@upstash/context7-mcp 2.0.2 → 2.1.0-canary-20260108172005

package/README.md

@@ -1428,6 +1428,19 @@ CONTEXT7_API_KEY=your_api_key_here
 
 </details>
 
+### OAuth Authentication
+
+Context7 MCP server supports OAuth 2.0 authentication for MCP clients that implement the [MCP OAuth specification](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization).
+
+To use OAuth, change the endpoint from `/mcp` to `/mcp/oauth` in your client configuration:
+
+```diff
+- "url": "https://mcp.context7.com/mcp"
++ "url": "https://mcp.context7.com/mcp/oauth"
+```
+
+> **Note:** OAuth is not supported with stdio transport. For local MCP connections, use API key authentication instead.
+
 <details>
 <summary><b>Testing with MCP Inspector</b></summary>
 

package/dist/index.js

@@ -4,11 +4,12 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import { searchLibraries, fetchLibraryContext } from "./lib/api.js";
 import { formatSearchResults, extractClientInfoFromUserAgent } from "./lib/utils.js";
+import { isJWT, validateJWT } from "./lib/jwt.js";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { Command } from "commander";
 import { AsyncLocalStorage } from "async_hooks";
-import { SERVER_VERSION } from "./lib/constants.js";
+import { SERVER_VERSION, RESOURCE_URL, AUTH_SERVER_URL } from "./lib/constants.js";
 /** Default HTTP server port */
 const DEFAULT_PORT = 3000;
 // Parse CLI arguments using commander
@@ -245,11 +246,41 @@ async function main() {
                 extractHeaderValue(req.headers["context7_api_key"]) ||
                 extractHeaderValue(req.headers["x_api_key"]));
         };
-        app.all("/mcp", async (req, res) => {
+        const handleMcpRequest = async (req, res, requireAuth) => {
             try {
+                const apiKey = extractApiKey(req);
+                const resourceUrl = RESOURCE_URL;
+                const baseUrl = new URL(resourceUrl).origin;
+                // OAuth discovery info header, used by MCP clients to discover the authorization server
+                res.set("WWW-Authenticate", `Bearer resource_metadata="${baseUrl}/.well-known/oauth-protected-resource"`);
+                if (requireAuth) {
+                    if (!apiKey) {
+                        return res.status(401).json({
+                            jsonrpc: "2.0",
+                            error: {
+                                code: -32001,
+                                message: "Authentication required. Please authenticate to use this MCP server.",
+                            },
+                            id: null,
+                        });
+                    }
+                    if (isJWT(apiKey)) {
+                        const validationResult = await validateJWT(apiKey);
+                        if (!validationResult.valid) {
+                            return res.status(401).json({
+                                jsonrpc: "2.0",
+                                error: {
+                                    code: -32001,
+                                    message: validationResult.error || "Invalid token. Please re-authenticate.",
+                                },
+                                id: null,
+                            });
+                        }
+                    }
+                }
                 const context = {
                     clientIp: getClientIp(req),
-                    apiKey: extractApiKey(req),
+                    apiKey: apiKey,
                     clientInfo: extractClientInfoFromUserAgent(req.headers["user-agent"]),
                     transport: "http",
                 };
@@ -275,10 +306,50 @@ async function main() {
                     });
                 }
             }
+        };
+        // Anonymous access endpoint - no authentication required
+        app.all("/mcp", async (req, res) => {
+            await handleMcpRequest(req, res, false);
+        });
+        // OAuth-protected endpoint - requires authentication
+        app.all("/mcp/oauth", async (req, res) => {
+            await handleMcpRequest(req, res, true);
         });
         app.get("/ping", (_req, res) => {
             res.json({ status: "ok", message: "pong" });
         });
+        // OAuth 2.0 Protected Resource Metadata (RFC 9728)
+        // Used by MCP clients to discover the authorization server
+        app.get("/.well-known/oauth-protected-resource", (_req, res) => {
+            res.json({
+                resource: RESOURCE_URL,
+                authorization_servers: [AUTH_SERVER_URL],
+                scopes_supported: ["profile", "email"],
+                bearer_methods_supported: ["header"],
+            });
+        });
+        app.get("/.well-known/oauth-authorization-server", async (_req, res) => {
+            const authServerUrl = AUTH_SERVER_URL;
+            try {
+                const response = await fetch(`${authServerUrl}/.well-known/oauth-authorization-server`);
+                if (!response.ok) {
+                    console.error("[OAuth] Upstream error:", response.status);
+                    return res.status(response.status).json({
+                        error: "upstream_error",
+                        message: "Failed to fetch authorization server metadata",
+                    });
+                }
+                const metadata = await response.json();
+                res.json(metadata);
+            }
+            catch (error) {
+                console.error("[OAuth] Error fetching OAuth metadata:", error);
+                res.status(502).json({
+                    error: "proxy_error",
+                    message: "Failed to proxy authorization server metadata",
+                });
+            }
+        });
         // Catch-all 404 handler - must be after all other routes
         app.use((_req, res) => {
             res.status(404).json({

