modelcontextprotocol/example-remote-server
Watch
1
0
Fork
You've already forked example-remote-server
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add OAuth protected resource metadata endpoint for separate mode

Browse source 
Fixes MCP Inspector connection by providing OAuth discovery endpoint
that points to the external auth server at http://localhost:3001
This commit is contained in:
Basil Hosmer 2025-09-15 02:57:56 -04:00
commit e393cb2129
No known key found for this signature in database
1 changed files with 17 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

24
src/index.ts
View file

@ -1,5 +1,5 @@
import { BearerAuthMiddlewareOptions, requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
import { AuthRouterOptions, getOAuthProtectedResourceMetadataUrl, mcpAuthRouter, mcpAuthMetadataRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
import { AuthRouterOptions, getOAuthProtectedResourceMetadataUrl, mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
import cors from "cors";
import rateLimit from "express-rate-limit";
import express from "express";
@ -227,18 +227,28 @@ if (AUTH_MODE === 'integrated') {
}
}
// In separate mode, we don't serve OAuth metadata endpoints
// The auth server handles all OAuth metadata
// We only need to configure the bearer auth middleware
// In separate mode, we serve minimal OAuth metadata that points to the auth server
// This allows OAuth clients to discover the authorization endpoints
// Serve OAuth protected resource metadata endpoint
app.get('/.well-known/oauth-protected-resource', (req, res) => {
res.json({
resource: BASE_URI,
authorization_server: AUTH_SERVER_URL,
bearer_methods_supported: ['header'],
resource_documentation: `${BASE_URI}/docs`,
resource_signing_alg_values_supported: ['HS256']
});
});
// Configure bearer auth with external verifier
const externalVerifier = new ExternalAuthVerifier(AUTH_SERVER_URL);
const bearerAuthOptions: BearerAuthMiddlewareOptions = {
verifier: externalVerifier,
resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(new URL(BASE_URI)),
};
bearerAuth = requireBearerAuth(bearerAuthOptions);
}