The auth server's /introspect endpoint now correctly sets the 'aud' field
to the resource server URL (BASE_URI) instead of the client ID. This ensures
proper audience validation when the MCP server verifies tokens in separate mode.
- Import BASE_URI in auth server
- Set aud to BASE_URI in introspection response
- Fixes "Token was not issued for this resource server" error
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Enhance token validation in separate mode to fully comply with MCP specification:
- Validate audience (aud) claim to ensure tokens are issued for this specific MCP server
- Validate temporal claims (nbf, iat) with appropriate clock skew tolerance
- Add configurable canonical URI for audience validation
- Improve logging for validation failures
These changes prevent token passthrough attacks and ensure tokens are
properly scoped to the intended resource server, as required by the
MCP OAuth 2.0 specification.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add state parameter round-trip validation to prevent CSRF attacks.
Document each OAuth step including PKCE generation and token exchange.
Kill existing servers before starting new ones to avoid conflicts.
Use single tsconfig.json for both main server and auth-server to avoid
nested directory issues during build. Update e2e test scripts to run
directly instead of using concurrently.
Remove incorrect mcpAuthMetadataRouter call when running in separate mode.
The resource server should not serve OAuth metadata endpoints - only the
auth server should provide these endpoints.
The package-lock.json contained references to Anthropic's internal
artifactory registry which GitHub Actions cannot access, causing
npm ci to fail. Regenerated with public registry.npmjs.org.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Make 'npm run build' build both main server and auth server
- Remove redundant build:auth-server and build:all scripts
- Update README to reflect simplified build command
- Ensures compilation errors in auth server are caught by default build
- Add missing staticFileRateLimit definition in auth-server/index.ts
- Resolves compilation error in auth server build
- Addresses PR check failure about missing rate limiting on line 123
- Apply staticFileRateLimit to /mcp-logo.png route in auth server
- Addresses remaining check failure about missing rate limiting
- Matches rate limiting pattern used in main server
- Add express-rate-limit to custom endpoints for security:
- /introspect: 100 requests per 5 minutes
- /fakeupstreamauth/*: 20 requests per minute
- Static files: 25 requests per 10 minutes
- Add automated e2e testing npm scripts using concurrently:
- npm run test:e2e:integrated: Auto-starts server and runs test
- npm run test:e2e:separate: Auto-starts both servers and runs test
- Update README with automated testing approach documentation
- Update docs/streamable-http-design.md with current file structure
- Remove redundancy in README e2e testing documentation
- Verified: All tests, linting, and e2e scripts pass with rate limiting
- Update streamable-http-design.md with correct file references
- Reflect current dual transport architecture (SSE + Streamable HTTP)
- Update file paths to match actual implementation structure
- Clarify stateful session management approach
- Remove outdated research content, focus on current implementation
- Remove /oauth prefix from introspect endpoint to match SDK pattern
- Fix auth-server endpoints: /introspect not /oauth/introspect
- Update external-verifier to call correct introspect endpoint
- Add 30-day expiry to client registration (REDIS_EXPIRY_TIMES.CLIENT_REGISTRATION)
- Remove inaccurate scratch/ directory references from README
- Add backlinks from auth-server/README.md to main README sections
- Verified all implementation details against running servers and Redis data
- Updated Prerequisites with Redis setup (Docker Compose + OrbStack)
- Added comprehensive Authentication Modes section
- Added Testing with MCP Inspector section with step-by-step guides
- Updated Features to highlight dual mode support
- Updated Configuration with new environment variables
- Updated Development Commands with all new npm scripts
- Added architecture diagrams for both modes
- Referenced auth-server/README.md for detailed auth server info
All phases now completed - Mode 2 implementation ready for use!
