MCP Endpoints

import { Elysia } from 'elysia';
import { mcpServer, verifyBearer } from '@absolutejs/mcp';
import { verifyJwt } from '@absolutejs/auth'; // or any JWT verifier

type Caller = { userId: string };

const server = new Elysia().use(
  mcpServer<Caller>({
    path: '/mcp',
    issuer: 'https://your.app',
    serverInfo: { name: 'your-app', title: 'Your App', version: '1.0.0' },
    instructions: 'What the model should know about this server.',
    scopesSupported: ['openid', 'mcp'],
    serveRootMetadata: true,

    // You decide who is allowed in. verifyBearer does the standard
    // OAuth access-token checks; add your own (billing, role, MFA)
    // on top.
    authorize: async (request) => {
      const token = await verifyBearer({
        request,
        issuer: 'https://your.app',
        requiredScope: 'mcp',
        verify: (jwt) => verifyJwt(jwt, publicJwk)
      });
      if ('error' in token) return { ok: false, reason: token.error };

      return { ok: true, caller: { userId: token.subject } };
    },

    // Called once per request; build the tools for this caller.
    tools: ({ caller }) => buildToolsFor(caller.userId)
  })
);

# An unauthorized POST gets the RFC 9728 challenge...
$ curl -i -X POST https://your.app/mcp
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://your.app/.well-known/oauth-protected-resource/mcp"

# ...and the metadata document points the client at your
# authorization server.
$ curl https://your.app/.well-known/oauth-protected-resource/mcp
{
  "authorization_servers": ["https://your.app"],
  "resource": "https://your.app/mcp",
  "scopes_supported": ["openid", "mcp"]
}

tools: ({ caller }) => ({
  get_report: {
    description: 'Fetch the latest report.',
    inputSchema: { type: 'object' },
    // Behaviour hints, passed straight through on tools/list.
    annotations: { readOnlyHint: true, title: 'Get report' },
    // JSON Schema for structuredContent, advertised on tools/list.
    outputSchema: {
      properties: { revenue: { type: 'number' } },
      type: 'object'
    },
    // A handler may return a bare string (wrapped as one text block),
    // an array of content blocks, or a full McpToolResult.
    handler: async () => [
      { text: 'Q2 revenue is up 14%.', type: 'text' },
      { data: chartBase64, mimeType: 'image/png', type: 'image' },
      { name: 'Full report', type: 'resource_link', uri: 'report://q2' }
    ]
  }
})

import { createMcpHandler } from '@absolutejs/mcp';

// The same config, no Elysia: a single (request) => Response | null
// over web-standard Request/Response. Mount it on Bun.serve, a Hono
// route, a Next.js route handler, or Cloudflare Workers. It returns
// null when the request is not for an MCP route, so you can fall
// through to your own routing.
const mcp = createMcpHandler(config);

Bun.serve({
  fetch: async (request) =>
    (await mcp(request)) ?? new Response('Not found', { status: 404 })
});

// mcpServer is per-endpoint, so an admin console is the same call
// with a different scope, a stricter authorize (role + MFA + a kill
// switch, re-checked live), a rate-limit beforeCall, and an audit
// onCall.
app.use(mcpServer({ path: '/mcp' /* member */ })).use(
  mcpServer({
    path: '/mcp/admin',
    scopesSupported: ['openid', 'mcp:admin'] /* stricter */
  })
);