@absolutejs/mcp 0.10.2 → 0.10.4

package/README.md

@@ -108,6 +108,7 @@ const server = new Elysia().use(
     // access-token checks; add your own (billing, role, MFA) on top.
     authorize: async (request) => {
       const token = await verifyBearer({
+        audience: "https://your.app/mcp",
         request,
         issuer: "https://your.app",
         requiredScope: "mcp",

package/dist/index.js

@@ -20,7 +20,7 @@ var isRecord = (value) => typeof value === "object" && value !== null && !Array.
 // src/auth.ts
 var MS_PER_SECOND = 1000;
 var verifyBearer = async (config) => {
-  const { issuer, request, verify, requiredScope } = config;
+  const { audience, issuer, request, verify, requiredScope } = config;
   const header = request.headers.get("authorization");
   if (!header?.startsWith("Bearer "))
     return { error: "Missing bearer token" };
@@ -32,6 +32,9 @@ var verifyBearer = async (config) => {
     return { error: "Not an access token" };
   if (payload.iss !== issuer)
     return { error: "Wrong issuer" };
+  const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+  if (audience !== undefined && !audiences.some((candidate) => candidate === audience))
+    return { error: "Wrong audience" };
   const expires = typeof payload.exp === "number" ? payload.exp : 0;
   if (expires * MS_PER_SECOND <= Date.now())
     return { error: "Token expired" };

package/dist/manifest.js

@@ -8505,6 +8505,16 @@ var Type2 = exports_type6;
 // src/manifest.ts
 var manifest = defineManifest()({
   contract: 2,
+  discovery: {
+    audiences: ["agent-hosts", "mcp-clients"],
+    intents: [
+      "serve MCP tools",
+      "connect an MCP client",
+      "run durable MCP tasks"
+    ],
+    keywords: ["agents", "mcp", "tools", "oauth", "tasks", "elicitation"],
+    protocols: ["MCP 2025-11-25", "OAuth 2.0"]
+  },
   identity: {
     accent: "#0ea5e9",
     category: "ai",

package/dist/manifest.json

@@ -1,5 +1,28 @@
 {
 	"contract": 2,
+	"discovery": {
+		"audiences": [
+			"agent-hosts",
+			"mcp-clients"
+		],
+		"intents": [
+			"serve MCP tools",
+			"connect an MCP client",
+			"run durable MCP tasks"
+		],
+		"keywords": [
+			"agents",
+			"mcp",
+			"tools",
+			"oauth",
+			"tasks",
+			"elicitation"
+		],
+		"protocols": [
+			"MCP 2025-11-25",
+			"OAuth 2.0"
+		]
+	},
 	"identity": {
 		"accent": "#0ea5e9",
 		"category": "ai",

package/dist/src/auth.d.ts

@@ -5,6 +5,8 @@ export type VerifiedJwt = {
 };
 export type BearerVerifier = (token: string) => Promise<VerifiedJwt | undefined> | VerifiedJwt | undefined;
 export type VerifyBearerConfig = {
+    /** Require the access token to name this protected resource in `aud`. */
+    audience?: string;
     issuer: string;
     request: Request;
     /** Verify the JWT signature and decode it (e.g. `@absolutejs/auth`'s
@@ -20,7 +22,7 @@ export type BearerResult = {
     subject: string;
 };
 /** Verify the `Authorization: Bearer` token: signature (via your `verify`),
- *  `token_use: access`, issuer, expiry, the required scope, and a subject.
+ *  `token_use: access`, issuer, optional audience, expiry, required scope, and a subject.
  *  Returns the decoded payload + parsed scopes + subject, or a reason string.
  *  The reason is safe to surface in the 401 (never why the signature failed). */
 export declare const verifyBearer: (config: VerifyBearerConfig) => Promise<BearerResult>;

package/package.json

@@ -58,5 +58,5 @@
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.10.2"
+  "version": "0.10.4"
 }