feat(mcp): allow custom fetch for HTTP and SSE transports (#14134)

## Summary

Fixes #13449.

`@ai-sdk/mcp` hardcoded `globalThis.fetch` in its HTTP and SSE
transports, breaking same-app MCP calls on runtimes that block
self-fetches (e.g. Cloudflare Workers error `1042` via Nitro).

- Adds an optional `fetch` field to `MCPTransportConfig` and both
`HttpMCPTransport` / `SseMCPTransport` constructors
- Falls back to `globalThis.fetch` when not provided (no breaking
change)
- Forwards the custom fetch to OAuth `auth()` calls so token
discovery/exchange uses the same fetch implementation
- Covers both `http` and `sse` transport types as requested in the issue

**Usage:**
```ts
createMCPClient({
  transport: {
    type: 'http',
    url,
    fetch: event.fetch, // e.g. Nitro / Cloudflare Workers request-local fetch
  },
})
```

## Test plan

- [x] Added `describe('custom fetch', ...)` tests to both
`mcp-http-transport.test.ts` and `mcp-sse-transport.test.ts` verifying
the custom fetch function is called for GET (start) and POST (send)
operations
- [x] All 171 existing tests continue to pass (`pnpm test:node`)
- [x] Package builds cleanly (`pnpm build` in `packages/mcp`)

---------

Co-authored-by: Aayush Kapoor <83492835+aayush-kapoor@users.noreply.github.com>
Co-authored-by: Aayush Kapoor <aayushkapoor34@gmail.com>

Author: jaydeep-pipaliya

.changeset/friendly-mugs-smell.md

@@ -0,0 +1,5 @@
+---
+"@ai-sdk/mcp": patch
+---
+
+feat(mcp): allow custom fetch for HTTP and SSE transports

packages/mcp/src/tool/mcp-http-transport.test.ts

@@ -427,4 +427,62 @@ describe('HttpMCPTransport', () => {
       fetchSpy.mockRestore();
     });
   });
+
+  describe('custom fetch', () => {
+    it('should use provided fetch function instead of globalThis.fetch', async () => {
+      const customFetch = vi.fn(globalThis.fetch);
+
+      transport = new HttpMCPTransport({
+        url: 'http://localhost:4000/mcp',
+        fetch: customFetch,
+      });
+
+      server.urls['http://localhost:4000/mcp'].response = {
+        type: 'error',
+        status: 405,
+      };
+
+      await transport.start();
+
+      await vi.waitFor(() => {
+        expect(customFetch).toHaveBeenCalled();
+      });
+
+      expect(customFetch).toHaveBeenCalledWith(
+        'http://localhost:4000/mcp',
+        expect.objectContaining({ method: 'GET' }),
+      );
+    });
+
+    it('should use provided fetch function for POST send()', async () => {
+      const customFetch = vi.fn(globalThis.fetch);
+
+      transport = new HttpMCPTransport({
+        url: 'http://localhost:4000/mcp',
+        fetch: customFetch,
+      });
+
+      server.urls['http://localhost:4000/mcp'].response = {
+        type: 'json-value',
+        body: { jsonrpc: '2.0', id: 1, result: { ok: true } },
+        headers: { 'mcp-session-id': 'abc123' },
+      };
+
+      await transport.start();
+
+      const message = {
+        jsonrpc: '2.0' as const,
+        method: 'initialize',
+        id: 1,
+        params: {},
+      };
+
+      await transport.send(message);
+
+      expect(customFetch).toHaveBeenCalledWith(
+        'http://localhost:4000/mcp',
+        expect.objectContaining({ method: 'POST' }),
+      );
+    });
+  });
 });

packages/mcp/src/tool/mcp-http-transport.ts

@@ -1,5 +1,6 @@
 import {
   EventSourceParserStream,
+  FetchFunction,
   withUserAgentSuffix,
   getRuntimeEnvironmentUserAgent,
 } from '@ai-sdk/provider-utils';
@@ -31,6 +32,7 @@ export class HttpMCPTransport implements MCPTransport {
   private sessionId?: string;
   private inboundSseConnection?: { close: () => void };
   private redirectMode: RequestRedirect;
+  private fetchFn: FetchFunction;
 
