cdk-serverless 3.2.1 → 3.3.1

package/docs/lambda/index.html

@@ -55,6 +55,117 @@
 <pre><code class="typescript"><span class="hl-3">import</span><span class="hl-1"> { </span><span class="hl-4">IntegTestUtil</span><span class="hl-1"> } </span><span class="hl-3">from</span><span class="hl-1"> </span><span class="hl-2">&#39;cdk-serverless/tests/integ-test-util&#39;</span><span class="hl-1">;</span><br/><br/><span class="hl-6">// Initialize with your stack outputs</span><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">test</span><span class="hl-1"> = </span><span class="hl-5">new</span><span class="hl-1"> </span><span class="hl-0">IntegTestUtil</span><span class="hl-1">({</span><br/><span class="hl-1">  </span><span class="hl-4">region:</span><span class="hl-1"> </span><span class="hl-2">&#39;us-east-1&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">apiOptions:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">baseURL:</span><span class="hl-1"> </span><span class="hl-2">&#39;https://api.example.com&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">  </span><span class="hl-4">authOptions:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">userPoolId:</span><span class="hl-1"> </span><span class="hl-2">&#39;us-east-1_xxxxx&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">    </span><span class="hl-4">userPoolClientId:</span><span class="hl-1"> </span><span class="hl-2">&#39;xxxxxxxx&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">    </span><span class="hl-4">identityPoolId:</span><span class="hl-1"> </span><span class="hl-2">&#39;us-east-1:xxxxxxxx&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">  </span><span class="hl-4">datastoreOptions:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">tableName:</span><span class="hl-1"> </span><span class="hl-2">&#39;MyTable&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">});</span><br/><br/><span class="hl-6">// Create and authenticate a test user</span><br/><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">test</span><span class="hl-1">.</span><span class="hl-0">createUser</span><span class="hl-1">(</span><span class="hl-2">&#39;test@example.com&#39;</span><span class="hl-1">, {</span><br/><span class="hl-1">  </span><span class="hl-2">&#39;custom:attribute&#39;</span><span class="hl-4">:</span><span class="hl-1"> </span><span class="hl-2">&#39;value&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">}, [</span><span class="hl-2">&#39;admin&#39;</span><span class="hl-1">]);</span><br/><br/><span class="hl-6">// Get an authenticated API client</span><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">client</span><span class="hl-1"> = </span><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">test</span><span class="hl-1">.</span><span class="hl-0">getAuthenticatedClient</span><span class="hl-1">(</span><span class="hl-2">&#39;test@example.com&#39;</span><span class="hl-1">);</span><br/><br/><span class="hl-6">// Make API calls</span><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">response</span><span class="hl-1"> = </span><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">client</span><span class="hl-1">.</span><span class="hl-0">get</span><span class="hl-1">(</span><span class="hl-2">&#39;/items&#39;</span><span class="hl-1">);</span><br/><br/><span class="hl-6">// Clean up test data</span><br/><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">test</span><span class="hl-1">.</span><span class="hl-0">cleanupItems</span><span class="hl-1">();</span><br/><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">test</span><span class="hl-1">.</span><span class="hl-0">removeUser</span><span class="hl-1">(</span><span class="hl-2">&#39;test@example.com&#39;</span><span class="hl-1">);</span>
 </code><button type="button">Copy</button></pre>
 
+<h2 id="mcp-auth" class="tsd-anchor-link">MCP Auth<a href="#mcp-auth" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2>
+<p>CDK Serverless includes built-in support for adding <a href="https://spec.modelcontextprotocol.io">Model Context Protocol (MCP)</a> OAuth authentication to your API. This enables MCP clients like Claude and ChatGPT to authenticate with your API using standard OAuth 2.0 flows.</p>
