Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions docs/README.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ sidebar_position: 1
sidebar_label: Get started
---

import { NpmLikeInstallation } from '@site/src/components/NpmLikeInstallation';

import ScopeValidationWarning from './snippets/_scope-validation-warning.mdx';

# Get started

:::info MCP authorization specification support
Expand All @@ -28,8 +32,6 @@ You can check the [MCP-compatible provider list](/provider-list) to see if your

## Install MCP Auth SDK \{#install-mcp-auth-sdk}

import { NpmLikeInstallation } from '@site/src/components/NpmLikeInstallation';

<NpmLikeInstallation packageName="mcp-auth" />

## Init MCP Auth \{#init-mcp-auth}
Expand Down Expand Up @@ -107,8 +109,6 @@ Once the MCP Auth instance is initialized, you can apply the Bearer auth middlew
The `audience` parameter is **required** by the OAuth 2.0 specification for secure token validation. However, it is currently **optional** to maintain compatibility with authorization servers that do not yet support resource identifiers. For security reasons, **please always include the audience parameter** when possible. Future versions will enforce audience validation as mandatory to fully comply with the specification.
:::

import ScopeValidationWarning from './snippets/_scope-validation-warning.mdx';

<ScopeValidationWarning />

```ts
Expand All @@ -124,14 +124,14 @@ app.get(
'/notes',
mcpAuth.bearerAuth('jwt', {
resource: resourceIdentifier,
audience: resourceIdentifier, // Enable audience validation for security
audience: resourceIdentifier, // Enable audience validation for security
requiredScopes: ['read:notes'],
}),
(req, res) => {
// If the token is valid, `req.auth` is populated with its claims.
console.log('Auth info:', req.auth);
res.json({ notes: [] });
},
}
);

app.listen(3000);
Expand Down
14 changes: 8 additions & 6 deletions docs/configure-server/bearer-auth.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ const bearerAuth = mcpAuth.bearerAuth(
{
resource: 'https://api.example.com',
audience: 'https://api.example.com', // Enable audience validation for security
requiredScopes: ['read', 'write']
requiredScopes: ['read', 'write'],
}
);
```
Expand All @@ -106,11 +106,13 @@ To protect your MCP server with Bearer auth, you need to apply the Bearer auth m

```ts
const app = express();
app.use(mcpAuth.bearerAuth('jwt', {
resource: 'https://api.example.com',
audience: 'https://api.example.com', // Enable audience validation for security
requiredScopes: ['read', 'write']
}));
app.use(
mcpAuth.bearerAuth('jwt', {
resource: 'https://api.example.com',
audience: 'https://api.example.com', // Enable audience validation for security
requiredScopes: ['read', 'write'],
})
);
```

This will ensure that all incoming requests are authenticated and authorized according to the configured Bearer auth settings, and the auth information will be available in the request context.
Expand Down
5 changes: 4 additions & 1 deletion docs/configure-server/mcp-auth.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ sidebar_label: MCP Auth
With the latest [MCP Specification (2025-06-18)](https://modelcontextprotocol.io/specification/2025-06-18), your MCP server acts as a **Resource Server** that validates access tokens issued by external authorization servers.

To configure MCP Auth, you need two main steps:

1. **Configure Authorization Server Metadata** - Define which authorization servers can issue valid tokens for your MCP server and guide MCP clients on where to obtain access tokens
2. **Configure Protected Resource Metadata** - Define your MCP server as a protected resource with supported scopes

Expand Down Expand Up @@ -136,7 +137,9 @@ import express from 'express';

const app = express();

const mcpAuth = new MCPAuth({/* ... */});
const mcpAuth = new MCPAuth({
/* ... */
});

app.use(mcpAuth.protectedResourceMetadataRouter());
```
16 changes: 9 additions & 7 deletions docs/snippets/_get-started-code.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -10,19 +10,21 @@ const mcpAuth = new MCPAuth({
resource: resourceIdentifier,
authorizationServers: [authServerConfig],
scopesSupported: ['read', 'write'],
}
}
},
},
});

const app = express();

app.use(mcpAuth.protectedResourceMetadataRouter());

app.use(mcpAuth.bearerAuth('jwt', {
resource: resourceIdentifier,
audience: resourceIdentifier,
requiredScopes: ['read', 'write']
}));
app.use(
mcpAuth.bearerAuth('jwt', {
resource: resourceIdentifier,
audience: resourceIdentifier,
requiredScopes: ['read', 'write'],
})
);

server.registerTool(
'whoami',
Expand Down
17 changes: 6 additions & 11 deletions docs/tutorials/todo-manager/README.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ sidebar_position: 2
sidebar_label: 'Tutorial: Build a todo manager'
---

import { NpmLikeInstallation } from '@site/src/components/NpmLikeInstallation';
import TabItem from '@theme/TabItem';
import Tabs from '@theme/Tabs';

Expand All @@ -29,6 +30,7 @@ The tutorial will involve the following components:
- **MCP Server (Resource Server)**: According to the latest MCP specification, the MCP server acts as a Resource Server in the OAuth 2.0 framework. It validates access tokens issued by the authorization server and enforces scope-based permissions for todo operations.

This architecture follows the standard OAuth 2.0 flow where:

- The **MCP Inspector** requests protected resources on behalf of the user
- The **Authorization Server** authenticates the user and issues access tokens
- The **MCP Server** validates tokens and serves protected resources based on granted permissions
Expand Down Expand Up @@ -626,9 +628,7 @@ create:todos read:todos delete:todos

First, install the MCP Auth SDK in your MCP server project.

import { NpmLikeInstallation } from '@site/src/components/NpmLikeInstallation';

<NpmLikeInstallation packageName="mcp-auth@0.2.0-beta.1" />
<NpmLikeInstallation packageName="mcp-auth" />

Now we need to initialize MCP Auth in your MCP server. With the protected resource mode, you need to configure your resource metadata including the authorization servers.

Expand Down Expand Up @@ -683,13 +683,9 @@ const mcpAuth = new MCPAuth({
resource: resourceId,
authorizationServers: [authServerConfig],
// Scopes this MCP server understands
scopesSupported: [
"create:todos",
"read:todos",
"delete:todos"
]
}
}
scopesSupported: ['create:todos', 'read:todos', 'delete:todos'],
},
},
});
```

Expand All @@ -705,7 +701,6 @@ Now, apply protected resource metadata routes so that MCP clients can retrieve e
// Set up Protected Resource Metadata routes
// This exposes metadata about this resource server for OAuth clients
app.use(mcpAuth.protectedResourceMetadataRouter());

```

Next, we will apply the MCP Auth middleware to the MCP server. This middleware will handle authentication and authorization for incoming requests, ensuring that only authorized users can access the todo manager tools.
Expand Down
1 change: 1 addition & 0 deletions eslint.config.mjs
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ const configs = [
'**/generated-*.mdx',
'**/_template-*.mdx',
'docs/references/js/**/*.md', // Ignore generated files
'src/pages/**/*.mdx', // Ignore pages with custom heading IDs
],
},
{
Expand Down
Loading