Function detectMcpAuthType

apps/sim/lib/mcp/oauth/probe.ts:21–89

(
  url: string,
  resolvedIP?: string | null
)

 * SSRF-guarded fetch validates and pins each request itself.
 */
export async function detectMcpAuthType(
  url: string,
  resolvedIP?: string | null
): Promise<McpAuthType> {
  let parsed: URL
  try {
    parsed = new URL(url)
  } catch {
    return 'headers'
  }
  const isLoopbackHttp = parsed.protocol === 'http:' && isLoopbackHostname(parsed.hostname)
  if (parsed.protocol !== 'https:' && !isLoopbackHttp) {
    return 'headers'
  }

  const probeFetch: FetchLike = resolvedIP
    ? createPinnedFetch(resolvedIP)
    : createSsrfGuardedMcpFetch()

  const controller = new AbortController()
  const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS)

  try {
    const res = await probeFetch(url, {
      method: 'POST',
      redirect: 'manual',
      headers: {
        'Content-Type': 'application/json',
        Accept: 'application/json, text/event-stream',
      },
      body: JSON.stringify({
        jsonrpc: '2.0',
        id: 1,
        method: 'initialize',
        params: {
          protocolVersion: '2025-06-18',
          capabilities: {},
          clientInfo: { name: 'sim-platform-probe', version: '1.0.0' },
        },
      }),
      signal: controller.signal,
    })

    const sessionId = res.headers.get('mcp-session-id')
    if (sessionId) {
      void closeMcpSession(url, sessionId, probeFetch)
    }

    if (res.status === 401) {
      const params = extractWWWAuthenticateParams(res)
      // Per RFC 9728, an OAuth-protected resource signals OAuth via
      // `resource_metadata=...` in WWW-Authenticate. `scope=...` is also an
      // OAuth-specific hint. A bare `error="invalid_token"` is generic Bearer
      // and used by plain API-key servers too, so it must not classify as OAuth.
      if (params.resourceMetadataUrl || params.scope) {
        return 'oauth'
      }
      return 'headers'