feat: OAuth 2.1 authorization flow for MCP servers

packages/types/src/mcp.ts

@@ -55,6 +55,7 @@ export type McpServer = {
 	name: string
 	config: string
 	status: "connected" | "connecting" | "disconnected"
+	authStatus?: "unauthenticated" | "awaiting_auth" | "authenticated"
 	error?: string
 	errorHistory?: McpErrorEntry[]
 	tools?: McpTool[]
@@ -105,16 +106,34 @@ export type McpToolCallResponse = {
 		| {
 				type: "text"
 				text: string
+				annotations?: {
+					audience?: ("assistant" | "user")[]
+					priority?: number
+					lastModified?: string
+				}
+				_meta?: Record<string, any> // eslint-disable-line @typescript-eslint/no-explicit-any
 		  }
 		| {
 				type: "image"
 				data: string
 				mimeType: string
+				annotations?: {
+					audience?: ("assistant" | "user")[]
+					priority?: number
+					lastModified?: string
+				}
+				_meta?: Record<string, any> // eslint-disable-line @typescript-eslint/no-explicit-any
 		  }
 		| {
 				type: "audio"
 				data: string
 				mimeType: string
+				annotations?: {
+					audience?: ("assistant" | "user")[]
+					priority?: number
+					lastModified?: string
+				}
+				_meta?: Record<string, any> // eslint-disable-line @typescript-eslint/no-explicit-any
 		  }
 		| {
 				type: "resource"
@@ -124,6 +143,26 @@ export type McpToolCallResponse = {
 					text?: string
 					blob?: string
 				}
+				annotations?: {
+					audience?: ("assistant" | "user")[]
+					priority?: number
+					lastModified?: string
+				}
+				_meta?: Record<string, any> // eslint-disable-line @typescript-eslint/no-explicit-any
+		  }
+		| {
+				type: "resource_link"
+				uri: string
+				name: string
+				description?: string
+				mimeType?: string
+				size?: number
+				annotations?: {
+					audience?: ("assistant" | "user")[]
+					priority?: number
+					lastModified?: string
+				}
+				_meta?: Record<string, any> // eslint-disable-line @typescript-eslint/no-explicit-any
 		  }
 	>
 	isError?: boolean

src/activate/handleUri.ts

@@ -43,6 +43,17 @@ export const handleUri = async (uri: vscode.Uri) => {
 			)
 			break
 		}
+		case "/mcp-auth/callback": {
+			const code = query.get("code")
+			const state = query.get("state")
+			if (code && state) {
+				const mcpHub = visibleProvider.getMcpHub()
+				if (mcpHub) {
+					mcpHub.handleOAuthCallback(code, state)
+				}
+			}
+			break
+		}
 		default:
 			break
 	}

src/i18n/locales/en/mcp.json

@@ -23,6 +23,8 @@
 		"already_refreshing": "MCP servers are already refreshing.",
 		"refreshing_all": "Refreshing all MCP servers...",
 		"all_refreshed": "All MCP servers have been refreshed.",
-		"project_config_deleted": "Project MCP configuration file deleted. All project MCP servers have been disconnected."
+		"project_config_deleted": "Project MCP configuration file deleted. All project MCP servers have been disconnected.",
+		"server_requires_auth": "{{serverName}} requires authentication. Please complete the sign-in flow in your browser.",
+		"server_auth_failed": "{{serverName}} authentication failed: {{reason}}"
 	}
 }