Interface: McpAuthOptions

Defined in: index.ts:31

Authentication options for the MCP endpoint. Verification runs through @ttoss/http-server-auth's oauth strategy; supply either a Cognito user pool or a custom verifyToken.

Properties

authorizationServerUrl?

optional authorizationServerUrl?: string

Defined in: index.ts:66

URL of the OAuth Authorization Server that issues tokens for this resource.

---

cognitoUserPool?

optional cognitoUserPool?: CognitoUserPoolConfig

Defined in: index.ts:33

Amazon Cognito user pool config; a CognitoJwtVerifier is built from it.

---

publicMethods?

optional publicMethods?: string[]

Defined in: index.ts:53

JSON-RPC methods (read from body.method) that bypass verification. Leaving this unset serves tools/list — the full tool catalogue — to unauthenticated callers, and logs a one-time warning explaining how to close it. Set explicitly (even to the same default) to silence the warning; set to ['initialize'] to require a token for tools/list too.

Default

['initialize', 'tools/list']

---

requiredScopes?

optional requiredScopes?: string[]

Defined in: index.ts:44

Scopes that must all be present on the token, else 403. verifyToken may return either scope: string (space-separated) or scopes: string[]; both are normalised internally.

---

resourceIndicator?

optional resourceIndicator?: string | string[]

Defined in: index.ts:82

Expected audience — the resource indicator (RFC 8707) this MCP server identifies as. When set, the verified token's aud claim must include at least one of these values, or the request is rejected with 401. Without this check, a token minted for a different resource but signed by the same authorization server would still be accepted here — the classic confused-deputy risk RFC 8707 exists to close.

Applies uniformly regardless of whether verification is done via cognitoUserPool, a custom verifyToken, or @ttoss/auth-core/oidc's createOidcVerifier (which intentionally leaves audience validation to the caller for this reason).

Example

'https://mcp.example.com'

---

resourceMetadataUrl?

optional resourceMetadataUrl?: string

Defined in: index.ts:58

When set, a 401 carries WWW-Authenticate: Bearer resource_metadata="…" (RFC 9728) so MCP clients can discover the authorization server.

---

resourceServerUrl?

optional resourceServerUrl?: string

Defined in: index.ts:64

URL of this MCP server, surfaced in the OAuth Protected Resource Metadata response. Both this and authorizationServerUrl must be set to serve /.well-known/oauth-protected-resource.

---

verifyToken?

optional verifyToken?: (token) => Promise<unknown>

Defined in: index.ts:38

Custom token verifier for non-Cognito providers (Auth0, Keycloak, your own JWTs, opaque tokens). Resolve with the verified payload, or throw to reject.

Parameters

Parameter	Type
token	string

Returns

Promise<unknown>