fcc4b03bdeAdds an example MCP App server demonstrating lazy (on-demand) OAuth: the server connects and lists tools without authentication, and only prompts for auth when a protected tool is called, by responding 401 with a WWW-Authenticate header pointing at protected-resource metadata. - Public `show_auth_button` app calls the protected `get_secret` tool via callServerTool; the host runs the OAuth flow on 401 and retries - Embedded mock authorization server (authorization-code + PKCE, short-lived HS256 tokens, refresh + session revocation) so the whole flow runs from a single process - TTL-scoped endpoint paths (/ttl/<seconds>/mcp) let slow or automated clients request longer-lived tokens per connection, threaded through OAuth via RFC 8707 resource indicators - `elicit_url` / `elicit_by_error` tools demonstrating URL elicitation
51 lines
1.9 KiB
JSON
51 lines
1.9 KiB
JSON
{
|
|
"name": "@modelcontextprotocol/server-lazy-auth",
|
|
"version": "1.7.2",
|
|
"type": "module",
|
|
"description": "MCP App example demonstrating lazy (on-demand) OAuth: public tools work unauthenticated, protected tools return 401 + WWW-Authenticate so the host runs the OAuth flow only when needed",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/modelcontextprotocol/ext-apps",
|
|
"directory": "examples/lazy-auth-server"
|
|
},
|
|
"license": "MIT",
|
|
"main": "dist/server.js",
|
|
"files": [
|
|
"dist"
|
|
],
|
|
"scripts": {
|
|
"build": "tsc --noEmit && cross-env INPUT=mcp-app.html vite build && cross-env INPUT=secret-app.html vite build && tsc -p tsconfig.server.json && bun build server.ts --outdir dist --target node && bun build main.ts --outfile dist/index.js --target node --external \"./server.js\" --banner \"#!/usr/bin/env node\"",
|
|
"watch": "concurrently \"cross-env INPUT=mcp-app.html vite build --watch\" \"cross-env INPUT=secret-app.html vite build --watch\"",
|
|
"serve": "bun --watch main.ts",
|
|
"start": "cross-env NODE_ENV=development npm run build && npm run serve",
|
|
"dev": "cross-env NODE_ENV=development concurrently \"npm run watch\" \"npm run serve\"",
|
|
"prepublishOnly": "npm run build"
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/ext-apps": "^1.0.0",
|
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
"cors": "^2.8.5",
|
|
"express": "^5.1.0",
|
|
"jose": "^6.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/cors": "^2.8.19",
|
|
"@types/express": "^5.0.0",
|
|
"@types/node": "22.10.0",
|
|
"concurrently": "^9.2.1",
|
|
"cross-env": "^10.1.0",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^6.0.0",
|
|
"vite-plugin-singlefile": "^2.3.0"
|
|
},
|
|
"types": "dist/server.d.ts",
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/server.d.ts",
|
|
"default": "./dist/server.js"
|
|
}
|
|
},
|
|
"bin": {
|
|
"mcp-server-lazy-auth": "dist/index.js"
|
|
}
|
|
}
|