The auth server's /introspect endpoint now correctly sets the 'aud' field
to the resource server URL (BASE_URI) instead of the client ID. This ensures
proper audience validation when the MCP server verifies tokens in separate mode.
- Import BASE_URI in auth server
- Set aud to BASE_URI in introspection response
- Fixes "Token was not issued for this resource server" error
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Use single tsconfig.json for both main server and auth-server to avoid
nested directory issues during build. Update e2e test scripts to run
directly instead of using concurrently.
- Make 'npm run build' build both main server and auth server
- Remove redundant build:auth-server and build:all scripts
- Update README to reflect simplified build command
- Ensures compilation errors in auth server are caught by default build
- Add express-rate-limit to custom endpoints for security:
- /introspect: 100 requests per 5 minutes
- /fakeupstreamauth/*: 20 requests per minute
- Static files: 25 requests per 10 minutes
- Add automated e2e testing npm scripts using concurrently:
- npm run test:e2e:integrated: Auto-starts server and runs test
- npm run test:e2e:separate: Auto-starts both servers and runs test
- Update README with automated testing approach documentation
- Update docs/streamable-http-design.md with current file structure
- Remove redundancy in README e2e testing documentation
- Verified: All tests, linting, and e2e scripts pass with rate limiting
- Created auth-server/index.ts with full OAuth endpoint support
- Reuses EverythingAuthProvider from main server
- Added custom /oauth/introspect endpoint for token validation
- Includes fake upstream auth routes for user authentication
- Added TypeScript configuration for auth server
- Added comprehensive npm scripts for all modes:
- dev:integrated, dev:separate, dev:auth-server
- dev:with-separate-auth (runs both servers)
- build:auth-server, build:all
- Added concurrently dependency for running multiple servers
- Added detailed README for auth server
- Successfully serves OAuth metadata and health endpoints
- Replace getRawBody with direct req.body usage since express.json() middleware already parses it
- Add debugging support with --inspect flag for dev scripts
- Add VS Code launch configurations for debugging
The issue was that getRawBody tried to read an already-consumed stream. Since express.json()
middleware is applied globally, we can directly use req.body instead.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add overrides for @types/express to resolve version conflicts
- Remove SDK build step from CI as we're now using published version
- Move mcp.png to src/static folder and update serving path
- Add copy-static script to build process
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Updated Jest configuration to use ts-jest ESM preset
- Added NODE_OPTIONS flag for experimental VM modules support
- Fixed import statements in all test files to import Jest globals
- Rewrote provider.test.ts to work with ESM (using actual implementations with mock Redis)
- Fixed test expectations to match actual implementation
- Fixed encryption key generation in tests (using proper 64-char hex tokens)
- Standardized token_type to "Bearer" across codebase
- Removed unused imports to fix lint errors
- Excluded scratch folder from test runs
All tests now pass successfully with proper ES module support.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Relocked
