headers);

          return new Headers({             ...headers,@@ -255,19 +258,6 @@ export class StreamableHTTPClientTransport implements Transport {         return Math.min(initialDelay * Math.pow(growFactor, attempt), maxDelay);     } 

-    private _normalizeHeaders(headers: HeadersInit | undefined): Record<string, string> {-        if (!headers) return {};--        if (headers instanceof Headers) {-            return Object.fromEntries(headers.entries());-        }--        if (Array.isArray(headers)) {-            return Object.fromEntries(headers);-        }--        return { ...(headers as Record<string, string>) };-    }      /**      * Schedule a reconnection attempt with exponential backoff

@@ -2,6 +2,51 @@ import { JSONRPCMessage, MessageExtraInfo, RequestId } from '../types.js';  export type FetchLike = (url: string | URL, init?: RequestInit) => Promise<Response>; 

+/**+ * Normalizes HeadersInit to a plain Record<string, string> for manipulation.+ * Handles Headers objects, arrays of tuples, and plain objects.+ */+export function normalizeHeaders(headers: HeadersInit | undefined): Record<string, string> {+    if (!headers) return {};++    if (headers instanceof Headers) {+        return Object.fromEntries(headers.entries());+    }++    if (Array.isArray(headers)) {+        return Object.fromEntries(headers);+    }++    return { ...(headers as Record<string, string>) };+}++/**+ * Creates a fetch function that includes base RequestInit options.+ * This ensures requests inherit settings like credentials, mode, headers, etc. from the base init.+ *+ * @param baseFetch - The base fetch function to wrap (defaults to global fetch)

+ * @param baseInit - The base RequestInit to merge with each request+ * @returns A wrapped fetch function that merges base options with call-specific options+ */+export function createFetchWithInit(baseFetch: FetchLike = fetch, baseInit?: RequestInit): FetchLike {+    if (!baseInit) {+        return baseFetch;+    }

++    // Return a wrapped fetch that merges base RequestInit with call-specific init+    return async (url: string | URL, init?: RequestInit): Promise<Response> => {+        const mergedInit: RequestInit = {+            ...baseInit,+            ...init,+            // Headers need special handling - merge instead of replace+            headers: init?.headers+                ? { ...normalizeHeaders(baseInit.headers), ...normalizeHeaders(init.headers) }+                : baseInit.headers+        };+        return baseFetch(url, mergedInit);+    };+}+ /**  * Options for sending a JSON-RPC message.  */

@@ -1,5 +1,5 @@ import { EventSource, type ErrorEvent, type EventSourceInit } from 'eventsource';-import { Transport, FetchLike } from '../shared/transport.js';+import { Transport, FetchLike, createFetchWithInit } from '../shared/transport.js'; import { JSONRPCMessage, JSONRPCMessageSchema } from '../types.js'; import { auth, AuthResult, extractWWWAuthenticateParams, OAuthClientProvider, UnauthorizedError } from './auth.js'; 

@@ -93,11 +93,14 @@ export class SSEClientTransport implements Transport { 

         let result: AuthResult;         try {+            // Wrap fetch to automatically include base RequestInit options+            const fetchFn = createFetchWithInit(this._fetch, this._requestInit);+             result = await auth(this._authProvider, {                 serverUrl: this._url,

                 resourceMetadataUrl: this._resourceMetadataUrl,                 scope: this._scope,-                fetchFn: this._fetch+                fetchFn             });         } catch (error) {             this.onerror?.(error as Error);@@ -215,12 +218,15 @@ export class SSEClientTransport implements Transport {             throw new UnauthorizedError('No auth provider');