+<p>When activated, the following endpoints are automatically added to your OpenAPI spec:</p>
+<table>
+<thead>
+<tr>
+<th>Endpoint</th>
+<th>Method</th>
+<th>RFC</th>
+<th>Purpose</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>/.well-known/oauth-protected-resource</code></td>
+<td>GET</td>
+<td>RFC 9728</td>
+<td>Resource metadata discovery</td>
+</tr>
+<tr>
+<td><code>/.well-known/oauth-authorization-server</code></td>
+<td>GET</td>
+<td>RFC 8414</td>
+<td>Authorization server metadata</td>
+</tr>
+<tr>
+<td><code>/oauth/authorize</code></td>
+<td>GET</td>
+<td>—</td>
+<td>Authorize proxy (redirect to upstream)</td>
+</tr>
+<tr>
+<td><code>/oauth/token</code></td>
+<td>POST</td>
+<td>—</td>
+<td>Token proxy (forward to upstream)</td>
+</tr>
+<tr>
+<td><code>/oauth/register</code></td>
+<td>POST</td>
+<td>RFC 7591</td>
+<td>Dynamic client registration</td>
+</tr>
+</tbody>
+</table>
+<p>All MCP auth endpoints are anonymous (no API authorizer applied).</p>
+<h3 id="with-cognito" class="tsd-anchor-link">With Cognito<a href="#with-cognito" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3>
+<p>MCP clients like Claude enforce that all OAuth endpoints (discovery, authorize, token, register) live on the <strong>same origin</strong> as the API itself. Cognito's hosted UI lives on a different domain (<code>auth.example.com</code>), so MCP clients cannot talk to it directly. Additionally:</p>
+<ul>
+<li>Cognito Managed Login v2 requires the RFC 8707 <code>resource</code> parameter for custom scopes in authorize requests — MCP clients do not send this parameter.</li>
+<li>MCP clients construct the token endpoint URL from the OAuth metadata <code>issuer</code> field rather than using the explicit <code>token_endpoint</code> — so the token exchange must be proxied through the API domain.</li>
+<li>Dynamic Client Registration (RFC 7591) is not natively supported by Cognito.</li>
+</ul>
+<p>The MCP auth proxy solves all three problems: it serves discovery metadata on the API domain, strips unsupported parameters before forwarding to Cognito, and implements a simplified registration endpoint that returns a pre-provisioned client ID.</p>
+<p>If your API already uses <code>CognitoAuthentication</code>, add MCP auth with minimal config — a dedicated user pool client is created automatically:</p>
+<pre><code class="typescript"><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">api</span><span class="hl-1"> = </span><span class="hl-5">new</span><span class="hl-1"> </span><span class="hl-0">TestApiRestApi</span><span class="hl-1">(</span><span class="hl-5">this</span><span class="hl-1">, </span><span class="hl-2">&#39;Api&#39;</span><span class="hl-1">, {</span><br/><span class="hl-1">  </span><span class="hl-4">stageName:</span><span class="hl-1"> </span><span class="hl-2">&#39;dev&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">domainName:</span><span class="hl-1"> </span><span class="hl-2">&#39;example.com&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">apiHostname:</span><span class="hl-1"> </span><span class="hl-2">&#39;api&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">authentication:</span><span class="hl-1"> </span><span class="hl-4">cognitoAuth</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">cors:</span><span class="hl-1"> </span><span class="hl-5">true</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">mcpAuth:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">cognito:</span><span class="hl-1"> {</span><br/><span class="hl-1">      </span><span class="hl-4">auth:</span><span class="hl-1"> </span><span class="hl-4">cognitoAuth</span><span class="hl-1">,           </span><span class="hl-6">// your CognitoAuthentication construct</span><br/><span class="hl-1">      </span><span class="hl-4">authDomain:</span><span class="hl-1"> </span><span class="hl-2">&#39;auth.example.com&#39;</span><span class="hl-1">, </span><span class="hl-6">// Cognito custom/hosted domain (required)</span><br/><span class="hl-1">    },</span><br/><span class="hl-1">    </span><span class="hl-4">serverInfo:</span><span class="hl-1"> { </span><span class="hl-4">name:</span><span class="hl-1"> </span><span class="hl-2">&#39;my-mcp-server&#39;</span><span class="hl-1">, </span><span class="hl-4">version:</span><span class="hl-1"> </span><span class="hl-2">&#39;1.0.0&#39;</span><span class="hl-1"> },</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">});</span>