- Created auth-server/index.ts with full OAuth endpoint support
- Reuses EverythingAuthProvider from main server
- Added custom /oauth/introspect endpoint for token validation
- Includes fake upstream auth routes for user authentication
- Added TypeScript configuration for auth server
- Added comprehensive npm scripts for all modes:
- dev:integrated, dev:separate, dev:auth-server
- dev:with-separate-auth (runs both servers)
- build:auth-server, build:all
- Added concurrently dependency for running multiple servers
- Added detailed README for auth server
- Successfully serves OAuth metadata and health endpoints
- Implemented retry logic (5 attempts, 3 second delay) for auth server connection
- Added token validation caching with 60-second default TTL
- Cache respects token expiration time if provided
- Cache invalidation on 401/403 responses
- Automatic cache cleanup every minute
- Debug logging for cache hits and misses
- Created ExternalAuthVerifier for token validation with external auth server
- Added mode switching logic to src/index.ts
- Integrated mode uses mcpAuthRouter (current behavior)
- Separate mode uses mcpAuthMetadataRouter and external verifier
- Fake upstream auth routes only available in integrated mode
- Added auth server metadata fetching with error handling
- Created shared/types.ts with well-documented type definitions
- Created shared/auth-core.ts with core auth functions (PKCE, tokens, encryption)
- Created shared/redis-auth.ts with Redis operations for auth data
- Updated src/services/auth.ts to use shared modules
- Added TokenIntrospectionResponse interface for Mode 2
- Updated config.ts with AUTH_MODE, AUTH_SERVER_URL, AUTH_SERVER_PORT
- Added validation for port consistency between URL and PORT variables
- Added comprehensive JSDoc comments for all config variables
- Created .env.integrated and .env.separate config files
- Updated redis.ts to use REDIS_URL from config
- Added .claude/ to .gitignore
- Moved inline CSS to external stylesheet to comply with CSP
- Added black background to logo area for visibility of white MCP logo
- Updated specification link to point to dated version (2025-06-18)
- Changed "MCP Everything Server" to "MCP Example Server"
- Added route to serve styles.css file
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Refreshed package dependencies to ensure clean installation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implemented a clean, informative splash page at the root endpoint that showcases:
- Server features and capabilities
- API endpoints documentation
- Links to GitHub repository and MCP documentation
- Black and white theme matching MCP branding
- Responsive design for mobile and desktop
The splash page provides users with an immediate overview of the server's functionality
and serves as a landing page for the MCP Everything Server.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Replace getRawBody with direct req.body usage since express.json() middleware already parses it
- Add debugging support with --inspect flag for dev scripts
- Add VS Code launch configurations for debugging
The issue was that getRawBody tried to read an already-consumed stream. Since express.json()
middleware is applied globally, we can directly use req.body instead.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add MCPInitResponse interface for test responses
- Replace 'any' types with proper interface
- Remove unused JSONRPCResponse import
- Maintain type safety while fixing build errors
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove unused imports and variables
- Replace 'any' types with proper type guards
- Add comments to empty catch blocks
- Fix Response/Request type imports in logger
- Use 'unknown' instead of 'any' for generic types
- Remove unused createMcpServer and setSessionOwner imports
All ESLint checks now pass.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add overrides for @types/express to resolve version conflicts
- Remove SDK build step from CI as we're now using published version
- Move mcp.png to src/static folder and update serving path
- Add copy-static script to build process
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove sensitive data (auth tokens, cookies) from request logging
- Add detailed logging throughout streamable HTTP request lifecycle:
- Session creation/reuse
- Session ownership validation
- Transport initialization
- Message flow through Redis channels
- Session shutdown and cleanup
- Add logging for inactivity timeouts and control messages
- Use appropriate log levels (info for lifecycle, debug for details, error for failures)
All logs now include contextual information like sessionId, userId, and channel names
for easier debugging and monitoring.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add structured logger utility with Cloud Run trace context support
- Uses AsyncLocalStorage for request context propagation
- Replace all console.log/error/warn statements with structured logger
- Add logging middleware to capture request/response metadata
- Support Google Cloud Logging severity levels and trace correlation
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
