The new connectMCPTransport helper in @vercel/connect/tanstack-ai attaches a Connect authentication provider to a TanStack MCP transport. It obtains a current token before each request, so the application need not keep a copy of the provider's token or construct its own authorisation header. Vercel documents the integration with a Linear example and lists Connect as available on all plans, subject to its terms.
Account access is not permission to act
Connect handles permission to access a provider account; TanStack's tool-approval settings govern particular actions. Vercel explicitly tells developers to configure approval separately for tools that create, update, delete, send or spend. The adapter does not automatically turn OAuth consent into an approval interrupt.
The documentation also warns against sharing a client pool between users: a pool retains its account subject and can send another user's request through that same account. Clients and pools should be created inside each request, with the subject derived from the authenticated session rather than an arbitrary user ID supplied by the caller.
Consent depends on the transport
Streamable HTTP defaults to eager consent, raising a missing-grant challenge during client creation. The route can then use getConsentChallenge to direct the user to authorisation before a response stream begins. SSE uses a different transport-level flow; forcing eager consent there can produce repeated reconnections.