MCP Server Framework - v1.0.0
    Preparing search index...

    Interface AuthOptions

    Authentication configuration for the server.

    Passed via ServerOptions.auth or McpServerBuilder.withAuthOptions().

    import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js';

    const github = new ProxyOAuthServerProvider({ endpoints, verifyAccessToken, getClient });
    createServer({
      name: 'my-server',
      version: '1.0.0',
      transport: { mode: 'http' },
      auth: {
        provider: github,
        issuerUrl: new URL('https://github.com'),
        requiredScopes: ['read:user'],
      },
    });

    createServer({
      name: 'my-server',
      version: '1.0.0',
      transport: { mode: 'http' },
      auth: {
        provider: myApiKeyVerifier,
        headerName: 'X-API-Key',
      },
    });

    createServer({
      name: 'my-server',
      version: '1.0.0',
      transport: { mode: 'http' },
      auth: {
        provider: myJwtVerifier,
      },
    });
    interface AuthOptions {
        callbackHandler?: RequestHandler<
            ParamsDictionary,
            any,
            any,
            ParsedQs,
            Record<string, any>,
        >;
        headerName?: string;
        issuerUrl?: URL;
        onAuthenticated?: (
            authInfo: AuthInfo,
        ) => Promise<AuthenticatedExtra | undefined>;
        provider: AuthProvider;
        requiredScopes?: string[];
        resourceMetadataUrl?: string;
        scopeFilterCapabilities?: boolean;
    }
    Index

    Properties

    callbackHandler? headerName? issuerUrl? onAuthenticated? provider requiredScopes? resourceMetadataUrl? scopeFilterCapabilities?

    Properties

    callbackHandler?: RequestHandler<
        ParamsDictionary,
        any,
        any,
        ParsedQs,
        Record<string, any>,
    >

    Express handler for the OAuth callback route (GET /callback).

    Required for OAuth providers that use server-side callbacks (e.g., GitHub, Google) where the upstream provider redirects back to the MCP server rather than directly to the MCP client.

    The handler receives the authorization code from the upstream provider and redirects the user to the MCP client's redirect_uri.

    Only effective when a full OAuth provider is configured.

    headerName?: string

    Custom header name for token extraction.

    When set, the framework extracts the token from this header instead of the standard Authorization: Bearer <token> header. Only allowed with TokenVerifier providers (not with full OAuth providers).

    `'X-API-Key'` — extracts the value of the `X-API-Key` header
    issuerUrl?: URL

    OAuth issuer URL (Authorization Server identifier).

    Required for full OAuth providers. Used as the issuer in OAuth Authorization Server Metadata (RFC 8414). Must use HTTPS scheme and have no query or fragment components.

    onAuthenticated?: (
        authInfo: AuthInfo,
    ) => Promise<AuthenticatedExtra | undefined>

    Hook called after successful token verification.

    Use this to map OAuth clientId/scopes to your own user model. The returned data is available in tool handlers via context.auth.extra.

    Type Declaration

    provider: AuthProvider

    Authentication provider (full OAuth or token verifier)

    requiredScopes?: string[]

    Global required scopes for the /mcp endpoint.

    All requests to /mcp must have tokens with these scopes. Per-capability scopes can be set via requiredScopes on tool, resource, and prompt definitions.

    resourceMetadataUrl?: string

    Protected Resource Metadata URL (RFC 9728).

    Included in WWW-Authenticate headers for 401 responses, allowing clients to discover the authorization server.

    scopeFilterCapabilities?: boolean

    When true, capability list handlers (tools/list, resources/list, prompts/list) filter out entries whose requiredScopes are not satisfied by the requesting user's token.

    Default: false (spec-konform — all capabilities are listed regardless of scopes). Enforcement always happens at execution time (403), independent of this setting.

    Enable this for UIs that should only show actionable items to users.

    Settings

    Member Visibility

    On This Page

    Properties