TanStack AI agents can now call OAuth-protected MCP servers via Vercel Connect

Vercel has added TanStack AI to the frameworks supported by Vercel Connect, its mechanism for wiring agents to OAuth-protected MCP servers. According to a post on the Vercel blog, agents built with TanStack AI can now reach those servers through Connect, which means developers no longer have to hold or renew OAuth credentials themselves.

How the integration works

The support arrives as a new subpath export, @vercel/connect/tanstack-ai, which exposes a connectMCPTransport helper. The function accepts an ordinary TanStack transport configuration — say, an HTTP transport pointing at an MCP endpoint — and attaches a Connect-backed auth provider to it.

Vercel says that provider runs ahead of every MCP request the agent makes, so the token attached to each call is current rather than a cached credential that could expire mid-conversation.

In the sample code Vercel published, a server route builds an MCP client for Linear. The createMCPClient call receives the wrapped transport, the identifier of the OAuth connection (oauth/linear), and a subject that pins the authorization to a specific end user — in the example, an ID resolved from the incoming request. The finished client is handed to TanStack's chat function alongside a model adapter, which in the sample routes an Anthropic Claude model through the Vercel AI gateway. The model can then invoke Linear's tools as part of the conversation, and the route streams the replies back as server-sent events.

Consent is resolved before the model runs

The other half of the integration covers users who have not yet granted access. In that case, createMCPClient fails with a consent challenge before the model is ever invoked. Developers catch the failure with a companion helper, getConsentChallenge, and redirect the user to Connect's consent URL to approve the connection.

Vercel explains why failing early matters: a consent error raised inside a tool call would reach the model as an ordinary error string rather than reaching the user as a redirect. The agent would simply report a failure, and no one would be sent through the approval flow needed to fix it.

Why it matters

OAuth has been an awkward fit for agent architectures. Tokens need secure storage, renewal when they lapse, and scoping to the right identity — and a model's tool calls happen at moments when no human is watching. By running the auth provider before each MCP request and binding tokens to a per-user subject, Connect moves that machinery out of application code and onto the platform.

The per-user design is the consequential choice here. A Linear client authorized as a particular user inherits that user's permissions and visibility instead of acting under a blanket service credential — effectively the difference between an agent that sees your tickets and one that sees everyone's.

For teams already building on TanStack AI, a working MCP connection now reduces to a transport config, a connection ID, and a subject, with consent handled through a redirect. Vercel notes that TanStack AI joins a broader list of supported frameworks and adapters for Connect, and that integration documentation is available for developers getting started.