Allow Agent instance to supply custom OAuth provider.

[jaredhanson]

I am implementing agents that use alternative ways to register and authenticate with OAuth authorization servers. These mechanisms are based on early draft OAuth specifications, and will hopefully see more widespread adoption as MCP's use of OAuth matures beyond dynamic client registration (which has many downsides).

To facilitate this, supplying a different AgentsOAuthProvider is necessary. This pull request proposes a createOAuthProvider function on the Agent class, which by default returns the current DurableObjectOAuthClientProvider instance. This function can be overridden by Agent subclasses that need to use an alternative implementation.

An example of a agent that has a custom OAuth provider is as follows:

export class MyChatAgent extends AIChatAgent<Env> {
   // ...

   createOAuthProvider(callbackUrl: string): AgentsOAuthProvider {
      return new MyCustomOAuthProvider(
        this.ctx.storage,
        this.name,
        callbackUrl
      );
   }
}

Let me know if I can supply any additional details. Any and all feedback is welcome! Thanks!

[changeset-bot]

🦋 Changeset detected

Latest commit: 58de61d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
agents	Patch
hono-agents	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[jaredhanson]

Kindly bumping to request review or feedback on this PR.

[jaredhanson]

For context here, I'm working on making the underlying OAuthClientProvider interface from @modelcontextprotocol/sdk more extensible, allowing it to implement more secure forms of authentication that don't rely on shared secrets. A PR is in progress here: modelcontextprotocol/typescript-sdk#531

Instantiating such an implementation from within an Agent is driving the requirement for this PR.

[threepointone]

I’ll have a look tomorrow, cheers Sunil Pai

…

On Thu, 29 May 2025 at 22:28, Jared Hanson ***@***.***> wrote: *jaredhanson* left a comment (cloudflare/agents#298) <#298 (comment)> For context here, I'm working on making the underlying OAuthClientProvider interface from @modelcontextprotocol/sdk more extensible, allowing it to implement more secure forms of authentication that don't rely on shared secrets. A PR is in progress here: modelcontextprotocol/typescript-sdk#531 <modelcontextprotocol/typescript-sdk#531> Instantiating such an implementation from within an Agent is driving the requirement for this PR. — Reply to this email directly, view it on GitHub <#298 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAES6E4M52BZPGA22JU55D3A44CFAVCNFSM6AAAAAB5UIAEQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDSMRQGAYDSMRXGI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[jaredhanson]

Support for implementing custom auth has landed in @modelcontextprotocol/sdk v1.15.1 (#720).

Now that it is in a stable release there, it'd be great to take advantage of better authentication mechanisms in Cloudflare Agents. Let me know if there's anything I can do to move this along. Thanks!