Authorization successful!

This window will close automatically...

Code: ${code}

\n \n \n `, {\n headers: { 'Content-Type': 'text/html' }\n });\n }\n\n // Get SDK version from query param or default\n const sdkVersion = url.searchParams.get('sdk') || 'latest';\n const customSdkUrl = url.searchParams.get('customSdk') || '';\n\n // Determine the SDK base URL\n let sdkBaseUrl= `https://esm.sh/@modelcontextprotocol/sdk@${sdkVersion}`\n\n // Main client page\n return new Response(`\n \n \n \n MCP OAuth Workbench\n \n \n \n

\n \n

\n Server Endpoint\n \n

\n\n

\n Custom Server URL\n \n

\n\n

\n SDK Version\n \n

\n\n

\n Custom SDK URL\n \n

\n\n

\n Current SDK: ${sdkBaseUrl}\n

\n\n

\n OAuth Callback URL\n \n

\n\n

\n \n \n \n \n

Console Output

\n\n \n \n \n `, {\n headers: { 'Content-Type': 'text/html' }\n });\n}\n\n// For Val Town deployment\nexport default handleRequest;\n\n// For local development\nif (import.meta.main) {\n const port = parseInt(Deno.env.get(\"PORT\") || \"8000\");\n console.log(`Starting OAuth client server on http://localhost:${port}`);\n console.log(`Open your browser to http://localhost:${port} to use the client`);\n\n Deno.serve({ port }, handleRequest);\n}\n","deleted","label","children",[],[155],{"_102":174,"_95":175,"_156":176,"_158":-5,"_159":137,"_160":136,"_161":162,"_104":177,"_99":32,"_164":178,"_166":179,"_168":22,"_169":-5,"_170":180,"_98":181},"19335618-d244-11f0-9805-42dde27851f2","mcp-server.ts","019af14e-6117-704e-a220-47176c0fee84",["D",1764985037031],"file","import { Hono } from \"npm:hono@3\";\nimport { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport { toFetchResponse, toReqRes } from \"npm:fetch-to-node\";\nimport { StreamableHTTPServerTransport } from \"npm:@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { z } from \"npm:zod@3.23.8\";\nimport { CallToolResult } from \"npm:@modelcontextprotocol/sdk/types.js\";\n\nexport interface ServerConfig {\n type: \"resource\" | \"auth\";\n name: string;\n port?: number;\n\n // Resource server specific\n metadataPath?: string;\n authServerUrl?: string;\n includeWwwAuthenticate?: boolean; // Whether to include WWW-Authenticate header\n\n // Auth server specific\n issuer?: string;\n tenantPath?: string;\n\n // Common\n fixedAccessToken: string;\n fixedRefreshToken?: string;\n fixedClientId?: string;\n fixedAuthCode?: string;\n}\n\nconst createMcpServer = (config: ServerConfig) => {\n const server = new McpServer({\n name: config.name,\n version: \"1.0.0\",\n }, {\n capabilities: {\n // logging: {},\n },\n });\n\n // Register a simple addition tool\n server.registerTool(\n \"add\",\n {\n title: \"Add tool\",\n description: \"A simple addition tool\",\n inputSchema: {\n a: z.number().describe(\"First number\"),\n b: z.number().describe(\"Second number\"),\n },\n },\n async ({ a, b }): Promise => {\n return {\n content: [\n {\n type: \"text\",\n text: `${a} + ${b} = ${a + b}`,\n },\n ],\n };\n },\n );\n\n return server;\n};\n\nfunction generateIndexHtml(config: ServerConfig): string {\n const serverType = config.type === \"resource\" ? \"Resource Server\" : \"Authorization Server\";\n\n const configDetails = Object.entries(config)\n .filter(([key, value]) => value !== undefined && key !== \"port\")\n .map(([key, value]) => {\n const formattedKey = key.replace(/([A-Z])/g, ' $1').toLowerCase()\n .replace(/^./, str => str.toUpperCase())\n .replace('_', ' ');\n return `${formattedKey}:${value}`;\n })\n .join('\\n');\n\n return `\n\n\n \n \n ${config.name} - MCP OAuth ${serverType}\n \n\n\n

${serverType}

${config.name}

\n\n

Configuration

\n \n ${configDetails}\n

\n\n

Available Endpoints

\n ${config.type === \"resource\" ? `\n

GET /health

GET ${config.metadataPath || '/.well-known/oauth-protected-resource'}

POST /mcp (requires Bearer token)

