Zum Hauptinhalt springen

Type Alias: MCPAuthConfig

type MCPAuthConfig = {
  jwtVerifyOptions?: Omit<JWTVerifyOptions, "issuer" | "audience">;
  protectedResourceMetadata: ProtectedResourceMetadataConfig;
};

Config for the MCPAuth class. One instance protects one resource and trusts one authorization server.

Properties​

jwtVerifyOptions?​

optional jwtVerifyOptions: Omit<JWTVerifyOptions, "issuer" | "audience">;

Per-call options passed to the underlying jose.jwtVerify function, e.g. clockTolerance or requiredClaims. The issuer and audience options are derived from protectedResourceMetadata and cannot be set here: the MCP authorization specification requires access tokens to be bound to this server's resource identifier (RFC 8707), and accepting unbound tokens would let a token issued for a different resource of the same authorization server be replayed against this MCP server.

See​

JWTVerifyOptions

protectedResourceMetadata​

protectedResourceMetadata: ProtectedResourceMetadataConfig;

The Protected Resource Metadata declaration (RFC 9728) of this MCP server, published through the SDK's metadata helpers and enforced by the token verifier.

See​

ProtectedResourceMetadataConfig