Mounts @modelcontextprotocol/server-lazy-auth as an additional example,
served at /lazy-auth/mcp alongside the other example MCP App servers.
Unlike the other examples (plain createServer() factories behind the
stateless handler), lazy-auth's value is its HTTP layer: public tools
work unauthenticated, protected tools answer 401 + WWW-Authenticate, and
a built-in mock OAuth authorization server completes the flow. So it
mounts its full Express app (createApp()) under /lazy-auth.
- New src/modules/example-apps/lazy-auth.ts mounts the app before the
host middleware and adds the RFC 8414/9728 path-insertion well-known
rewrite (/.well-known/oauth-authorization-server/lazy-auth -> into the
mount) that SDK clients require for discovery under a base path.
- PUBLIC_URL for the example is derived from this server's own BASE_URI,
so no extra deploy-time configuration is needed; an explicit PUBLIC_URL
still wins (e.g. a tunnel).
- Integration test covers the full flow: public initialize/tools/list,
401 on the protected tool, mount-prefixed discovery metadata, and the
PKCE -> token -> authed get_secret round trip.
The stateless /:slug/mcp handler creates a fresh McpServer and
StreamableHTTPServerTransport on every request but never closed them,
leaking memory under load. Register a 'close' listener (fires on both
normal completion and client abort mid-SSE) to release them.
- Bump @modelcontextprotocol/ext-apps from ^1.1.0 to ^1.1.1
- Bump all @modelcontextprotocol/server-* packages from ^1.1.0 to ^1.1.1
- Add new @modelcontextprotocol/server-debug package at ^1.1.1
- Wire up debug server in example-apps module at /debug/mcp
Remove bearer auth middleware from all /:slug/mcp routes (pdf, map, etc.)
so they are publicly accessible without an OAuth token. The root /mcp
endpoint retains its existing bearer auth requirement.
https://claude.ai/code/session_019bG1wzY84JA7LbpkybddP9
Add INFO-level logging to both the stateful SHTTP handler and the
stateless example-apps handler to show the full client capabilities
sent during MCP initialization, including any extensions like
io.modelcontextprotocol/ui.
This helps verify that clients are correctly sending UI extension
capabilities during the initialization handshake.
Address PR feedback:
- Remove session store and session management
- Use stateless mode (sessionIdGenerator: undefined)
- Each request creates a fresh server instance
- Remove user-controlled format string in error message
- Simplify handler logic significantly
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Wire up 13 MCP Apps servers from the @modelcontextprotocol/server-* packages:
- budget-allocator: Interactive budget allocation UI
- cohort-heatmap: Customer retention heatmap
- customer-segmentation: Scatter chart with clustering
- map: Interactive 3D globe viewer (CesiumJS)
- pdf: Interactive PDF viewer
- scenario-modeler: SaaS business projections dashboard
- shadertoy: Real-time GLSL shader renderer
- sheet-music: ABC notation to sheet music visualizer
- system-monitor: Real-time OS metrics display
- threejs: 3D scene renderer
- transcript: Live speech transcription
- video-resource: Binary video streaming via MCP resources
- wiki-explorer: Wikipedia link graph visualization
Each server is mounted at /{slug}/mcp and shares the same OAuth
authentication as the main MCP server.
Also updates the splash page to dynamically list all available
example servers.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