         } +        // Wrap fetch to automatically include base RequestInit options+        const fetchFn = createFetchWithInit(this._fetch, this._requestInit);+         const result = await auth(this._authProvider, {             serverUrl: this._url,

             authorizationCode,             resourceMetadataUrl: this._resourceMetadataUrl,             scope: this._scope,-            fetchFn: this._fetch+            fetchFn         });         if (result !== 'AUTHORIZED') {             throw new UnauthorizedError('Failed to authorize');@@ -256,11 +262,14 @@ export class SSEClientTransport implements Transport {                     this._resourceMetadataUrl = resourceMetadataUrl;

                     this._scope = scope; +                    // Wrap fetch to automatically include base RequestInit options+                    const fetchFn = createFetchWithInit(this._fetch, this._requestInit);+                     const result = await auth(this._authProvider, {                         serverUrl: this._url,

                         resourceMetadataUrl: this._resourceMetadataUrl,                         scope: this._scope,-                        fetchFn: this._fetch+                        fetchFn                     });                     if (result !== 'AUTHORIZED') {                         throw new UnauthorizedError();

@@ -2,11 +2,14 @@ import type { FetchLike, JSONRPCMessage, Transport } from '@modelcontextprotocol import {     brandedHasInstance,     createFetchWithInit,

+    fetchLeavingRedirects,+    fetchWithinOrigin,     JSONRPCMessageSchema,     SdkError,     SdkErrorCode,     SdkHttpError,-    stampErrorBrands+    stampErrorBrands,+    unfollowedRedirect

 } from '@modelcontextprotocol/core-internal'; import type { ErrorEvent, EventSourceInit } from 'eventsource'; import { EventSource } from 'eventsource';@@ -113,13 +116,35 @@ export type SSEClientTransportOptions = {      * `mcp-protocol-version`. A caller-supplied `Authorization` value is therefore only sent      * while the provider has no token, which lets a static API key fall back to OAuth once      * the provider obtains one.

+     *

+     * A `redirect` of `'error'` or `'manual'` is passed to fetch as it is for the `POST`+     * requests that carry messages. For the OAuth requests, and for any other value,+     * `redirect` is consulted only when+     * {@linkcode SSEClientTransportOptions.redirectPolicy | redirectPolicy} is `'follow'`. The+     * request that begins the stream does not read it.      */     requestInit?: RequestInit;

      /**      * Custom fetch implementation used for all network requests.      */     fetch?: FetchLike;

++    /**+     * How a redirect of one of the transport's requests is handled, including the OAuth+     * requests it makes for {@linkcode SSEClientTransportOptions.authProvider | authProvider}.+     * The option does not reach requests that a provider makes with a fetch of its own, such as+     * those of the `assertion` callback of a `CrossAppAccessProvider`.+     *

+     * - `'same-origin'` (default): a redirect is followed only when it stays within the origin+     *   of the request and keeps the method, and any other redirect fails the request.+     * - `'follow'`: redirects are left to the fetch implementation, as in earlier versions. It+     *   follows them to any origin unless `requestInit.redirect` says otherwise, which the+     *   request that begins the stream does not read.

+     *+     * @default 'same-origin'+     */+    redirectPolicy?: 'same-origin' | 'follow'; };  /**@@ -141,6 +166,7 @@ export class SSEClientTransport implements Transport {     private _skipIssuerMetadataValidation?: boolean;     private _fetch?: FetchLike;     private _fetchWithInit: FetchLike;+    private _redirectPolicy?: 'same-origin' | 'follow';     private _dpop?: Middleware;     private _protocolVersion?: string; @@ -171,13 +197,26 @@ export class SSEClientTransport implements Transport {         } else {             this._authProvider = opts?.authProvider;         }+        this._redirectPolicy = opts?.redirectPolicy;         this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);+        if (this._redirectPolicy === 'follow') this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);     }      private _last401Response?: Response;     // True between a 401-triggered reconnect and the next successful open.     private _connectAuthRetried = false; +    /** `baseFetch` with redirects handled as `redirectPolicy` says. */+    private _redirects(baseFetch: FetchLike): FetchLike {+        return this._redirectPolicy === 'follow' ? baseFetch : fetchWithinOrigin(baseFetch);+    }++    /** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */+    private _unfollowedRedirect(url: string | URL, response: Response): string | undefined {+        const text = this._redirectPolicy === 'follow' ? undefined : unfollowedRedirect(url, response);+        return text && `${text} (redirectPolicy: 'same-origin')`;+    }+     private async _commonHeaders(): Promise<Headers> {         // Start from the caller-supplied `requestInit.headers` and `set()` the         // transport-managed headers on top. `Headers.set` compares names@@ -211,9 +250,10 @@ export class SSEClientTransport implements Transport {      private _startOrAuth(): Promise<void> {