+</code><button type="button">Copy</button></pre>
+
+<p>The <code>apiDomain</code> is derived from the RestApi's own domain config (<code>apiHostname</code> + <code>domainName</code>), and <code>stageName</code> is reused — no duplication needed.</p>
+<h3 id="with-any-oauth2-provider" class="tsd-anchor-link">With any OAuth2 provider<a href="#with-any-oauth2-provider" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3>
+<p>For non-Cognito providers, use <code>generic</code> mode with explicit endpoint URLs:</p>
+<pre><code class="typescript"><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">api</span><span class="hl-1"> = </span><span class="hl-5">new</span><span class="hl-1"> </span><span class="hl-0">TestApiRestApi</span><span class="hl-1">(</span><span class="hl-5">this</span><span class="hl-1">, </span><span class="hl-2">&#39;Api&#39;</span><span class="hl-1">, {</span><br/><span class="hl-1">  </span><span class="hl-6">// ...</span><br/><span class="hl-1">  </span><span class="hl-4">mcpAuth:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">generic:</span><span class="hl-1"> {</span><br/><span class="hl-1">      </span><span class="hl-4">authorizeEndpoint:</span><span class="hl-1"> </span><span class="hl-2">&#39;https://auth.example.com/authorize&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">      </span><span class="hl-4">tokenEndpoint:</span><span class="hl-1"> </span><span class="hl-2">&#39;https://auth.example.com/token&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">      </span><span class="hl-4">clientId:</span><span class="hl-1"> </span><span class="hl-2">&#39;my-pre-provisioned-client-id&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">    },</span><br/><span class="hl-1">    </span><span class="hl-4">serverInfo:</span><span class="hl-1"> { </span><span class="hl-4">name:</span><span class="hl-1"> </span><span class="hl-2">&#39;my-mcp-server&#39;</span><span class="hl-1">, </span><span class="hl-4">version:</span><span class="hl-1"> </span><span class="hl-2">&#39;1.0.0&#39;</span><span class="hl-1"> },</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">});</span>
+</code><button type="button">Copy</button></pre>
+
+<h3 id="configuration-options" class="tsd-anchor-link">Configuration options<a href="#configuration-options" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3>
+<table>
+<thead>
+<tr>
+<th>Option</th>
+<th>Default</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>serverInfo</code></td>
+<td>(required)</td>
+<td><code>{ name, version }</code> returned in MCP initialize</td>
+</tr>
+<tr>
+<td><code>allowedRedirectUris</code></td>
+<td>Claude + ChatGPT callbacks</td>
+<td>Allowlist for dynamic registration</td>
+</tr>
+<tr>
+<td><code>protocolVersions</code></td>
+<td><code>['2025-11-25', '2025-03-26', '2024-11-05']</code></td>
+<td>Supported MCP versions</td>
+</tr>
+<tr>
+<td><code>scopes</code></td>
+<td><code>['openid', 'email', 'profile']</code></td>
+<td>Advertised OAuth scopes</td>
+</tr>
+<tr>
+<td><code>stripParameters</code></td>
+<td><code>['resource']</code></td>
+<td>Params stripped from authorize/token proxying</td>
+</tr>
+<tr>
+<td><code>lambdaOptions</code></td>
+<td>—</td>
+<td>Lambda config for MCP auth handlers</td>
+</tr>
+</tbody>
+</table>
+<h3 id="mcp-server-runtime" class="tsd-anchor-link">MCP Server runtime<a href="#mcp-server-runtime" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3>
+<p>The <code>cdk-serverless/mcp-auth</code> module also exports a JSON-RPC server for implementing the MCP tool endpoint itself:</p>