\n \n

\n ` : `\n

GET /health

GET /.well-known/openid-configuration

GET /authorize

POST /token

\n \n

\n `}\n

\n\n \n

\n\n

\n Note: This is an MCP OAuth example server for testing and development purposes.\n ${config.type === \"resource\"\n ? `Access to the /mcp endpoint requires a valid Bearer token: ${config.fixedAccessToken}`\n : `This server uses fixed test credentials for demonstration purposes.`\n }\n

\n \n\n`;\n}\n\nfunction createResourceServer(config: ServerConfig) {\n const app = new Hono();\n\n // CORS middleware - apply to all routes\n app.use(\"*\", async (c, next) => {\n // Handle preflight requests\n if (c.req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization, mcp-protocol-version\",\n \"Access-Control-Max-Age\": \"86400\",\n },\n });\n }\n\n // Add CORS headers to all responses\n await next();\n\n // Add CORS headers after the response is generated\n c.header(\"Access-Control-Allow-Origin\", \"*\");\n c.header(\"Access-Control-Allow-Methods\", \"GET, POST, OPTIONS\");\n c.header(\"Access-Control-Allow-Headers\", \"Content-Type, Authorization\");\n\n // If WWW-Authenticate header is present, expose it\n if (c.res.headers.get(\"WWW-Authenticate\")) {\n c.header(\"Access-Control-Expose-Headers\", \"WWW-Authenticate\");\n }\n });\n\n // Root index page\n app.get(\"/\", (c) => c.html(generateIndexHtml(config)));\n\n // Health check endpoint\n app.get(\"/health\", (c) => c.json({ status: \"ok\", server: config.name }));\n\n // OAuth Protected Resource metadata endpoint\n app.get(config.metadataPath!, (c) => {\n const resourceUrl = `https://${c.req.header(\"host\")}/mcp`;\n const authServers = config.tenantPath\n ? [`${config.authServerUrl}${config.tenantPath}`]\n : [config.authServerUrl!];\n\n return c.json({\n resource: resourceUrl,\n authorization_servers: authServers,\n });\n });\n\n // MCP endpoint with auth\n app.post(\"/mcp\", async (c) => {\n // Check for bearer token\n const authHeader = c.req.header(\"Authorization\");\n if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\n const resourceMetadataUrl = `https://${c.req.header(\"host\")}${config.metadataPath}`;\n\n const responseHeaders: Record = {};\n\n // Only include WWW-Authenticate header if configured\n if (config.includeWwwAuthenticate !== false) {\n responseHeaders[\"WWW-Authenticate\"] = `Bearer resource_metadata=\"${resourceMetadataUrl}\"`;\n }\n\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Authentication required\",\n },\n id: null,\n }, {\n status: 401,\n headers: responseHeaders,\n });\n }\n\n const token = authHeader.substring(7);\n if (token !== config.fixedAccessToken) {\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Invalid token\",\n },\n id: null,\n }, { status: 401 });\n }\n\n // Handle MCP request\n const { req, res } = toReqRes(c.req.raw);\n const server = createMcpServer(config);\n\n try {\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined,\n });\n\n transport.onerror = console.error.bind(console);\n\n await server.connect(transport);\n\n const body = await c.req.json();\n\n await transport.handleRequest(req, res, body);\n\n console.log(`${new Date().toISOString()} MCP request handled`);\n\n res.on(\"close\", () => {\n console.log(`${new Date().toISOString()} Request closed`);\n transport.close();\n server.close();\n });\n\n return toFetchResponse(res);\n } catch (error) {\n console.error(\"Error handling MCP request:\", error);\n\n try {\n server.close();\n } catch (cleanupError) {\n console.error(\"Error during cleanup:\", cleanupError);\n }\n return c.json(\n {\n jsonrpc: \"2.0\",\n error: {\n code: -32603,\n message: \"Internal server error\",\n },\n id: null,\n },\n { status: 500 },\n );\n }\n });\n\n return app;\n}\n\nfunction createAuthServer(config: ServerConfig) {\n const app = new Hono();\n\n // Root index page\n app.get(\"/\", (c) => c.html(generateIndexHtml(config)));\n\n // OAuth Authorization Server Metadata endpoint\n const metadataPath = config.tenantPath\n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n\n app.get(metadataPath, (c) => {\n const baseUrl = `https://${c.req.header(\"host\")}`;\n