Summary of Changes

Hello @Nayana-Parameswarappa, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new OAuth client provider to the core package, enabling the application to interact with OAuth 2.0 authorization servers. This foundational component abstracts the complexities of the OAuth flow, allowing for secure authentication and authorization by managing client credentials, tokens, and redirect handling.

Highlights

• New OAuth Client Provider: Introduced MCPOAuthClientProvider which implements the MCPSDK OAuthClientProvider interface, providing core functionality for handling OAuth client-side operations such as saving client information, tokens, code verifiers, and managing authorization redirects.

(From /review-frontend audited by Jacob Richman)

Code Review Summary

The pull request introduces a new MCPOAuthClientProvider class that cleanly implements the OAuthClientProvider interface from the MCP SDK. It serves well as a data container for the OAuth flow. The tests are solid and cover the full OAuth flow as expected.

I do have a couple of suggestions focused on maintainability and readability.

Improvements

1. Type Definition Duplication:
   The type definition for the callback server is defined inline three separate times in packages/core/src/mcp/mcp-oauth-provider.ts (in the property declaration, the setter, and the getter):

   {
     port: Promise<number>;
     waitForResponse: () => Promise<OAuthAuthorizationResponse>;
     close: () => Promise<void>;
   }

   To improve maintainability, consider extracting this into a named interface or type. For example:

   export interface CallbackServer {
     port: Promise<number>;
     waitForResponse: () => Promise<OAuthAuthorizationResponse>;
     close: () => Promise<void>;
   }

   You can then reuse CallbackServer for the _cbServer property, saveCallbackServer, and getSavedCallbackServer.

2. Constructor and _onRedirect Initialization:
   Currently, _onRedirect is defined outside the constructor but assigned inside it, checking for undefined:

     constructor(
       // ...
       onRedirect?: (url: URL) => void,
     ) {
       this._onRedirect =
         onRedirect ||
         ((url) => {
           debugLogger.log(`Redirect to: ${url.toString()}`);
         });
     }
   
     private _onRedirect: (url: URL) => void;

   Since you're using TypeScript parameter properties (e.g., private readonly _redirectUrl), you can simplify this by providing a default parameter directly in the constructor signature:

     constructor(
       private readonly _redirectUrl: string | URL,
       private readonly _clientMetadata: OAuthClientMetadata,
       private readonly _state?: string | undefined,
       private readonly _onRedirect: (url: URL) => void = (url) => {
           debugLogger.log(`Redirect to: ${url.toString()}`);
       }
     ) {}

Conclusion

Overall, the implementation and tests look good. Implementing the above suggestions will help reduce code duplication and simplify the class setup.