package/dist/lib/api.js

@@ -1,6 +1,6 @@
 import { generateHeaders } from "./encryption.js";
 import { ProxyAgent, setGlobalDispatcher } from "undici";
-const CONTEXT7_API_BASE_URL = "https://context7.com/api";
+import { CONTEXT7_API_BASE_URL } from "./constants.js";
 /**
  * Parses error response from the Context7 API
  * Extracts the server's error message, falling back to status-based messages if parsing fails

package/dist/lib/constants.js

@@ -1,2 +1,12 @@
-import pkg from "../../package.json" with { type: "json" };
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkg = JSON.parse(readFileSync(join(__dirname, "../../package.json"), "utf-8"));
 export const SERVER_VERSION = pkg.version;
+const CONTEXT7_BASE_URL = "https://context7.com";
+const MCP_RESOURCE_URL = "https://mcp.context7.com";
+export const CLERK_DOMAIN = "clerk.context7.com";
+export const CONTEXT7_API_BASE_URL = process.env.CONTEXT7_API_URL || `${CONTEXT7_BASE_URL}/api`;
+export const RESOURCE_URL = process.env.RESOURCE_URL || MCP_RESOURCE_URL;
+export const AUTH_SERVER_URL = process.env.AUTH_SERVER_URL || CONTEXT7_BASE_URL;

package/dist/lib/jwt.js

@@ -0,0 +1,29 @@
+import * as jose from "jose";
+import { CLERK_DOMAIN } from "./constants.js";
+const JWKS_URL = `https://${CLERK_DOMAIN}/.well-known/jwks.json`;
+const ISSUER = `https://${CLERK_DOMAIN}`;
+const jwks = jose.createRemoteJWKSet(new URL(JWKS_URL));
+export function isJWT(token) {
+    const parts = token.split(".");
+    return parts.length === 3;
+}
+export async function validateJWT(token) {
+    try {
+        await jose.jwtVerify(token, jwks, {
+            issuer: ISSUER,
+        });
+        return { valid: true };
+    }
+    catch (error) {
+        if (error instanceof jose.errors.JWTExpired) {
+            return { valid: false, error: "Token expired" };
+        }
+        if (error instanceof jose.errors.JWTClaimValidationFailed) {
+            return { valid: false, error: "Invalid token claims" };
+        }
+        if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+            return { valid: false, error: "Invalid signature" };
+        }
+        return { valid: false, error: "Invalid token" };
+    }
+}

package/package.json

@@ -1,8 +1,20 @@
 {
   "name": "@upstash/context7-mcp",
-  "version": "2.0.2",
+  "version": "2.1.0-canary-20260108172005",
   "mcpName": "io.github.upstash/context7",
   "description": "MCP server for Context7",
+  "scripts": {
+    "build": "tsc && chmod 755 dist/index.js",
+    "test": "echo \"No tests yet\"",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "lint:check": "eslint .",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js --transport http",
+    "pack-mcpb": "pnpm install && pnpm run build && rm -rf node_modules && pnpm install --prod && cp mcpb/manifest.json manifest.json && cp ../../public/icon.png icon.png && mcpb validate manifest.json && mcpb pack . mcpb/context7.mcpb && rm manifest.json icon.png && pnpm install"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/upstash/context7.git",
@@ -37,23 +49,12 @@
     "@types/express": "^5.0.4",
     "commander": "^14.0.0",
     "express": "^5.1.0",
+    "jose": "^6.1.3",
     "undici": "^6.6.3",
     "zod": "^3.24.2"
   },
   "devDependencies": {
-    "@types/node": "^22.13.14",
+    "@types/node": "^25.0.3",
     "typescript": "^5.8.2"
-  },
-  "scripts": {
-    "build": "tsc && chmod 755 dist/index.js",
-    "test": "echo \"No tests yet\"",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint .",
-    "lint:check": "eslint .",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
-    "dev": "tsc --watch",
-    "start": "node dist/index.js --transport http",
-    "pack-mcpb": "pnpm install && pnpm run build && rm -rf node_modules && pnpm install --prod && cp mcpb/manifest.json manifest.json && cp ../../public/icon.png icon.png && mcpb validate manifest.json && mcpb pack . mcpb/context7.mcpb && rm manifest.json icon.png && pnpm install"
   }
-}
+}