fix(client): accept form-encoded token responses

[tylergibbs1]

Summary

• parse successful OAuth token responses as form data when the response media type is application/x-www-form-urlencoded
• preserve the existing JSON path for other response media types
• add regression coverage for a form response whose content type includes a charset parameter
• add a patch changeset for @modelcontextprotocol/client

Fixes #759.

Why

executeTokenRequest() unconditionally called response.json(). OAuth providers that return a form-encoded token response therefore threw a SyntaxError even though the token fields were otherwise valid. The response now goes through the existing OAuthTokensSchema after decoding the declared form media type.

Validation

• pnpm --filter @modelcontextprotocol/client exec vitest run test/client/auth.test.ts — 253 passed
• pnpm --filter @modelcontextprotocol/client test — 772 passed
• pnpm lint:all — passed
• pnpm typecheck:all — passed
• pnpm build:all — passed
• pnpm test:all — reaches two unrelated @modelcontextprotocol/node SSE assertions that also fail on untouched origin/main under Node 26.5.0 (streamableHttp.test.ts:737 and streamableHttp.test.ts:1522)

AI assistance

Codex assisted with repository triage and implementation. I reviewed the diff and ran the checks above.

[changeset-bot]

🦋 Changeset detected

Latest commit: dd489aa

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/client	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2535

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2535

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2535

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2535

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2535

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2535

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2535

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2535

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2535

commit: dd489aa