   // Inbound SSE resumption and reconnection state
   private lastInboundEventId?: string;
@@ -51,16 +53,19 @@ export class HttpMCPTransport implements MCPTransport {
     headers,
     authProvider,
     redirect = 'error',
+    fetch: fetchFn,
   }: {
     url: string;
     headers?: Record<string, string>;
     authProvider?: OAuthClientProvider;
     redirect?: 'follow' | 'error';
+    fetch?: FetchFunction;
   }) {
     this.url = new URL(url);
     this.headers = headers;
     this.authProvider = authProvider;
     this.redirectMode = redirect;
+    this.fetchFn = fetchFn ?? globalThis.fetch;
   }
 
   private async commonHeaders(
@@ -111,7 +116,7 @@ export class HttpMCPTransport implements MCPTransport {
         !this.abortController.signal.aborted
       ) {
         const headers = await this.commonHeaders({});
-        await fetch(this.url, {
+        await this.fetchFn(this.url.href, {
           method: 'DELETE',
           headers,
           signal: this.abortController.signal,
@@ -140,7 +145,7 @@ export class HttpMCPTransport implements MCPTransport {
           redirect: this.redirectMode,
         } satisfies RequestInit;
 
-        const response = await fetch(this.url, init);
+        const response = await this.fetchFn(this.url.href, init);
 
         const sessionId = response.headers.get('mcp-session-id');
         if (sessionId) {
@@ -153,6 +158,7 @@ export class HttpMCPTransport implements MCPTransport {
             const result = await auth(this.authProvider, {
               serverUrl: this.url,
               resourceMetadataUrl: this.resourceMetadataUrl,
+              fetchFn: this.fetchFn,
             });
             if (result !== 'AUTHORIZED') {
               const error = new UnauthorizedError();
@@ -314,7 +320,7 @@ export class HttpMCPTransport implements MCPTransport {
         headers['last-event-id'] = resumeToken;
       }
 
-      const response = await fetch(this.url.href, {
+      const response = await this.fetchFn(this.url.href, {
         method: 'GET',
         headers,
         signal: this.abortController?.signal,
@@ -332,6 +338,7 @@ export class HttpMCPTransport implements MCPTransport {
           const result = await auth(this.authProvider, {
             serverUrl: this.url,
             resourceMetadataUrl: this.resourceMetadataUrl,
+            fetchFn: this.fetchFn,
           });
           if (result !== 'AUTHORIZED') {
             const error = new UnauthorizedError();

packages/mcp/src/tool/mcp-sse-transport.test.ts

@@ -381,4 +381,75 @@ describe('SseMCPTransport', () => {
       fetchSpy.mockRestore();
     });
   });
+
+  describe('custom fetch', () => {
+    it('should use provided fetch function for SSE connection', async () => {
+      const controller = new TestResponseController();
+      server.urls['http://localhost:3000/sse'].response = {
+        type: 'controlled-stream',
+        controller,
+      };
+
+      const customFetch = vi.fn(globalThis.fetch);
+
+      transport = new SseMCPTransport({
+        url: 'http://localhost:3000/sse',
+        fetch: customFetch,
+      });
+
+      const connectPromise = transport.start();
+      controller.write(
+        'event: endpoint\ndata: http://localhost:3000/messages\n\n',
+      );
+      await connectPromise;
+
+      expect(customFetch).toHaveBeenCalledWith(
+        'http://localhost:3000/sse',
+        expect.objectContaining({ headers: expect.anything() }),
+      );
+
+      await transport.close();
+    });
+
+    it('should use provided fetch function for POST send()', async () => {
+      const controller = new TestResponseController();
+      server.urls['http://localhost:3000/sse'].response = {
+        type: 'controlled-stream',
+        controller,
+      };
+      server.urls['http://localhost:3000/messages'].response = {
+        type: 'empty',
+        status: 200,
+      };
+
+      const customFetch = vi.fn(globalThis.fetch);
+
+      transport = new SseMCPTransport({
+        url: 'http://localhost:3000/sse',
+        fetch: customFetch,
+      });
+
+      const connectPromise = transport.start();
+      controller.write(
+        'event: endpoint\ndata: http://localhost:3000/messages\n\n',
+      );
+      await connectPromise;
+
+      customFetch.mockClear();
+
+      await transport.send({
+        jsonrpc: '2.0' as const,
+        method: 'test',
+        params: {},
+        id: '1',
+      });
+
+      expect(customFetch).toHaveBeenCalledWith(
+        'http://localhost:3000/messages',
+        expect.objectContaining({ method: 'POST' }),
+      );
+
+      await transport.close();
+    });
+  });
 });

