Authorization successful!

This window will close automatically...

Code: ${code}

\n \n \n `, {\n headers: { 'Content-Type': 'text/html' }\n });\n }\n\n // Main client page\n return new Response(`\n \n \n \n MCP OAuth Client\n \n \n \n

\n =\u0010 MCP OAuth Client Demo\n Disconnected\n

\n\n

\n MCP Server URL\n \n

\n\n

\n OAuth Callback URL\n \n

\n\n

\n \n \n \n

\n\n

\n\n \n \n \n `, {\n headers: { 'Content-Type': 'text/html' }\n });\n}\n","deleted","label","mcp-oauth-client-ex1","children",[],[99],{"_104":174,"_95":175,"_156":176,"_157":-5,"_158":142,"_159":177,"_160":22,"_106":178,"_100":32,"_163":179,"_165":180,"_167":22,"_168":-5,"_170":181,"_98":182},"c5234cfe-7e6f-11f0-8554-0224a6c84d84","mcp-server.ts","c5234dbc-7e6f-11f0-8554-0224a6c84d84",2,["D",1755767896217],"file","import { Hono } from \"npm:hono@3\";\nimport { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport { toFetchResponse, toReqRes } from \"npm:fetch-to-node\";\nimport { StreamableHTTPServerTransport } from \"npm:@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { z } from \"npm:zod@3.23.8\";\nimport { CallToolResult } from \"npm:@modelcontextprotocol/sdk/types.js\";\n\nexport interface ServerConfig {\n type: \"resource\" | \"auth\";\n name: string;\n port?: number;\n\n // Resource server specific\n metadataPath?: string;\n authServerUrl?: string;\n includeWwwAuthenticate?: boolean; // Whether to include WWW-Authenticate header\n\n // Auth server specific\n issuer?: string;\n tenantPath?: string;\n\n // Common\n fixedAccessToken: string;\n fixedRefreshToken?: string;\n fixedClientId?: string;\n fixedAuthCode?: string;\n}\n\nconst createMcpServer = (config: ServerConfig) => {\n const server = new McpServer({\n name: config.name,\n version: \"1.0.0\",\n }, {\n capabilities: {\n // logging: {},\n },\n });\n\n // Register a simple addition tool\n server.registerTool(\n \"add\",\n {\n title: \"Add tool\",\n description: \"A simple addition tool\",\n inputSchema: {\n a: z.number().describe(\"First number\"),\n b: z.number().describe(\"Second number\"),\n },\n },\n async ({ a, b }): Promise => {\n return {\n content: [\n {\n type: \"text\",\n text: `${a} + ${b} = ${a + b}`,\n },\n ],\n };\n },\n );\n\n return server;\n};\n\nfunction generateIndexHtml(config: ServerConfig): string {\n const serverType = config.type === \"resource\" ? \"Resource Server\" : \"Authorization Server\";\n\n const configDetails = Object.entries(config)\n .filter(([key, value]) => value !== undefined && key !== \"port\")\n .map(([key, value]) => {\n const formattedKey = key.replace(/([A-Z])/g, ' $1').toLowerCase()\n .replace(/^./, str => str.toUpperCase())\n .replace('_', ' ');\n return `${formattedKey}:${value}`;\n })\n .join('\\n');\n\n return `\n\n\n \n \n ${config.name} - MCP OAuth ${serverType}\n \n\n\n

${serverType}

${config.name}

\n\n

Configuration

\n \n ${configDetails}\n

\n\n

Available Endpoints

\n ${config.type === \"resource\" ? `\n

GET /health

GET ${config.metadataPath || '/.well-known/oauth-protected-resource'}

POST /mcp (requires Bearer token)

\n \n

\n ` : `\n

GET /health

GET /.well-known/openid-configuration

GET /authorize

POST /token

\n \n

\n `}\n

\n\n \n

\n\n

\n Note: This is an MCP OAuth example server for testing and development purposes.\n ${config.type === \"resource\"\n ? `Access to the /mcp endpoint requires a valid Bearer token: ${config.fixedAccessToken}`\n : `This server uses fixed test credentials for demonstration purposes.`\n }\n

