Skip to main content
Import from @mcp-use/client/react:
Use McpClientProvider for multi-server apps. Use standalone useMcp only for a single server.

Provider setup

Call addServer only after storageLoaded is true. When the provider finishes its initial load, it replaces its server list with the servers from storageProvider and the mcpServers prop, if either is set, so a server added earlier is dropped. addServer ignores an ID that is already registered.

Connection states

OAuth does not auto-start by default (preventAutoAuth: true). Show a sign-in button when state === "pending_auth". Mixed auth is reported separately from the connection state. A mixed-auth server remains ready because its public operations are usable, while authorization describes the optional OAuth state:
The hook detects mixed auth from RFC 9728 protected-resource metadata after an anonymous connection. Set detectMixedAuth: false to disable this best-effort discovery. With the default explicit browser flow, a wire-level OAuth challenge from a protected operation prepares the auth action; call authenticate() and retry that operation. Tool-level isError results do not trigger OAuth.

OAuth callback

Create a route (default: /oauth/callback):
Override with defaultCallbackUrl on the provider or callbackUrl per server. McpClientProvider skips connecting its servers only on a page whose path ends in /oauth/callback. A connection attempt on the callback page can replace the in-flight PKCE verifier before onMcpAuthorization() exchanges the code. If your callback URL uses a different path, render that route outside McpClientProvider.

Proxy fallback

When direct browser connections fail (CORS / FastMCP), retry through a proxy:
MCP traffic and OAuth use separate proxy URLs so resource identity stays the upstream MCP URL.

Persistence

Built-in providers persist only non-secret connection settings. Supply bearer tokens, request headers, and proxy headers again at runtime after a reload. Browser OAuth tokens remain persistent by default and are encrypted with AES-256-GCM using a non-extractable origin key stored in IndexedDB.

Standalone useMcp

For one server without the provider:

OAuth UserInfo

Set oauth.fetchUserInfo: true to fetch the authenticated account’s UserInfo after the MCP connection becomes ready. The fetch runs independently of the connection; a UserInfo error does not change mcp.state. The authorization server must advertise a userinfo_endpoint, and the requested scopes must permit the claims you need (often openid profile email).
mcp.userInfo is reactive and has these states: Automatic fetching is opt-in and retries an error once after a short delay. You can omit fetchUserInfo and call await mcp.getUserInfo() whenever you want to fetch the account explicitly; the method returns the same state it publishes to mcp.userInfo.

Types

  • McpServerConfig — server options passed to addServer (replaces deprecated McpServerOptions).
  • displayName — your label for the server in UI.
  • serverInfo.name — name returned by the server at init.
  • authorization — optional mixed-auth metadata with mode, authenticated, resource, and scopesSupported.
Sampling, elicitation, and notifications are queued on each McpServer (pendingSamplingRequests, pendingElicitationRequests, notifications). See Sampling and Elicitation.

Reference

React client API reference — provider props, hook return values, and storage types.