AI SDK MCP client now refuses HTTP redirects by default (November 7, 2026)

What changed

On November 7, 2026 Vercel released @ai-sdk/mcp 1.0.102 (AI SDK 6) and 0.0.44 (AI SDK 5). The HTTP transport now rejects redirects by default, so an MCP server can no longer send your requests on to another host or a private network.

• GET, POST and DELETE requests now use redirect: 'error'.
• Private endpoints you configure yourself still work.
• redirect: 'follow' still follows redirects, for destinations you trust.

Prerequisites

• An app that connects to an MCP server over HTTP with @ai-sdk/mcp
• No new key is needed

Steps

1. Upgrade: npm install @ai-sdk/mcp@1.0.102 (AI SDK 6) or npm install @ai-sdk/mcp@0.0.44 (AI SDK 5).
2. Check each MCP server URL in your code. If it redirects (http to https, a trailing slash, a moved host), change it to the final URL.
3. Only for servers you trust, keep the old behaviour by adding redirect: 'follow' to the transport object you pass to createMCPClient, next to type and url. The option accepts 'follow' or 'error'.

Test it

Connect to each MCP server and list its tools. A server whose URL redirects now fails until you use its final URL.

The AI SDK 7 line (@ai-sdk/mcp 2.x, the npm latest tag) already rejected redirects by default from 2.0.0, so it needs no change.

Not confirmed

The docs reference page does not say which AI SDK version it describes.