Add lazy-auth-server example (#679)

Browse source

Adds an example MCP App server demonstrating lazy (on-demand) OAuth:
the server connects and lists tools without authentication, and only
prompts for auth when a protected tool is called, by responding 401
with a WWW-Authenticate header pointing at protected-resource metadata.

- Public `show_auth_button` app calls the protected `get_secret` tool
  via callServerTool; the host runs the OAuth flow on 401 and retries
- Embedded mock authorization server (authorization-code + PKCE,
  short-lived HS256 tokens, refresh + session revocation) so the whole
  flow runs from a single process
- TTL-scoped endpoint paths (/ttl/<seconds>/mcp) let slow or automated
  clients request longer-lived tokens per connection, threaded through
  OAuth via RFC 8707 resource indicators
- `elicit_url` / `elicit_by_error` tools demonstrating URL elicitation

...

This commit is contained in:

Mel Ludowise 2026-06-01 03:19:53 -07:00 • committed by GitHub

parent 9a37ad7182

commit fcc4b03bde

No known key found for this signature in database

GPG key ID: B5690EEEBB952194

1 changed files with 1737 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1068

examples/lazy-auth-server/server.ts Normal file

View file

File diff suppressed because it is too large Load diff