MCP servers#

import { Hono } from "hono";
import { createRemoteJWKSet, jwtVerify } from "jose";

const ISSUER = "https://evonia-gate.annatarhe.com/api/auth";
const RESOURCE = "https://mcp.example.com/mcp"; // exactly the project's MCP server URL
const METADATA_URL = "https://mcp.example.com/.well-known/oauth-protected-resource/mcp";

// Module scope: the set caches keys and refetches only when it sees an unknown `kid`.
const jwks = createRemoteJWKSet(new URL("https://evonia-gate.annatarhe.com/.well-known/jwks.json"));

const app = new Hono<{ Variables: { userId: string; clientId: string } }>();

app.get("/.well-known/oauth-protected-resource/mcp", (c) =>
  c.json({
    resource: RESOURCE,
    authorization_servers: [ISSUER],
    bearer_methods_supported: ["header"],
    scopes_supported: ["openid", "profile", "email", "offline_access"],
  }),
);

app.use("/mcp", async (c, next) => {
  const header = c.req.header("authorization") ?? "";
  try {
    if (!header.startsWith("Bearer ")) throw new Error("missing bearer token");
    const { payload } = await jwtVerify(header.slice("Bearer ".length), jwks, {
      algorithms: ["ES256"],
      audience: RESOURCE,
      clockTolerance: 5,
      issuer: ISSUER,
    });
    c.set("userId", payload.sub!);
    c.set("clientId", String(payload.azp));
  } catch {
    c.header("WWW-Authenticate", `Bearer resource_metadata="${METADATA_URL}"`);
    return c.json({ error: "invalid_token" }, 401);
  }
  await next();
});

package mcpauth

import (
    "context"
    "encoding/json"
    "errors"
    "net/http"
    "strings"

    "github.com/coreos/go-oidc/v3/oidc"
)

const (
    issuer      = "https://evonia-gate.annatarhe.com/api/auth"
    resource    = "https://mcp.example.com/mcp" // exactly the project's MCP server URL
    metadataURL = "https://mcp.example.com/.well-known/oauth-protected-resource/mcp"
)

type Caller struct {
    UserID   string `json:"sub"`
    ClientID string `json:"azp"`
}

type callerKey struct{}

// Build once at startup: the provider caches JWKS and refreshes on unknown kid.
func NewVerifier(ctx context.Context) (*oidc.IDTokenVerifier, error) {
    provider, err := oidc.NewProvider(ctx, issuer)
    if err != nil {
        return nil, err
    }
    return provider.Verifier(&oidc.Config{
        ClientID:             resource, // checked against `aud`
        SupportedSigningAlgs: []string{oidc.ES256},
    }), nil
}

// Serve at /.well-known/oauth-protected-resource/mcp.
func ProtectedResourceMetadata(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string]any{
        "resource":                 resource,
        "authorization_servers":    []string{issuer},
        "bearer_methods_supported": []string{"header"},
        "scopes_supported":         []string{"openid", "profile", "email", "offline_access"},
    })
}

// Wrap the MCP endpoint.
func RequireToken(v *oidc.IDTokenVerifier, next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        caller, err := authenticate(r.Context(), v, r.Header.Get("Authorization"))
        if err != nil {
            w.Header().Set("WWW-Authenticate", `Bearer resource_metadata="`+metadataURL+`"`)
            http.Error(w, "invalid_token", http.StatusUnauthorized)
            return
        }
        next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), callerKey{}, caller)))
    })
}

func authenticate(ctx context.Context, v *oidc.IDTokenVerifier, header string) (Caller, error) {
    var caller Caller
    raw, ok := strings.CutPrefix(header, "Bearer ")
    if !ok {
        return caller, errors.New("missing bearer token")
    }
    token, err := v.Verify(ctx, raw)
    if err != nil {
        return caller, err
    }
    return caller, token.Claims(&caller)
}