${p.name}

Registers this val directly with ${p.name}’s MCP authorization server.

\n ${connection ? `

Authenticated MCP data

${tools.slice(0,4).map((t:any)=>`

${esc(t.name)}

`).join(\"\")}${tools.length>4?`+${tools.length-4} more tools`:\"\"}

`\n : `Connect ${p.name}`}\n

`;\n}\n\nfunction page(valUser:any, connections:any[], error?:string) {\n const map = new Map(connections.map((x:any)=>[x.provider,x]));\n const user = valUser?.user;\n return `\nOAuth without the paperwork

Live MCP OAuth

One val.
Eight services.

No developer portals. No manually created OAuth apps. Each button dynamically introduces this val to a service, authenticates, then displays tools returned by its MCP server.

\n${error?`

${esc(error)}

`:\"\"}\n

DCR

Val Town

The same idea without MCP in the middle: dynamically register, then fetch authenticated user data.

\n${user?`

@${esc(user.username)}user_id: ${esc(user.id||user.userId||\"authenticated\")}

`:`Connect Val Town`}

\n${providers.map(p=>card(p,map.get(p.key))).join(\"\")}\n

The n² collapse, live: none of these services knew this val existed. Shared discovery, registration, OAuth, and MCP protocols are the integration. View source.

`;\n}\n\napp.get(\"/\", async c => {\n await init();\n const valUser = await getOAuthUserData(c.req.raw);\n const sid = cookie(c.req.raw,\"mcp_demo_sid\");\n let connections:any[]=[];\n if(sid) connections=(await sqlite.execute({sql:\"SELECT provider, tools, connected_at FROM mcp_connections WHERE sid=?\",args:[sid]})).rows as any[];\n return c.html(page(valUser,connections,c.req.query(\"error\")));\n});\n\napp.get(\"/mcp/:provider/start\", async c => {\n await init();\n const p=byKey.get(c.req.param(\"provider\"));\n if(!p) return c.notFound();\n try{\n const origin=new URL(c.req.url).origin;\n const redirectUri=origin+\"/mcp/callback\";\n const verifier=b64url(crypto.getRandomValues(new Uint8Array(48)));\n const challenge=await sha256(verifier);\n const state=crypto.randomUUID();\n const registration:any={\n client_name:\"Val Town OAuth Demos\",\n client_uri:origin,\n redirect_uris:[redirectUri],\n grant_types:[\"authorization_code\",\"refresh_token\"],\n response_types:[\"code\"],\n token_endpoint_auth_method:p.authMethod,\n };\n const rr=await fetch(p.register,{method:\"POST\",headers:{\"content-type\":\"application/json\",\"accept\":\"application/json\"},body:JSON.stringify(registration)});\n const raw=await rr.text();\n if(!rr.ok) throw new Error(`${p.name} registration failed (${rr.status}): ${raw.slice(0,120)}`);\n const client=JSON.parse(raw);\n await sqlite.execute({sql:\"INSERT INTO mcp_flows(state,provider,client_id,client_secret,verifier,redirect_uri,created_at) VALUES(?,?,?,?,?,?,?)\",args:[state,p.key,client.client_id,client.client_secret||null,verifier,redirectUri,Date.now()]});\n const q:Record={response_type:\"code\",client_id:client.client_id,redirect_uri:redirectUri,state,code_challenge:challenge,code_challenge_method:\"S256\",resource:p.endpoint};\n if(p.scope) q.scope=p.scope;\n return c.redirect(p.auth+\"?\"+new URLSearchParams(q));\n }catch(e){return c.redirect(\"/?error=\"+encodeURIComponent(e instanceof Error?e.message:String(e)))}\n});\n\napp.get(\"/mcp/callback\", async c => {\n await init();\n const state=c.req.query(\"state\")||\"\", code=c.req.query(\"code\")||\"\";\n const flow:any=(await sqlite.execute({sql:\"SELECT * FROM mcp_flows WHERE state=?\",args:[state]})).rows[0];\n if(!flow||!code) return c.redirect(\"/?error=\"+encodeURIComponent(\"OAuth response could not be verified.\"));\n const p=byKey.get(flow.provider)!;\n try{\n const form:Record={grant_type:\"authorization_code\",code,client_id:flow.client_id,redirect_uri:flow.redirect_uri,code_verifier:flow.verifier,resource:p.endpoint};\n if(flow.client_secret) form.client_secret=flow.client_secret;\n const tr=await fetch(p.token,{method:\"POST\",headers:{\"content-type\":\"application/x-www-form-urlencoded\",\"accept\":\"application/json\"},body:new URLSearchParams(form)});\n const raw=await tr.text();\n if(!tr.ok) throw new Error(`${p.name} token exchange failed (${tr.status}): ${raw.slice(0,120)}`);\n const token=JSON.parse(raw);\n const tools=await authenticatedTools(p,token.access_token);\n let sid=cookie(c.req.raw,\"mcp_demo_sid\");\n if(!sid) sid=crypto.randomUUID();\n await sqlite.batch([\n {sql:\"INSERT OR REPLACE INTO mcp_connections(sid,provider,tools,connected_at) VALUES(?,?,?,?)\",args:[sid,p.key,JSON.stringify(tools),Date.now()]},\n {sql:\"DELETE FROM mcp_flows WHERE state=?\",args:[state]},\n {sql:\"DELETE FROM mcp_flows WHERE created_at < ?