vinkius-labs/mcp-fusion

Added

@vurb/core — OAuth 2.0 BYOA (Bring Your Own Account)

Marketplace buyers can now authenticate with OAuth 2.0 providers (Calendly, Salesforce, Slack, Zoom, etc.) using their own OAuth credentials — orchestrated entirely by the platform, with zero MCP server code changes.

• 'oauth2' credential type — New value in the CredentialType union. When a credential field uses type: 'oauth2', the platform takes over the full token lifecycle: initiation, code exchange, encrypted storage, proactive refresh, and runtime injection.
• OAuthConfig interface — Attached to a CredentialDef via oauth?: OAuthConfig. Declares the provider's OAuth endpoints, scopes, grant type, and field references:
  • provider — Display name
  • grant_type — 'authorization_code' (default) or 'client_credentials'
  • authorize_url — Provider's consent screen URL (auth code only)
  • token_url — Token exchange endpoint
  • scopes — Required OAuth scopes
  • client_id_field / client_secret_field — References to buyer's credential keys
  • user_info_url / user_info_email_path — Optional endpoint to show connected email
  • token_expires_in — Fallback TTL when provider doesn't return expires_in
  • supports_refresh — Whether provider returns refresh tokens
  • extra_params — Extra token request params (keys ending in _field resolved from buyer credentials)
• oauth? on CredentialDef — Optional field, only valid when type is 'oauth2'

Full Changelog: https://github.com/vinkius-labs/vurb.ts/compare/v3.13.1...v3.14.0