@aauth/ mcp- 服务器

MCP 的服务器侧 AAuth 。 验证已签名的请求,验证代理和认证令牌,建立AAuth挑战头,创建资源令牌,并管理202个交互流量.

部分 (auth-dev-packages-js) (韩语)。协议规格: 迪克哈特/澳大利亚。 。 。 .

安装

npm install @aauth/mcp-server

使用量

verifyToken(options): Promise<VerifiedToken>

根据签署的申请核证JWT。 支持两者 aa-agent+jwt 财务报告和审定财务报表 aa-auth+jwt 符号类型。 自动获取发件人元数据和JWKS(已标记).

import { verifyToken } from '@aauth/mcp-server'

const result = await verifyToken({
  jwt: tokenFromSignatureKeyHeader,
  httpSignatureThumbprint: thumbprintFromVerifiedSignature,
})

if (result.type === 'agent') {
  // VerifiedAgentToken: iss, sub, cnf, iat, exp
  console.log(`Agent: ${result.sub}`)
}

if (result.type === 'auth') {
  // VerifiedAuthToken: iss, aud, agent, cnf, sub?, scope?, iat, exp
  console.log(`Authorized agent: ${result.agent}, scope: ${result.scope}`)
}

掷出 AAuthTokenError 带有关于失败的光谱定义错误代码 :

buildAAuthHeader(requirement, params?): string

构建一个 AAuth-Requirement 响应头.

import { buildAAuthHeader } from '@aauth/mcp-server'

// 401 — require auth token
const header = buildAAuthHeader('auth-token', { resourceToken: '...' })
response.setHeader('aauth-requirement', header)

// 202 — require interaction
buildAAuthHeader('interaction', { url: 'https://example.com/interact', code: 'ABCD1234' })

// Simple levels (no params)
buildAAuthHeader('approval')
buildAAuthHeader('clarification')
buildAAuthHeader('claims')

buildAAuthAccessHeader(token): string

构建一个 AAuth-Access 双方模式的响应头。 令牌对代理不透明——资源包裹着自己的授权状态.

import { buildAAuthAccessHeader } from '@aauth/mcp-server'

response.setHeader('aauth-access', buildAAuthAccessHeader(wrappedToken))

parseCapabilitiesHeader(headerValue): Capability[]

解析 a AAuth-Capabilities 请求头.

import { parseCapabilitiesHeader } from '@aauth/mcp-server'

const caps = parseCapabilitiesHeader(request.headers.get('aauth-capabilities'))
// ['interaction', 'clarification', 'payment']

parseMissionHeader(headerValue): Mission

解析 a AAuth-Mission 请求页眉为 a Mission 可直接传递给 createResourceToken。 。 。 .

import { parseMissionHeader } from '@aauth/mcp-server'

const mission = parseMissionHeader(request.headers.get('aauth-mission'))
// { approver: 'https://ps.example', s256: '...' }

createResourceToken(options, sign): Promise<string>

创建一个 aa-resource+jwt 用于包含在401 AAuth 挑战中.

import { createResourceToken } from '@aauth/mcp-server'

const resourceToken = await createResourceToken(
  {
    resource: 'https://api.example.com',
    authServer: 'https://ps.example',      // PS URL (three-party) or AS URL (four-party)
    agent: 'aauth:[email protected]',
    agentJkt: thumbprint,                  // JWK Thumbprint of agent's signing key
    scope: 'files.read',
    mission: parseMissionHeader(request.headers.get('aauth-mission')),  // optional
    lifetime: 300,                         // seconds, default 300
  },
  async (payload, header) => {
    // Sign the JWT with your resource server's key
    return signedJwtString
  }
)

InteractionManager

管理待处理的202起递延反应流量请求.

import { InteractionManager } from '@aauth/mcp-server'

const manager = new InteractionManager({
  baseUrl: 'https://api.example.com',
  pendingPath: '/pending',  // default
  codeLength: 8,            // default
  ttl: 600,                 // seconds, default
})

// Create a pending request (returns headers for 202 response)
const { headers, pending } = manager.createPending()
// headers: { Location, Retry-After, Cache-Control, AAuth }
// pending: { id, code, promise, resolve, reject }

// Resolve when the interaction completes
manager.resolve(pending.id, { granted: true })

// Or reject
manager.reject(pending.id, 'denied')

// Cleanup expired entries
manager.cleanup()

clearMetadataCache()

清除缓存的发行者元数据和 JWKS verifyToken。 。 。 .

import { clearMetadataCache } from '@aauth/mcp-server'

clearMetadataCache()

许可证

麻省理工学院