Align Quick OAuth Flow and Simple Connect Flow with Guided OAuth Flow behavior

[cliffhall]

Description

• In oauth-state-machine.ts
  • in token_request transition
    • ensure resource is URL type, not string
    • this fixes Quick flow which was sending string, while guided was using proper URL type and working
  • In auth.ts
    • in InspectorOAuthClientProvider constructor
      • add optional scope param
      • set instance var this.scope to scope param
    • in clientMetadata getter
      • add scope param set to this.scope or ""
  • in useConnection.ts
    • in handleAuthError handler
      • move instantiation of serverAuthProvider until after scope has been determined
      • pass scope to InspectorOAuthClientProvider constructor

Motivation and Context

• When following the OAuth Guided Flow in the Inspector UI, it works. It is possible to get to the end and then click Connect, and get an authenticated connection.
• However when using the Quick OAuth Flow it currently fails. This is because the resource url is persisted across the guided experience as a URL type, but with the quick flow, it actually does a redirect and ends up being processed as a string. This change ensures that we always pass a URL instance to during the token_request transition.
• When just clicking the Connect button, if a 401 Unauthorized error is returned, it attempts to run the authentication flow, but during the client registration step, it omits scope when calling the register endpoint, resulting in a message like: Error: invalid_scope. Details: Client was not registered with scope mcp:tools. This change makes sure that scope is included in client metadata when client is registered.

How Has This Been Tested?

In the Typescript SDK there is an example server that can be started in oauth mode, which allows us to test this flow.

tsx --watch src/examples/server/simpleStreamableHttp.ts --oauth

Guided Flow

guided.mov

Quick Flow

Quick.mov

Simple Connect Flow

Connect.mov

Breaking Changes

Nope.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[olaservo]

Looks good to me 👍
Should we also bump SDK from 1.17.2 to 1.17.3 ? Doesn't look like there is anything directly related, but might as well?