agent

type AuthorizationServerMetadata struct {
	// Issuer is the authorization server's issuer identifier URL
	Issuer string `json:"issuer"`

	// AuthorizationEndpoint is the URL for the authorization endpoint
	AuthorizationEndpoint string `json:"authorization_endpoint"`

	// TokenEndpoint is the URL for the token endpoint
	TokenEndpoint string `json:"token_endpoint"`

	// RegistrationEndpoint is the URL for Dynamic Client Registration (optional)
	RegistrationEndpoint string `json:"registration_endpoint,omitempty"`

	// CodeChallengeMethods lists supported PKCE code challenge methods
	// MCP spec requires this field to be present and include "S256"
	CodeChallengeMethods []string `json:"code_challenge_methods_supported,omitempty"`

	// ClientIDMetadataDocumentSupported indicates support for Client ID Metadata Documents
	ClientIDMetadataDocumentSupported bool `json:"client_id_metadata_document_supported,omitempty"`

	// ScopesSupported lists supported OAuth scopes (optional)
	ScopesSupported []string `json:"scopes_supported,omitempty"`

	// ResponseTypesSupported lists supported OAuth response types
	ResponseTypesSupported []string `json:"response_types_supported,omitempty"`

	// GrantTypesSupported lists supported OAuth grant types
	GrantTypesSupported []string `json:"grant_types_supported,omitempty"`

	// TokenEndpointAuthMethodsSupported lists supported token endpoint auth methods
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`
}

type Client struct {
	// contains filtered or unexported fields
}

type ClientConfig struct {
	Endpoint    string
	Transport   string
	Logger      *Logger
	OAuthConfig *OAuthConfig
	Version     string
}

type ClientMetadataDocument struct {
	// ClientID is the HTTPS URL that identifies this client
	// REQUIRED: Must use https scheme and include a path component
	ClientID string `json:"client_id"`

	// ClientName is the human-readable name of the client
	ClientName string `json:"client_name,omitempty"`

	// ClientURI is the URL of the client's home page
	ClientURI string `json:"client_uri,omitempty"`

	// LogoURI is the URL of the client's logo image
	LogoURI string `json:"logo_uri,omitempty"`

	// RedirectURIs are the redirect URIs for OAuth callbacks
	// REQUIRED for authorization code grant
	RedirectURIs []string `json:"redirect_uris"`

	// GrantTypes are the OAuth grant types the client will use
	// Default: ["authorization_code"]
	GrantTypes []string `json:"grant_types,omitempty"`

	// ResponseTypes are the OAuth response types the client will use
	// Default: ["code"]
	ResponseTypes []string `json:"response_types,omitempty"`

	// TokenEndpointAuthMethod is the authentication method for the token endpoint
	// Default: "none" for public clients
	TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"`
}

type Logger struct {
	// contains filtered or unexported fields
}

type MCPServer struct {
	// contains filtered or unexported fields
}

type NotificationHandler func(notification mcp.JSONRPCNotification)

type OAuthConfig struct {
	// Enabled indicates whether OAuth authentication should be used
	Enabled bool

	// ClientID is the OAuth client identifier (optional - will use DCR if not provided)
	ClientID string

	// ClientSecret is the OAuth client secret (optional for public clients)
	ClientSecret string

	// Scopes are the OAuth scopes to request (optional, no default scopes)
	// When ScopeSelectionMode is "manual", these scopes are used directly.
	// When ScopeSelectionMode is "auto", these scopes are used as a fallback
	// if no scopes can be determined from WWW-Authenticate or resource metadata.
	Scopes []string

	// ScopeSelectionMode controls automatic scope selection per MCP spec
	// - "auto" (default): Follow MCP spec priority (secure by default)
	//   Priority 1: Use scope from WWW-Authenticate header
	//   Priority 2: Use scopes_supported from Protected Resource Metadata
	//   Priority 3: Omit scope parameter entirely
	// - "manual": Use only the Scopes field value
	ScopeSelectionMode string

	// RedirectURL is the callback URL for OAuth flow (default: http://localhost:8765/callback)
	//
	// IMPORTANT SECURITY LIMITATION:
	// - HTTPS redirect URIs are NOT currently supported
	// - HTTP is only allowed for localhost/127.0.0.1/[::1] addresses
	// - The callback server runs on localhost only with HTTP
	// - For production OAuth flows requiring HTTPS callbacks, this is a known limitation
	//
	// This design follows OAuth 2.1 best practices for native/desktop applications
	// which use localhost loopback for authorization callbacks.
	RedirectURL string

