Custom Provider

import { MCPServer } from "mcp-use";
import {
  createJwtVerifier,
  oauthCustomProvider,
  type OAuthAuthInfo,
  type OAuthMetadata,
} from "mcp-use/oauth";

const issuer = "https://auth.example.com";

const oauthMetadata = {
  issuer,
  authorization_endpoint: `${issuer}/oauth/authorize`,
  token_endpoint: `${issuer}/oauth/token`,
  registration_endpoint: `${issuer}/oauth/register`,
  response_types_supported: ["code"],
  grant_types_supported: ["authorization_code", "refresh_token"],
  code_challenge_methods_supported: ["S256"],
} satisfies OAuthMetadata;

type AppUser = {
  id: string;
  email?: string;
  organizationId?: string;
};

const server = new MCPServer({
  name: "custom-auth-server",
  version: "1.0.0",
  oauth: oauthCustomProvider<AppUser>({
    oauthMetadata,

    createTokenVerifier(resource) {
      return createJwtVerifier({
        issuer,
        jwksUrl: new URL(`${issuer}/.well-known/jwks.json`),
        resource,
      });
    },

    mapAuthInfo(authInfo: OAuthAuthInfo) {
      const payload = authInfo.extra?.payload as Record<string, unknown>;
      if (typeof payload.sub !== "string") {
        throw new Error("Verified token is missing sub");
      }

      return {
        user: {
          id: payload.sub,
          email: typeof payload.email === "string" ? payload.email : undefined,
          organizationId:
            typeof payload.organization_id === "string"
              ? payload.organization_id
              : undefined,
        },
        payload,
        permissions: Array.isArray(payload.permissions)
          ? payload.permissions.filter(
              (value): value is string => typeof value === "string",
            )
          : [],
      };
    },
  }),
});

export default server;

import { oauthCustomProvider, type OAuthProviderHost } from "mcp-use/oauth";

const oauth = oauthCustomProvider<AppUser>({
  createTokenVerifier,
  oauthMetadata,
  mapAuthInfo,
  setup(host: OAuthProviderHost<AppUser>) {
    for (const tool of host.listTools()) {
      if (tool.annotations?.destructiveHint && !tool._meta?.["shop/tags"]) {
        throw new Error(`Destructive tool "${tool.name}" needs shop/tags`);
      }
    }

    host.use("mcp:tools/call", async (ctx, next) => {
      // Let the consent tool through, or consent could never be recorded.
      if (ctx.params.name === "grant_consent") return next();
      if (!(await isAllowed(ctx.auth, ctx.params.name))) {
        return {
          isError: true,
          content: [{ type: "text", text: "Complete consent first." }],
        };
      }
      return next();
    });

    host.tool(
      { name: "grant_consent", description: "Record consent." },
      async (_params, ctx) => recordConsent(ctx.auth.user),
    );

    host.instructions((current) =>
      `${current ?? ""}\n\nCall grant_consent before other tools.`.trim(),
    );
  },
});