\n \n\n`;\n}\n\nfunction createResourceServer(config: ServerConfig) {\n const app = new Hono();\n\n // Root index page\n app.get(\"/\", (c) => c.html(generateIndexHtml(config)));\n\n // Health check endpoint\n app.get(\"/health\", (c) => c.json({ status: \"ok\", server: config.name }));\n\n // OAuth Protected Resource metadata endpoint\n app.get(config.metadataPath!, (c) => {\n const resourceUrl = `https://${c.req.header(\"host\")}/mcp`;\n const authServers = config.tenantPath\n ? [`${config.authServerUrl}${config.tenantPath}`]\n : [config.authServerUrl!];\n\n return c.json({\n resource: resourceUrl,\n authorization_servers: authServers,\n });\n });\n\n // MCP endpoint with auth\n app.post(\"/mcp\", async (c) => {\n // Check for bearer token\n const authHeader = c.req.header(\"Authorization\");\n if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\n const resourceMetadataUrl = `https://${c.req.header(\"host\")}${config.metadataPath}`;\n\n const responseHeaders: Record = {};\n\n // Only include WWW-Authenticate header if configured\n if (config.includeWwwAuthenticate !== false) {\n responseHeaders[\"WWW-Authenticate\"] = `Bearer resource_metadata=\"${resourceMetadataUrl}\"`;\n }\n\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Authentication required\",\n },\n id: null,\n }, {\n status: 401,\n headers: responseHeaders,\n });\n }\n\n const token = authHeader.substring(7);\n if (token !== config.fixedAccessToken) {\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Invalid token\",\n },\n id: null,\n }, { status: 401 });\n }\n\n // Handle MCP request\n const { req, res } = toReqRes(c.req.raw);\n const server = createMcpServer(config);\n\n try {\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined,\n });\n\n transport.onerror = console.error.bind(console);\n\n await server.connect(transport);\n\n const body = await c.req.json();\n\n await transport.handleRequest(req, res, body);\n\n console.log(`${new Date().toISOString()} MCP request handled`);\n\n res.on(\"close\", () => {\n console.log(`${new Date().toISOString()} Request closed`);\n transport.close();\n server.close();\n });\n\n return toFetchResponse(res);\n } catch (error) {\n console.error(\"Error handling MCP request:\", error);\n\n try {\n server.close();\n } catch (cleanupError) {\n console.error(\"Error during cleanup:\", cleanupError);\n }\n return c.json(\n {\n jsonrpc: \"2.0\",\n error: {\n code: -32603,\n message: \"Internal server error\",\n },\n id: null,\n },\n { status: 500 },\n );\n }\n });\n\n return app;\n}\n\nfunction createAuthServer(config: ServerConfig) {\n const app = new Hono();\n\n // Root index page\n app.get(\"/\", (c) => c.html(generateIndexHtml(config)));\n\n // OAuth Authorization Server Metadata endpoint\n const metadataPath = config.tenantPath\n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n\n app.get(metadataPath, (c) => {\n const baseUrl = `https://${c.req.header(\"host\")}`;\n const issuer = config.issuer || (config.tenantPath ? `${baseUrl}${config.tenantPath}` : baseUrl);\n\n const metadata = {\n issuer: issuer,\n authorization_endpoint: `${baseUrl}/authorize`,\n token_endpoint: `${baseUrl}/token`,\n registration_endpoint: `${baseUrl}/register`,\n jwks_uri: `${baseUrl}/jwks`,\n response_types_supported: [\"code\"],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"RS256\"],\n scopes_supported: [\"openid\", \"profile\", \"email\", \"offline_access\"],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"],\n claims_supported: [\"sub\", \"name\", \"email\"],\n code_challenge_methods_supported: [\"plain\", \"S256\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n response_modes_supported: [\"query\", \"fragment\"],\n authorization_response_iss_parameter_supported: true,\n backchannel_logout_supported: false,\n frontchannel_logout_supported: false,\n end_session_endpoint: `${baseUrl}/logout`,\n request_parameter_supported: false,\n request_uri_parameter_supported: false,\n };\n\n return c.json(metadata);\n });\n\n // Mock authorization endpoint\n app.get(\"/authorize\", (c) => {\n const redirectUri = c.req.query(\"redirect_uri\");\n const state = c.req.query(\"state\");\n const codeChallenge = c.req.query(\"code_challenge\");\n const codeChallengeMethod = c.req.query(\"code_challenge_method\");\n\n if (!redirectUri) {\n return c.text(\"redirect_uri is required\", 400);\n }\n\n // Store code challenge for PKCE validation (in real impl, store in DB)\n console.log(\"PKCE:\", { codeChallenge, codeChallengeMethod });\n\n // In real implementation, show login/consent screen\n // For testing, immediately redirect with code\n const code = config.fixedAuthCode || \"test_auth_code_123\";\n const params = new URLSearchParams({\n code,\n ...(state && { state }),\n });\n\n const authorizeRedirectUrl = `${redirectUri}?