const issuer = config.issuer || (config.tenantPath ? `${baseUrl}${config.tenantPath}` : baseUrl);\n\n const metadata = {\n issuer: issuer,\n authorization_endpoint: `${baseUrl}/authorize`,\n token_endpoint: `${baseUrl}/token`,\n registration_endpoint: `${baseUrl}/register`,\n jwks_uri: `${baseUrl}/jwks`,\n response_types_supported: [\"code\"],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"RS256\"],\n scopes_supported: [\"openid\", \"profile\", \"email\", \"offline_access\"],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"],\n claims_supported: [\"sub\", \"name\", \"email\"],\n code_challenge_methods_supported: [\"plain\", \"S256\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n response_modes_supported: [\"query\", \"fragment\"],\n authorization_response_iss_parameter_supported: true,\n backchannel_logout_supported: false,\n frontchannel_logout_supported: false,\n end_session_endpoint: `${baseUrl}/logout`,\n request_parameter_supported: false,\n request_uri_parameter_supported: false,\n };\n\n return c.json(metadata);\n });\n\n // Mock authorization endpoint\n app.get(\"/authorize\", (c) => {\n const redirectUri = c.req.query(\"redirect_uri\");\n const state = c.req.query(\"state\");\n const codeChallenge = c.req.query(\"code_challenge\");\n const codeChallengeMethod = c.req.query(\"code_challenge_method\");\n\n if (!redirectUri) {\n return c.text(\"redirect_uri is required\", 400);\n }\n\n // Store code challenge for PKCE validation (in real impl, store in DB)\n console.log(\"PKCE:\", { codeChallenge, codeChallengeMethod });\n\n // In real implementation, show login/consent screen\n // For testing, immediately redirect with code\n const code = config.fixedAuthCode || \"test_auth_code_123\";\n const params = new URLSearchParams({\n code,\n ...(state && { state }),\n });\n\n const authorizeRedirectUrl = `${redirectUri}?${params}`;\n return c.redirect(authorizeRedirectUrl);\n });\n\n // Mock token endpoint\n app.post(\"/token\", async (c) => {\n const contentType = c.req.header(\"Content-Type\");\n let grantType, code, refreshToken, codeVerifier;\n\n if (contentType?.includes(\"application/x-www-form-urlencoded\")) {\n const body = await c.req.text();\n const params = new URLSearchParams(body);\n grantType = params.get(\"grant_type\");\n code = params.get(\"code\");\n refreshToken = params.get(\"refresh_token\");\n codeVerifier = params.get(\"code_verifier\");\n } else {\n const body = await c.req.json();\n grantType = body.grant_type;\n code = body.code;\n refreshToken = body.refresh_token;\n codeVerifier = body.code_verifier;\n }\n\n // Validate PKCE if provided\n if (codeVerifier) {\n console.log(\"PKCE verification:\", { codeVerifier });\n // In real impl, verify against stored code_challenge\n }\n\n if (grantType === \"authorization_code\") {\n if (code !== (config.fixedAuthCode || \"test_auth_code_123\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n } else if (grantType === \"refresh_token\") {\n if (refreshToken !== (config.fixedRefreshToken || \"test_refresh_token_xyz\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n }\n\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n });\n\n // Mock JWKS endpoint\n app.get(\"/jwks\", (c) => {\n return c.json({\n keys: [\n {\n kty: \"RSA\",\n use: \"sig\",\n kid: \"test-key-1\",\n alg: \"RS256\",\n n: \"xGOr-H7A-PWG\",\n e: \"AQAB\",\n },\n ],\n });\n });\n\n // Mock client registration endpoint\n app.post(\"/register\", async (c) => {\n const body = await c.req.json();\n\n return c.json({\n client_id: config.fixedClientId || \"test_client_id\",\n client_secret: \"test_client_secret\",\n client_id_issued_at: Math.floor(Date.now() / 1000),\n client_secret_expires_at: 0,\n redirect_uris: body.redirect_uris || [],\n token_endpoint_auth_method: \"client_secret_basic\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: body.client_name || \"Test Client\",\n scope: body.scope || \"openid profile email\",\n });\n });\n\n // Mock logout endpoint\n app.get(\"/logout\", (c) => {\n return c.text(\"Logged out successfully\");\n });\n\n // Health check\n app.get(\"/health\", (c) => {\n return c.json({ status: \"ok\", server: config.name });\n });\n\n return app;\n}\n\nexport function createServer(config: ServerConfig) {\n const app = config.type === \"resource\"\n ? createResourceServer(config)\n : createAuthServer(config);\n\n return app.fetch;\n}\n\nexport function startServer(config: ServerConfig) {\n const app = config.type === \"resource\"\n ? createResourceServer(config)\n : createAuthServer(config);\n\n const port = config.type === \"resource\" ? 