fix: make callbackHost optional in addMcpServer for non-OAuth servers

[threepointone]

addMcpServer() previously required a callbackHost (either explicitly or derived from the request context) and eagerly created an OAuth auth provider for every connection, even when the MCP server does not use OAuth. This made simple non-OAuth connections unnecessarily difficult — especially from @callable methods where the request context origin is unreliable (it's the WebSocket upgrade request, not the client's origin).

This PR defers OAuth setup to when it's actually needed:

• callbackHost, callbackUrl, and authProvider are only constructed when a callbackHost is available
• If the MCP server responds with AUTHENTICATING (401) but no callbackUrl was configured, a clear error is thrown: "This MCP server requires OAuth authentication. Provide callbackHost in addMcpServer options to enable the OAuth flow."
• The restore-from-storage flow skips authProvider creation for servers with no stored callback_url
• callbackPath enforcement for sendIdentityOnConnect: false is only applied when a callbackHost is present (no callback URL to protect otherwise)

Before

// Always required callbackHost, even for non-OAuth servers
await this.addMcpServer("my-server", url, {
  callbackHost: "https://my-app.workers.dev"
});

After

// Non-OAuth servers: just name and URL
await this.addMcpServer("my-server", url);

// OAuth servers: provide callbackHost
await this.addMcpServer("oauth-server", url, {
  callbackHost: "https://my-app.workers.dev"
});

[changeset-bot]

🦋 Changeset detected

Latest commit: dc6de1d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agents	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/agents@963

npm i https://pkg.pr.new/cloudflare/agents/@cloudflare/ai-chat@963

npm i https://pkg.pr.new/cloudflare/agents/@cloudflare/codemode@963

npm i https://pkg.pr.new/cloudflare/agents/hono-agents@963

commit: dc6de1d