	// UsePKCE enables Proof Key for Code Exchange (recommended, enabled by default)
	UsePKCE bool

	// AuthorizationTimeout is the maximum time to wait for user authorization (default: 5 minutes)
	AuthorizationTimeout time.Duration

	// UseOIDC enables OpenID Connect features including nonce validation (optional)
	UseOIDC bool

	// RegistrationToken is the OAuth registration access token for Dynamic Client Registration
	// Required if the authorization server has DCR authentication enabled
	RegistrationToken string

	// ResourceURI is the target MCP server URI for RFC 8707 Resource Indicators
	// If empty, automatically derived from endpoint URL
	// This parameter is included in authorization and token requests for better security
	ResourceURI string

	// SkipResourceParam disables RFC 8707 resource parameter inclusion
	// Only use this for testing with older servers that don't support RFC 8707
	// Security: Disabling this weakens token audience binding
	SkipResourceParam bool

	// SkipResourceMetadata disables RFC 9728 Protected Resource Metadata discovery
	// Only use this for testing with older servers that don't support RFC 9728
	// Security: Disabling this may require manual authorization server configuration
	SkipResourceMetadata bool

	// PreferredAuthServer allows selecting a specific authorization server
	// when multiple servers are available in the protected resource metadata
	// If empty, the first server in the list is used
	PreferredAuthServer string

	// SkipPKCEValidation disables checking for PKCE support in AS metadata
	// DANGEROUS: Only use for testing servers that support PKCE but don't advertise it
	// Security: This weakens security by allowing connections to servers without PKCE
	SkipPKCEValidation bool

	// SkipAuthServerDiscovery disables automatic AS metadata discovery
	// Useful for testing with pre-configured endpoints or older servers
	// When enabled, relies on mcp-go's internal discovery mechanisms
	SkipAuthServerDiscovery bool

	// EnableStepUpAuth enables automatic step-up authorization when the server
	// returns 403 Forbidden with insufficient_scope error per MCP spec
	// Default: true (secure by default, provides better UX)
	EnableStepUpAuth bool

	// StepUpMaxRetries limits the number of retry attempts per resource/operation
	// when handling insufficient_scope errors during step-up authorization
	// Default: 2 (prevents infinite authorization loops)
	StepUpMaxRetries int

	// StepUpUserPrompt asks user before requesting additional scopes
	// When false, step-up authorization happens automatically
	// Default: false (automatic for better UX, user can always decline in browser)
	StepUpUserPrompt bool

	// ClientIDMetadataURL is the HTTPS URL hosting the Client ID Metadata Document
	// When set, this URL will be used as the client_id per
	// draft-ietf-oauth-client-id-metadata-document-00
	// Requirements:
	//   - MUST use https scheme (HTTP not allowed, even for localhost)
	//   - MUST contain a path component
	//   - The document at this URL should contain client metadata in JSON format
	// Example: "https://app.example.com/oauth/client-metadata.json"
	ClientIDMetadataURL string

	// DisableCIMD disables Client ID Metadata Documents support
	// When true, falls back to Dynamic Client Registration or manual registration
	// Use this for testing with Authorization Servers that don't support CIMD
	DisableCIMD bool
}

type ProtectedResourceMetadata struct {
	// Resource is the protected resource identifier
	Resource string `json:"resource"`

	// AuthorizationServers lists the authorization servers for this resource
	AuthorizationServers []string `json:"authorization_servers"`

	// ScopesSupported lists the OAuth scopes supported by this resource
	ScopesSupported []string `json:"scopes_supported,omitempty"`

	// BearerMethodsSupported indicates how bearer tokens can be presented
	BearerMethodsSupported []string `json:"bearer_methods_supported,omitempty"`

	// ResourceDocumentation provides human-readable documentation URL
	ResourceDocumentation string `json:"resource_documentation,omitempty"`
}

type REPL struct {
	// contains filtered or unexported fields
}

type WWWAuthenticateChallenge struct {
	// Scheme is the authentication scheme (typically "Bearer")
	Scheme string

	// ResourceMetadataURL is the URL to fetch protected resource metadata
	ResourceMetadataURL string

	// Scopes are the required scopes for this resource/operation
	Scopes []string

	// Error indicates the error type (e.g., "insufficient_scope")
	Error string

	// ErrorDescription provides human-readable error details
	ErrorDescription string
}