3000 : 3001\n\n const serverType = config.type === \"resource\" ? \"Resource\" : \"Auth\";\n console.log(`${serverType} Server (${config.name}) running at http://localhost:${port}`);\n\n if (config.type === \"resource\") {\n console.log(\"\\nEndpoints:\");\n console.log(` MCP: http://localhost:${port}/mcp`);\n console.log(` Metadata: http://localhost:${port}${config.metadataPath}`);\n console.log(` Health: http://localhost:${port}/health`);\n if (config.authServerUrl) {\n console.log(` Auth Server: ${config.authServerUrl}`);\n }\n } else {\n const metadataPath = config.tenantPath\n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n console.log(\"\\nEndpoints:\");\n console.log(` Metadata: http://localhost:${port}${metadataPath}`);\n console.log(` Authorize: http://localhost:${port}/authorize`);\n console.log(` Token: http://localhost:${port}/token`);\n console.log(` Health: http://localhost:${port}/health`);\n }\n\n Deno.serve({ port, hostname: \"127.0.0.1\" }, app.fetch);\n}\n",[],[175],"files",[153,173],"counts",{"_186":32,"_187":136,"_188":32,"_189":190},"pulls","branches","forks","envVars",{"_191":32,"_192":32},"count","emptyCount","contents",[195,198],{"_102":154,"_95":155,"_156":157,"_158":-5,"_159":137,"_160":136,"_161":162,"_104":196,"_99":32,"_164":165,"_166":167,"_168":22,"_169":-5,"_98":197},["D",1764985037031],[155],{"_102":174,"_95":175,"_156":176,"_158":-5,"_159":137,"_160":136,"_161":162,"_104":199,"_99":32,"_164":178,"_166":179,"_168":22,"_169":-5,"_98":200},["D",1764985037031],[175],"upstreamProject",{"_102":145,"_95":96,"_110":-5,"_111":-5,"_108":109,"_23":203},{"_93":204,"_129":205},"pcarleton","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","upstreamBranch",{"_102":140,"_104":208,"_209":210,"_95":43,"_138":145,"_99":142,"_139":-5,"_141":-5,"_211":212,"_106":-5,"_150":22,"_108":109,"_149":204,"_16":147,"_148":96},["D",1755767895836],"updatedAt",["D",1762190661227],"lockfileKey","1762190669739-esm.town_v_pcarleton_mcp-oauth-client1@14-main","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name._index",{"_93":94,"_95":96,"_97":-7,"_99":-7,"_100":219,"_193":224,"_229":-7,"_230":231,"_234":-5,"_182":235,"_242":243,"_244":32,"_245":32},{"_102":103,"_95":96,"_104":220,"_106":-5,"_107":22,"_108":109,"_110":-5,"_111":-5,"_14":112,"_113":-5,"_114":22,"_115":-5,"_116":-5,"_117":32,"_16":118,"_119":120,"_121":120,"_122":123,"_124":123,"_125":123,"_126":120,"_127":120,"_23":221,"_131":222,"_134":223,"_150":22},["D",1764985037031],{"_93":94,"_129":130},{"_93":94,"_133":130,"_14":112},{"_99":136,"_95":43,"_102":137,"_138":103,"_139":140,"_141":142,"_143":109,"_144":145,"_146":147,"_148":96,"_149":94},[225,227],{"_102":154,"_95":155,"_156":157,"_158":-5,"_159":137,"_160":136,"_161":162,"_104":196,"_99":32,"_164":165,"_166":167,"_168":22,"_169":-5,"_98":226},[155],{"_102":174,"_95":175,"_156":176,"_158":-5,"_159":137,"_160":136,"_161":162,"_104":199,"_99":32,"_164":178,"_166":179,"_168":22,"_169":-5,"_98":228},[175],"readme","upstream",{"_102":140,"_104":232,"_209":233,"_95":43,"_138":145,"_99":142,"_139":-5,"_141":-5,"_211":212,"_106":-5,"_150":22,"_108":109,"_149":204,"_16":147,"_148":96},["D",1755767895836],["D",1762190661227],"pull",[236,239],{"_102":154,"_95":155,"_156":157,"_158":-5,"_159":137,"_160":136,"_161":162,"_104":163,"_99":32,"_164":165,"_166":167,"_168":22,"_169":-5,"_170":237,"_98":238},[],[155],{"_102":174,"_95":175,"_156":176,"_158":-5,"_159":137,"_160":136,"_161":162,"_104":177,"_99":32,"_164":178,"_166":179,"_168":22,"_169":-5,"_170":240,"_98":241},[],[175],"previews",[236],"ahead","behind","actionData","errors"]

dk3

mcp-oauth-client1