@@ -4,6 +4,8 @@ import type { FetchLike, JSONRPCMessage, Transport } from '@modelcontextprotocol import {     createFetchWithInit,     encodeMcpParamValue,

+    fetchLeavingRedirects,+    fetchWithinOrigin,     isInitializedNotification,     isInitializeRequest,     isJSONRPCErrorResponse,@@ -16,7 +18,8 @@ import {     PROTOCOL_VERSION_META_KEY,     SdkError,     SdkErrorCode,-    SdkHttpError+    SdkHttpError,+    unfollowedRedirect

 } from '@modelcontextprotocol/core-internal'; import { EventSourceParserStream } from 'eventsource-parser/stream'; @@ -189,6 +192,11 @@ export type StreamableHTTPClientTransportOptions = {      * token, `mcp-session-id`, and `mcp-protocol-version`. A caller-supplied `Authorization`      * value is therefore only sent while the provider has no token, which lets a static API      * key fall back to OAuth once the provider obtains one.

+     *

+     * A `redirect` of `'error'` or `'manual'` is passed to fetch as it is for the POST, GET and+     * DELETE requests to the server URL. For the OAuth requests, and for any other value,+     * `redirect` is consulted only when+     * {@linkcode StreamableHTTPClientTransportOptions.redirectPolicy | redirectPolicy} is `'follow'`.      */     requestInit?: RequestInit; @@ -197,6 +205,21 @@ export type StreamableHTTPClientTransportOptions = {      */     fetch?: FetchLike; +    /**+     * How a redirect of one of the transport's requests is handled, including the OAuth+     * requests it makes for {@linkcode StreamableHTTPClientTransportOptions.authProvider | authProvider}.+     * The option does not reach requests that a provider makes with a fetch of its own, such as+     * those of the `assertion` callback of a `CrossAppAccessProvider`.+     *

+     * - `'same-origin'` (default): a redirect is followed only when it stays within the origin+     *   of the request and keeps the method, and any other redirect fails the request.+     * - `'follow'`: redirects are left to the fetch implementation, as in earlier versions. It+     *   follows them to any origin unless `requestInit.redirect` says otherwise.

+     *+     * @default 'same-origin'+     */+    redirectPolicy?: 'same-origin' | 'follow';+     /**      * Options to configure the reconnection behavior.      */@@ -328,6 +351,7 @@ export class StreamableHTTPClientTransport implements Transport {     private _skipIssuerMetadataValidation?: boolean;     private _fetch?: FetchLike;     private _fetchWithInit: FetchLike;+    private _redirectPolicy?: 'same-origin' | 'follow';     private _sessionId?: string;     private _reconnectionOptions: StreamableHTTPReconnectionOptions;     private _protocolVersion?: string;@@ -371,7 +395,9 @@ export class StreamableHTTPClientTransport implements Transport {         } else {             this._authProvider = opts?.authProvider;         }+        this._redirectPolicy = opts?.redirectPolicy;         this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);+        if (this._redirectPolicy === 'follow') this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);         this._sessionId = opts?.sessionId;         this._protocolVersion = opts?.protocolVersion;         this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;@@ -448,6 +474,17 @@ export class StreamableHTTPClientTransport implements Transport {         });     } +    /** `baseFetch` with redirects handled as `redirectPolicy` says. */+    private _redirects(baseFetch: FetchLike): FetchLike {+        return this._redirectPolicy === 'follow' ? baseFetch : fetchWithinOrigin(baseFetch);+    }++    /** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */+    private _unfollowedRedirect(url: string | URL, response: Response): string | undefined {+        const text = this._redirectPolicy === 'follow' ? undefined : unfollowedRedirect(url, response);+        return text && `${text} (redirectPolicy: 'same-origin')`;+    }+     private async _commonHeaders(): Promise<Headers> {         // Start from the caller-supplied `requestInit.headers` and `set()` the         // transport-managed headers on top. `Headers.set` compares names@@ -562,7 +599,7 @@ export class StreamableHTTPClientTransport implements Transport {

