Auth0 Provider

AUTH0_DOMAIN=https://your-tenant.us.auth0.com
MCP_URL=https://mcp.example.com

import { MCPServer } from "mcp-use";
import { oauthAuth0Provider } from "mcp-use/oauth/auth0";

const domain = process.env.AUTH0_DOMAIN;
if (!domain) throw new Error("AUTH0_DOMAIN is required");

const server = new MCPServer({
  name: "auth0-server",
  version: "1.0.0",
  oauth: oauthAuth0Provider({ domain }),
});

export default server;

import { z } from "zod";

server.tool(
  {
    name: "delete_document",
    description: "Delete a document with the Auth0 permission.",
    inputSchema: z.object({ documentId: z.string() }),
  },
  async ({ documentId }, ctx) => {
    if (!ctx.auth.permissions.includes("delete:documents")) {
      return {
        isError: true,
        content: [{ type: "text", text: "Forbidden" }],
      };
    }

    await db.documents.delete({ id: documentId });
    return {
      content: [{ type: "text", text: `Deleted for ${ctx.auth.user.id}` }],
    };
  },
);