[{"_1":2,"_171":-5,"_172":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","4e736cb42e83c17c10d9f33412034a74b06f3941","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_150":151,"_168":169,"_170":-5},"handle","pcarleton","name","mcp-oauth-landing","path","http.ts","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":20,"_108":109,"_110":-5,"_111":-5,"_12":112,"_113":114,"_115":116,"_117":116,"_118":-5,"_119":32,"_14":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_23":130,"_133":134,"_136":137,"_149":20},"id","6628b72a-7dc0-11f0-8f01-0224a6c84d84","createdAt",["D",1755692574960],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","07534baa-7de5-11f0-8e24-0224a6c84d84","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_131":132},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","org",{"_94":95,"_135":132,"_12":112},"avatar","branch",{"_138":139,"_96":44,"_102":140,"_141":103,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":97,"_148":95},"version",12,"6628ee7a-7dc0-11f0-8f01-0224a6c84d84","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":152,"_96":99,"_153":114,"_154":-5,"_155":140,"_156":157,"_158":116,"_104":159,"_138":160,"_161":162,"_163":164,"_165":20,"_166":97,"_98":167},"379cab24-7de7-11f0-83da-0224a6c84d84","fileId","parentId","branchId","branchVersion",11,"latest",["D",1755709247233],8,"fileType","http","content","export default async function(req: Request): Promise {\n const html = `\n \n \n \n \n \n MCP OAuth Examples\n \n \n \n

🔐 MCP OAuth Examples

\n\n

What is this?

This is a collection of example implementations for the MCP (Model Context Protocol) OAuth specification.\n These examples demonstrate different OAuth flows and configurations for protecting MCP resources.

\n\n

📚 Available Examples

\n\n

Example 1: PRM Metadata at Root

Tests Protected Resource Metadata (PRM) discovery at the server root without WWW-Authenticate headers.

Configuration:

No WWW-Authenticate header
PRM metadata at /.well-known/oauth-protected-resource
Fixed token validation

\n MCP Endpoint
https://mcp-oauth-ex1.val.run/mcp\n Metadata
/.well-known/oauth-protected-resource\n

\n\n

Example 2: PRM Metadata at Path

Tests Protected Resource Metadata (PRM) discovery at the specific resource path without WWW-Authenticate headers.

Configuration:

No WWW-Authenticate header
PRM metadata at /.well-known/oauth-protected-resource/mcp
Fixed token validation

\n MCP Endpoint
https://mcp-oauth-ex2.val.run/mcp\n Metadata
/.well-known/oauth-protected-resource/mcp\n

\n\n

Example 3: WWW-Authenticate with Custom PRM Location

Tests OAuth protection with WWW-Authenticate headers and PRM metadata at a custom location.

Configuration:

WWW-Authenticate header included
PRM metadata at custom location

\n MCP Endpoint
https://mcp-oauth-ex3.val.run/mcp\n Metadata
/custom/metadata-path\n

\n\n

Authorization Server 1

A simple OAuth authorization server for testing with the example resource servers.

Features:

Metadata at the root
Fixed access and refresh token
PKCE validation

\n Server Home
https://mcp-oauth-as1.val.run/\n Metadata
/.well-known/oauth-authorization-server\n

\n\n

🚀 Getting Started

\n\n

Testing the Examples

You can test these endpoints using:

Live production clients
curl with Authorization headers
MCP client libraries
OAuth testing tools like Postman

Example request:

\ncurl -X POST https://mcp-oauth-ex1.val.run/mcp \\\\\n  -H \"Authorization: Bearer test_access_token_abc\" \\\\\n  -H \"Content-Type: application/json\" \\\\\n  -H 'Accept: application/json, text/event-stream' \\\\\n  -d '{\"jsonrpc\": \"2.0\", \"method\": \"tools/list\", \"id\": 1}'

\n\n

📖 Documentation

For more information about MCP and OAuth:

\n\n

\n Built with Val Town | val.town\n

\n \n \n `;\n\n return new Response(html, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n },\n });\n}\n","deleted","label",[99],"permalink","https://www.val.town/x/pcarleton/mcp-oauth-landing/code/http.ts","extension","actionData","errors"]