@@ -15,6 +15,7 @@ import type { import {     brandedHasInstance,     checkResourceAllowed,+    fetchWithinOrigin,     LATEST_PROTOCOL_VERSION,     OAuthClientInformationFullSchema,     OAuthError,

@@ -1672,8 +1673,9 @@ export async function discoverOAuthProtectedResourceMetadata(  * error object alone, so the swallow-and-fallthrough heuristic is preserved there.  */ async function fetchWithCorsRetry(url: URL, headers?: Record<string, string>, fetchFn: FetchLike = fetch): Promise<Response | undefined> {+    const withinOrigin = fetchWithinOrigin(fetchFn);     try {-        return await fetchFn(url, { headers });+        return await withinOrigin(url, { headers });     } catch (error) {         if (!(error instanceof TypeError) || !CORS_IS_POSSIBLE) {             throw error;@@ -1682,7 +1684,7 @@ async function fetchWithCorsRetry(url: URL, headers?: Record<string, string>, fe             // Could be a CORS preflight rejection caused by our custom header. Retry as a simple             // request: if that succeeds, we've sidestepped the preflight.             try {-                return await fetchFn(url, {});+                return await withinOrigin(url, {});             } catch (retryError) {                 if (!(retryError instanceof TypeError)) {                     throw retryError;@@ -1728,7 +1730,7 @@ async function tryMetadataDiscovery(url: URL, protocolVersion: string, fetchFn: function shouldAttemptFallback(response: Response | undefined, pathname: string): boolean {     if (!response) return true; // CORS error — always try fallback     if (pathname === '/') return false; // Already at root-    return (response.status >= 400 && response.status < 500) || response.status === 502;+    return (!response.ok && response.status < 500) || response.status === 502; }  /**@@ -1755,7 +1757,7 @@ async function discoverMetadataWithFallback(      let response = await tryMetadataDiscovery(url, protocolVersion, fetchFn); -    // If path-aware discovery fails (4xx or 502 Bad Gateway) and we're not already at root, try fallback to root discovery+    // If path-aware discovery fails (4xx, 502 or a redirect not followed) and we're not already at root, try fallback to root discovery     if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {         const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);         response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);@@ -1933,8 +1935,8 @@ export async function discoverAuthorizationServerMetadata(          if (!response.ok) {             await response.text?.().catch(() => {});-            if ((response.status >= 400 && response.status < 500) || response.status === 502) {-                continue; // Try next URL for 4xx or 502 (Bad Gateway)+            if (response.status < 500 || response.status === 502) {+                continue; // Try next URL for 4xx, 502 (Bad Gateway) or a redirect that was not followed             }             throw new Error(                 `HTTP ${response.status} trying to load ${type === 'oauth' ? 'OAuth' : 'OpenID provider'} metadata from ${endpointUrl}`@@ -2224,7 +2226,7 @@ export async function executeTokenRequest(             // presented, and the token request is presenting credentials to *obtain* one.             requestHeaders.set('DPoP', await dpop.buildProof({ htm: 'POST', htu: tokenUrl }));         }-        return (fetchFn ?? fetch)(tokenUrl, {+        return fetchWithinOrigin(fetchFn ?? fetch)(tokenUrl, {             method: 'POST',             headers: requestHeaders,             body: tokenRequestParams@@ -2547,7 +2549,7 @@ export async function registerClient(         ...(scope === undefined ? {} : { scope })     }; -    const response = await (fetchFn ?? fetch)(registrationUrl, {+    const response = await fetchWithinOrigin(fetchFn ?? fetch)(registrationUrl, {         method: 'POST',         headers: {             'Content-Type': 'application/json'