Harden MCP schema and wire Claude OAuth/token handling

tests/mcp-converters.test.ts

@@ -6,6 +6,7 @@ import {
   toClaudeServerConfig,
   toCodexServerConfig,
 } from "../src/mcp/converters.js";
+import { parseMcpConfig } from "../src/mcp/types.js";
 
 test("infers stdio transport when url is absent", () => {
   const transport = inferTransport({
@@ -84,3 +85,51 @@ test("throws for claude http server without url", () => {
     /requires "url" for http transport/,
   );
 });
+
+test("maps sdk transport for claude conversion", () => {
+  const claudeConfig = toClaudeServerConfig("local-sdk", {
+    type: "sdk",
+    name: "local-sdk-server",
+  });
+
+  assert.deepEqual(claudeConfig, {
+    type: "sdk",
+    name: "local-sdk-server",
+  });
+});
+
+test("throws when sdk transport is converted for codex", () => {
+  assert.throws(
+    () => toCodexServerConfig("sdk-server", { type: "sdk", name: "sdk-server" }),
+    /not supported by Codex/,
+  );
+});
+
+test("accepts sdk transport in strict MCP schema", () => {
+  const parsed = parseMcpConfig({
+    servers: {
+      "sdk-server": {
+        type: "sdk",
+        name: "sdk-server",
+      },
+    },
+  });
+
+  assert.equal(parsed.servers?.["sdk-server"]?.type, "sdk");
+});
+
+test("rejects unknown fields in strict MCP schema", () => {
+  assert.throws(
+    () =>
+      parseMcpConfig({
+        servers: {
+          broken: {
+            type: "stdio",
+            command: "node",
+            extra: "nope",
+          },
+        },
+      }),
+    /unrecognized key/i,
+  );
+});