This is a utility library for OAuth callback handling, not a traditional MCP server exposing agent-callable tools. The five exported functions are developer APIs rather than tools meant for LLM invocation. Tool naming is reasonable (verb_noun pattern), but descriptions are inconsistent, some are clear, others lack specificity. Parameter schemas are partially documented; some use complex nested objects without full type clarity. The library is well-engineered for its domain (OAuth handling) but poorly suited as an MCP agent tool set. No error handling guidance for LLM-driven recovery. Security (token storage) is thoughtful but not reflected in tool definitions.

• Rename tools to use verb_noun pattern: 'configure_browser_auth', 'get_auth_code', 'get_redirect_url', 'create_memory_store', 'create_file_store'. This aligns with LLM agent discovery conventions.
• Document complete output schemas for all tools. E.g., 'browserAuth returns { code: string, state: string, error?: string, error_description?: string }' and specify what CallbackServer interface provides.
• Expand descriptions to 100-150 characters with explicit guidance: 'Call browserAuth to configure OAuth provider with PKCE and token storage. Use getAuthCode to start the callback server and capture the authorization code from the provider.'
• Document type signatures for complex parameters: 'launch: (url: string) => Promise<void>' and 'store: interface TokenStore { get(key: string): Promise<any>; set(key: string, value: any): Promise<void> }'.
• Add error handling guidance to getAuthCode and browserAuth descriptions: 'Returns { code, state, error?, error_description?, error_uri? }. If error is set, the OAuth provider rejected the request, LLM should ask user to try again or adjust scopes.'
• Add parameter validation guidance: 'port: number between 1024 and 65535 (avoid system ports < 1024); hostname: valid hostname or IP address (default localhost for security)'.
• For fileStore, add concurrency guidance: 'Not safe for multi-process concurrent writes. Use in single agent instance only, or wrap with exclusive file locking (e.g., proper-lockfile npm package).'
• Add dependency hints: 'If you have an OAuth provider URL but need to exchange an auth code, call getAuthCode first. If you need the redirect URI to register with the provider, call getRedirectUrl.'

Inferred effective spec: <=2025-11-25.

• Relies on Dynamic Client Registration (deprecated) - use Client ID Metadata Documents (CIMD)