\",args:[Date.now()-3600000]},\n ]);\n return new Response(null,{status:302,headers:{location:\"/\",\"set-cookie\":`mcp_demo_sid=${sid}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=86400`}});\n }catch(e){return c.redirect(\"/?error=\"+encodeURIComponent(e instanceof Error?e.message:String(e)))}\n});\n\nexport default oauthMiddleware(app.fetch);\n","label",[132],"6d83eb4b-f9ba-4fd1-a14e-a8a852a0d51f","research","be4a3357-8a13-4c9e-913c-09690a439aea",9,["D",1784745267183],0,"directory",[143],"pulls","branches","forks",4,"envVars",{"_158":147,"_160":147},"connections",{"_158":147,"_159":147},"count","unfilledCount","emptyCount",{"_42":142,"_31":143,"_29":144,"_133":-5,"_40":41,"_39":145,"_135":58,"_37":182,"_13":147,"_33":148,"_35":-5,"_23":24,"_140":-5,"_166":183,"_26":184},{"_42":173,"_31":174,"_29":175,"_133":144,"_40":41,"_39":176,"_135":58,"_37":177,"_13":178,"_33":34,"_35":179,"_23":24,"_140":-5,"_166":180,"_26":181},{"_42":169,"_31":32,"_29":30,"_133":144,"_40":41,"_39":14,"_135":58,"_37":170,"_13":147,"_33":34,"_35":36,"_23":24,"_140":-5,"_166":171,"_26":172},{"_42":131,"_31":132,"_29":56,"_133":-5,"_40":41,"_39":134,"_135":24,"_37":165,"_13":137,"_33":138,"_35":139,"_23":24,"_140":44,"_166":167,"_26":168},["D",1784745447570],"children",[],[132],"be51f567-722d-4c27-8243-7b1382ee08d9",["D",1784745577550],[],[143,32],"14078280-4bef-4075-9352-23c58546b6a9","probe.ts","f82a8c5e-85fb-11f1-8c29-1607ee4eb77e",12,["D",1784745312157],3,"const targets = [\n [\"Notion\", \"https://mcp.notion.com/mcp\"],\n [\"Figma\", \"https://mcp.figma.com/mcp\"],\n [\"Slack\", \"https://mcp.slack.com/mcp\"],\n [\"Linear\", \"https://mcp.linear.app/mcp\"],\n [\"Sentry\", \"https://mcp.sentry.dev/mcp\"],\n [\"Atlassian\", \"https://mcp.atlassian.com/v1/mcp\"],\n [\"Canva\", \"https://mcp.canva.com/mcp\"],\n [\"Stripe\", \"https://mcp.stripe.com\"],\n [\"Intercom\", \"https://mcp.intercom.com/mcp\"],\n [\"Asana\", \"https://mcp.asana.com/sse\"],\n] as const;\n\nconst json = async (url: string) => {\n try {\n const r = await fetch(url, { redirect: \"manual\", headers: { accept: \"application/json, text/event-stream\" } });\n let body: any = null;\n try { body = await r.json(); } catch { body = (await r.text()).slice(0, 300); }\n return { url, status: r.status, headers: Object.fromEntries(r.headers), body };\n } catch (e) { return { url, error: String(e) }; }\n};\n\nasync function probe() {\n const output = [];\n for (const [name, endpoint] of targets) {\n const first: any = await json(endpoint);\n const auth = first.headers?.[\"www-authenticate\"] || \"\";\n const match = auth.match(/resource_metadata=\"([^\"]+)\"/);\n const candidates = [\n match?.[1],\n new URL(\"/.well-known/oauth-protected-resource\" + new URL(endpoint).pathname, endpoint).toString(),\n new URL(\"/.well-known/oauth-protected-resource\", endpoint).toString(),\n ].filter(Boolean) as string[];\n let resource: any = null;\n for (const u of [...new Set(candidates)]) {\n const x: any = await json(u);\n if (x.status === 200 && typeof x.body === \"object\") { resource = x; break; }\n }\n const issuer = resource?.body?.authorization_servers?.[0];\n let server: any = null;\n if (issuer) {\n for (const suffix of [\"/.well-known/oauth-authorization-server\", \"/.well-known/openid-configuration\"]) {\n const base = new URL(issuer);\n const u = base.origin + suffix + (base.pathname === \"/\" ? \"\" : base.pathname);\n const x: any = await json(u);\n if (x.status === 200 && typeof x.body === \"object\") { server = x; break; }\n }\n }\n output.push({\n name, endpoint,\n endpoint_status: first.status,\n www_authenticate: auth,\n resource_metadata_url: resource?.url,\n authorization_server: issuer,\n authorization_metadata_url: server?.url,\n authorization_endpoint: server?.body?.authorization_endpoint || null,\n token_endpoint: server?.body?.token_endpoint || null,\n scopes_supported: server?.body?.scopes_supported || null,\n registration_endpoint: server?.body?.registration_endpoint || null,\n client_id_metadata_document_supported: server?.body?.client_id_metadata_document_supported ?? server?.body?.client_id_metadata_documents_supported ?? null,\n auth_methods: server?.body?.token_endpoint_auth_methods_supported || null,\n error: first.error,\n });\n }\n console.log(JSON.stringify(output, null, 2));\n return output;\n}\n\nexport default await probe();",[],[143,174],["D",1784745267183],[162,163],[143],["D",1784744701880],["D",1789560070146],{"_99":98,"_106":102},{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"ctx",{"_81":-5,"_126":223,"_224":225,"_226":227,"_228":24,"_229":24,"_230":24,"_231":58,"_232":-5,"_233":-7,"_234":-7,"_235":147,"_236":24,"_237":24,"_238":-5,"_239":24,"_240":24,"_241":24,"_242":-5},"ENV",{"_194":195,"_196":197,"_198":89,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

${p.name}

One val.Eight services.

Val Town

One val.
Eight services.

Diff · v14