examples: web-standard twin of the bearer-auth story (#2424)

examples/bearer-auth-web/server.ts

@@ -0,0 +1,70 @@
+/**
+ * The web-standard counterpart of `examples/bearer-auth`: the same
+ * Resource-Server-only auth built entirely from `@modelcontextprotocol/server`
+ * exports — `requireBearerAuth` gating the MCP handler, behind the same
+ * DNS-rebinding guards the Express sibling gets from `createMcpExpressApp` —
+ * composed as one `fetch(request)` handler.
+ *
+ * On Cloudflare Workers, Deno, or Bun that handler is the whole server
+ * (`export default { fetch: fetchHandler }`); on Node, `toNodeHandler` bridges
+ * it onto `node:http`. HTTP-only by definition.
+ */
+import { createServer } from 'node:http';
+
+import { parseExampleArgs } from '@mcp-examples/shared';
+import { toNodeHandler } from '@modelcontextprotocol/node';
+import type { AuthInfo, McpServerFactory, OAuthTokenVerifier } from '@modelcontextprotocol/server';
+import {
+    createMcpHandler,
+    hostHeaderValidationResponse,
+    localhostAllowedHostnames,
+    localhostAllowedOrigins,
+    McpServer,
+    OAuthError,
+    OAuthErrorCode,
+    originValidationResponse,
+    requireBearerAuth
+} from '@modelcontextprotocol/server';
+import * as z from 'zod/v4';
+
+const buildServer: McpServerFactory = ctx => {
+    const server = new McpServer({ name: 'bearer-auth-web-example', version: '1.0.0' });
+    server.registerTool('whoami', { description: 'Returns the authenticated subject.', inputSchema: z.object({}) }, async () => ({
+        content: [{ type: 'text', text: `client=${ctx.authInfo?.clientId ?? 'anon'}` }]
+    }));
+    return server;
+};
+
+const { port } = parseExampleArgs();
+
+// Replace with JWT verification, RFC 7662 introspection, etc.
+const staticTokenVerifier: OAuthTokenVerifier = {
+    async verifyAccessToken(token): Promise<AuthInfo> {
+        if (token !== 'demo-token') {
+            throw new OAuthError(OAuthErrorCode.InvalidToken, 'unknown token');
+        }
+        return { token, clientId: 'demo-client', scopes: ['mcp'], expiresAt: Math.floor(Date.now() / 1000) + 3600 };
+    }
+};
+
+const gate = requireBearerAuth({ verifier: staticTokenVerifier, requiredScopes: ['mcp'] });
+const handler = createMcpHandler(buildServer);
+
+async function fetchHandler(request: Request): Promise<Response> {
+    const rejected =
+        hostHeaderValidationResponse(request, localhostAllowedHostnames()) ?? originValidationResponse(request, localhostAllowedOrigins());
+    if (rejected) {
+        return rejected;
+    }
+    const auth = await gate(request);
+    if (auth instanceof Response) {
+        return auth;
+    }
+    return handler.fetch(request, { authInfo: auth });
+}
+
+// On a web-standard runtime the composition above is the whole server;
+// `toNodeHandler` accepts any `{ fetch }` shape and bridges it onto node:http.
+createServer(toNodeHandler({ fetch: fetchHandler })).listen(port, () => {
+    console.error(`[server] listening on http://127.0.0.1:${port}/mcp`);
+});