fcc4b03bdeAdds an example MCP App server demonstrating lazy (on-demand) OAuth: the server connects and lists tools without authentication, and only prompts for auth when a protected tool is called, by responding 401 with a WWW-Authenticate header pointing at protected-resource metadata. - Public `show_auth_button` app calls the protected `get_secret` tool via callServerTool; the host runs the OAuth flow on 401 and retries - Embedded mock authorization server (authorization-code + PKCE, short-lived HS256 tokens, refresh + session revocation) so the whole flow runs from a single process - TTL-scoped endpoint paths (/ttl/<seconds>/mcp) let slow or automated clients request longer-lived tokens per connection, threaded through OAuth via RFC 8707 resource indicators - `elicit_url` / `elicit_by_error` tools demonstrating URL elicitation
27 lines
853 B
HTML
27 lines
853 B
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<meta name="color-scheme" content="light dark" />
|
|
<title>Lazy Auth Demo</title>
|
|
</head>
|
|
<body>
|
|
<main class="main">
|
|
<h3>Public App</h3>
|
|
<p>
|
|
No auth was needed to render this view. Click below to invoke the
|
|
protected
|
|
<code>get_secret</code> tool — the host will run the OAuth flow on 401
|
|
and retry.
|
|
</p>
|
|
<div class="actions">
|
|
<button id="auth-btn">Auth me</button>
|
|
<button id="revoke-btn">Revoke token</button>
|
|
<button id="fullscreen-btn" title="Toggle fullscreen">⤢</button>
|
|
</div>
|
|
<div id="output"></div>
|
|
</main>
|
|
<script type="module" src="/src/mcp-app.ts"></script>
|
|
</body>
|
|
</html>
|