packages/mcp/src/tool/mcp-sse-transport.ts

@@ -1,5 +1,6 @@
 import {
   EventSourceParserStream,
+  FetchFunction,
   withUserAgentSuffix,
   getRuntimeEnvironmentUserAgent,
 } from '@ai-sdk/provider-utils';
@@ -27,6 +28,7 @@ export class SseMCPTransport implements MCPTransport {
   private authProvider?: OAuthClientProvider;
   private resourceMetadataUrl?: URL;
   private redirectMode: RequestRedirect;
+  private fetchFn: FetchFunction;
 
   onclose?: () => void;
   onerror?: (error: unknown) => void;
@@ -37,16 +39,19 @@ export class SseMCPTransport implements MCPTransport {
     headers,
     authProvider,
     redirect = 'error',
+    fetch: fetchFn,
   }: {
     url: string;
     headers?: Record<string, string>;
     authProvider?: OAuthClientProvider;
     redirect?: 'follow' | 'error';
+    fetch?: FetchFunction;
   }) {
     this.url = new URL(url);
     this.headers = headers;
     this.authProvider = authProvider;
     this.redirectMode = redirect;
+    this.fetchFn = fetchFn ?? globalThis.fetch;
   }
 
   private async commonHeaders(
@@ -85,7 +90,7 @@ export class SseMCPTransport implements MCPTransport {
           const headers = await this.commonHeaders({
             Accept: 'text/event-stream',
           });
-          const response = await fetch(this.url.href, {
+          const response = await this.fetchFn(this.url.href, {
             headers,
             signal: this.abortController?.signal,
             redirect: this.redirectMode,
@@ -97,6 +102,7 @@ export class SseMCPTransport implements MCPTransport {
               const result = await auth(this.authProvider, {
                 serverUrl: this.url,
                 resourceMetadataUrl: this.resourceMetadataUrl,
+                fetchFn: this.fetchFn,
               });
               if (result !== 'AUTHORIZED') {
                 const error = new UnauthorizedError();
@@ -235,14 +241,15 @@ export class SseMCPTransport implements MCPTransport {
           redirect: this.redirectMode,
         };
 
-        const response = await fetch(endpoint, init);
+        const response = await this.fetchFn(endpoint.href, init);
 
         if (response.status === 401 && this.authProvider && !triedAuth) {
           this.resourceMetadataUrl = extractResourceMetadataUrl(response);
           try {
             const result = await auth(this.authProvider, {
               serverUrl: this.url,
               resourceMetadataUrl: this.resourceMetadataUrl,
+              fetchFn: this.fetchFn,
             });
             if (result !== 'AUTHORIZED') {
               const error = new UnauthorizedError();

packages/mcp/src/tool/mcp-transport.ts

@@ -1,3 +1,4 @@
+import { FetchFunction } from '@ai-sdk/provider-utils';
 import { MCPClientError } from '../error/mcp-client-error';
 import { JSONRPCMessage } from './json-rpc-message';
 import { SseMCPTransport } from './mcp-sse-transport';
@@ -66,6 +67,13 @@ export type MCPTransportConfig = {
    * @default 'error'
    */
   redirect?: 'follow' | 'error';
+
+  /**
+   * Optional custom fetch implementation to use for HTTP requests.
+   * Useful for runtimes that need a request-local fetch.
+   * @default globalThis.fetch
+   */
+  fetch?: FetchFunction;
 };
 
 export function createMcpTransport(config: MCPTransportConfig): MCPTransport {