Mounts @modelcontextprotocol/server-lazy-auth as an additional example,
served at /lazy-auth/mcp alongside the other example MCP App servers.
Unlike the other examples (plain createServer() factories behind the
stateless handler), lazy-auth's value is its HTTP layer: public tools
work unauthenticated, protected tools answer 401 + WWW-Authenticate, and
a built-in mock OAuth authorization server completes the flow. So it
mounts its full Express app (createApp()) under /lazy-auth.
- New src/modules/example-apps/lazy-auth.ts mounts the app before the
host middleware and adds the RFC 8414/9728 path-insertion well-known
rewrite (/.well-known/oauth-authorization-server/lazy-auth -> into the
mount) that SDK clients require for discovery under a base path.
- PUBLIC_URL for the example is derived from this server's own BASE_URI,
so no extra deploy-time configuration is needed; an explicit PUBLIC_URL
still wins (e.g. a tunnel).
- Integration test covers the full flow: public initialize/tools/list,
401 on the protected tool, mount-prefixed discovery metadata, and the
PKCE -> token -> authed get_secret round trip.
2476540fab