${params}`;\n return c.redirect(authorizeRedirectUrl);\n });\n\n // Mock token endpoint\n app.post(\"/token\", async (c) => {\n const contentType = c.req.header(\"Content-Type\");\n let grantType, code, refreshToken, codeVerifier;\n\n if (contentType?.includes(\"application/x-www-form-urlencoded\")) {\n const body = await c.req.text();\n const params = new URLSearchParams(body);\n grantType = params.get(\"grant_type\");\n code = params.get(\"code\");\n refreshToken = params.get(\"refresh_token\");\n codeVerifier = params.get(\"code_verifier\");\n } else {\n const body = await c.req.json();\n grantType = body.grant_type;\n code = body.code;\n refreshToken = body.refresh_token;\n codeVerifier = body.code_verifier;\n }\n\n // Validate PKCE if provided\n if (codeVerifier) {\n console.log(\"PKCE verification:\", { codeVerifier });\n // In real impl, verify against stored code_challenge\n }\n\n if (grantType === \"authorization_code\") {\n if (code !== (config.fixedAuthCode || \"test_auth_code_123\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n } else if (grantType === \"refresh_token\") {\n if (refreshToken !== (config.fixedRefreshToken || \"test_refresh_token_xyz\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n }\n\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n });\n\n // Mock JWKS endpoint\n app.get(\"/jwks\", (c) => {\n return c.json({\n keys: [\n {\n kty: \"RSA\",\n use: \"sig\",\n kid: \"test-key-1\",\n alg: \"RS256\",\n n: \"xGOr-H7A-PWG\",\n e: \"AQAB\",\n },\n ],\n });\n });\n\n // Mock client registration endpoint\n app.post(\"/register\", async (c) => {\n const body = await c.req.json();\n\n return c.json({\n client_id: config.fixedClientId || \"test_client_id\",\n client_secret: \"test_client_secret\",\n client_id_issued_at: Math.floor(Date.now() / 1000),\n client_secret_expires_at: 0,\n redirect_uris: body.redirect_uris || [],\n token_endpoint_auth_method: \"client_secret_basic\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: body.client_name || \"Test Client\",\n scope: body.scope || \"openid profile email\",\n });\n });\n\n // Mock logout endpoint\n app.get(\"/logout\", (c) => {\n return c.text(\"Logged out successfully\");\n });\n\n // Health check\n app.get(\"/health\", (c) => {\n return c.json({ status: \"ok\", server: config.name });\n });\n\n return app;\n}\n\nexport function createServer(config: ServerConfig) {\n const app = config.type === \"resource\"\n ? createResourceServer(config)\n : createAuthServer(config);\n\n return app.fetch;\n}\n\nexport function startServer(config: ServerConfig) {\n const app = config.type === \"resource\"\n ? createResourceServer(config)\n : createAuthServer(config);\n\n const port = config.type === \"resource\" ? 3000 : 3001\n\n const serverType = config.type === \"resource\" ? \"Resource\" : \"Auth\";\n console.log(`${serverType} Server (${config.name}) running at http://localhost:${port}`);\n\n if (config.type === \"resource\") {\n console.log(\"\\nEndpoints:\");\n console.log(` MCP: http://localhost:${port}/mcp`);\n console.log(` Metadata: http://localhost:${port}${config.metadataPath}`);\n console.log(` Health: http://localhost:${port}/health`);\n if (config.authServerUrl) {\n console.log(` Auth Server: ${config.authServerUrl}`);\n }\n } else {\n const metadataPath = config.tenantPath\n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n console.log(\"\\nEndpoints:\");\n console.log(` Metadata: http://localhost:${port}${metadataPath}`);\n console.log(` Authorize: http://localhost:${port}/authorize`);\n console.log(` Token: http://localhost:${port}/token`);\n console.log(` Health: http://localhost:${port}/health`);\n }\n\n Deno.serve({ port, hostname: \"127.0.0.1\" }, app.fetch);\n}\n",[],[175],"files",[154,173],"counts",{"_187":32,"_188":122,"_189":122,"_190":191},"pulls","branches","forks","envVars",{"_192":32,"_193":32},"count","emptyCount","contents",[],{"_104":155,"_95":99,"_156":116,"_157":-5,"_158":142,"_159":101,"_160":22,"_106":197,"_100":162,"_163":164,"_165":166,"_167":22,"_168":169,"_98":198},["D",1755768239935],[99],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.branch.$branch.version.$version.code.$",{"_93":94,"_95":96,"_97":43,"_100":101,"_98":99,"_102":207,"_152":212,"_183":219,"_179":220,"_194":222,"_223":-5,"_224":-5,"_225":-5,"_226":-5,"_227":228},{"_104":105,"_95":96,"_106":208,"_108":-5,"_109":22,"_110":111,"_112":-5,"_113":-5,"_14":114,"_115":116,"_117":118,"_119":118,"_120":-5,"_121":122,"_16":123,"_124":125,"_126":125,"_127":128,"_129":128,"_130":128,"_131":125,"_132":125,"_23":209,"_136":210,"_139":211,"_151":22},["D",1755767895836],{"_93":94,"_134":135},{"_93":94,"_138":135,"_14":114},{"_100":141,"_95":43,"_104":142,"_143":105,"_144":-5,"_145":-5,"_146":-5,"_147":-5,"_148":-5,"_149":96,"_150":94},[213,216],{"_104":155,"_95":99,"_156":116,"_157":-5,"_158":142,"_159":101,"_160":22,"_106":161,"_100":162,"_163":164,"_165":166,"_167":22,"_168":169,"_170":214,"_98":215},[],[99],{"_104":174,"_95":175,"_156":176,"_157":-5,"_158":142,"_159":177,"_160":22,"_106":178,"_100":32,"_163":179,"_165":180,"_167":22,"_168":-5,"_170":217,"_98":218},[],[175],[213,216],{"_104":155,"_95":99,"_156":116,"_157":-5,"_158":142,"_159":101,"_160":22,"_106":197,"_100":162,"_163":164,"_165":166,"_167":22,"_168":169,"_98":221},[99],[],"upstream","pull","ahead","behind","templates",[],"actionData","errors"]

pcarleton

mcp-oauth-client1