+<pre><code class="typescript"><span class="hl-3">import</span><span class="hl-1"> { </span><span class="hl-4">createMcpServer</span><span class="hl-1"> } </span><span class="hl-3">from</span><span class="hl-1"> </span><span class="hl-2">&#39;cdk-serverless/mcp-auth&#39;</span><span class="hl-1">;</span><br/><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">server</span><span class="hl-1"> = </span><span class="hl-0">createMcpServer</span><span class="hl-1">({</span><br/><span class="hl-1">  </span><span class="hl-4">serverInfo:</span><span class="hl-1"> { </span><span class="hl-4">name:</span><span class="hl-1"> </span><span class="hl-2">&#39;my-server&#39;</span><span class="hl-1">, </span><span class="hl-4">version:</span><span class="hl-1"> </span><span class="hl-2">&#39;1.0.0&#39;</span><span class="hl-1"> },</span><br/><span class="hl-1">  </span><span class="hl-4">protocolVersions:</span><span class="hl-1"> [</span><span class="hl-2">&#39;2025-11-25&#39;</span><span class="hl-1">],</span><br/><span class="hl-1">  </span><span class="hl-4">resolver:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-5">async</span><span class="hl-1"> </span><span class="hl-0">resolve</span><span class="hl-1">(</span><span class="hl-4">headers</span><span class="hl-1">) {</span><br/><span class="hl-1">      </span><span class="hl-6">// Validate Bearer token, return principal or throw McpUnauthorizedError</span><br/><span class="hl-1">      </span><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">token</span><span class="hl-1"> = </span><span class="hl-4">headers</span><span class="hl-1">.</span><span class="hl-4">authorization</span><span class="hl-1">?.</span><span class="hl-0">replace</span><span class="hl-1">(</span><span class="hl-2">&#39;Bearer &#39;</span><span class="hl-1">, </span><span class="hl-2">&#39;&#39;</span><span class="hl-1">);</span><br/><span class="hl-1">      </span><span class="hl-3">if</span><span class="hl-1"> (!</span><span class="hl-4">token</span><span class="hl-1">) </span><span class="hl-3">throw</span><span class="hl-1"> </span><span class="hl-5">new</span><span class="hl-1"> </span><span class="hl-0">McpUnauthorizedError</span><span class="hl-1">(</span><span class="hl-2">&#39;Bearer&#39;</span><span class="hl-1">);</span><br/><span class="hl-1">      </span><span class="hl-3">return</span><span class="hl-1"> </span><span class="hl-0">verifyToken</span><span class="hl-1">(</span><span class="hl-4">token</span><span class="hl-1">);</span><br/><span class="hl-1">    },</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">  </span><span class="hl-4">tools:</span><span class="hl-1"> [</span><br/><span class="hl-1">    {</span><br/><span class="hl-1">      </span><span class="hl-4">name:</span><span class="hl-1"> </span><span class="hl-2">&#39;search&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">      </span><span class="hl-4">description:</span><span class="hl-1"> </span><span class="hl-2">&#39;Search documents&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">      </span><span class="hl-4">inputSchema:</span><span class="hl-1"> { </span><span class="hl-4">type:</span><span class="hl-1"> </span><span class="hl-2">&#39;object&#39;</span><span class="hl-1">, </span><span class="hl-4">properties:</span><span class="hl-1"> { </span><span class="hl-4">query:</span><span class="hl-1"> { </span><span class="hl-4">type:</span><span class="hl-1"> </span><span class="hl-2">&#39;string&#39;</span><span class="hl-1"> } } },</span><br/><span class="hl-1">      </span><span class="hl-5">async</span><span class="hl-1"> </span><span class="hl-0">invoke</span><span class="hl-1">(</span><span class="hl-4">principal</span><span class="hl-1">, </span><span class="hl-4">args</span><span class="hl-1">) {</span><br/><span class="hl-1">        </span><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">results</span><span class="hl-1"> = </span><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-0">search</span><span class="hl-1">(</span><span class="hl-4">principal</span><span class="hl-1">, (</span><span class="hl-4">args</span><span class="hl-1"> </span><span class="hl-3">as</span><span class="hl-1"> </span><span class="hl-8">any</span><span class="hl-1">).</span><span class="hl-4">query</span><span class="hl-1">);</span><br/><span class="hl-1">        </span><span class="hl-3">return</span><span class="hl-1"> { </span><span class="hl-4">content:</span><span class="hl-1"> [{ </span><span class="hl-4">type:</span><span class="hl-1"> </span><span class="hl-2">&#39;text&#39;</span><span class="hl-1">, </span><span class="hl-4">text:</span><span class="hl-1"> </span><span class="hl-7">JSON</span><span class="hl-1">.</span><span class="hl-0">stringify</span><span class="hl-1">(</span><span class="hl-4">results</span><span class="hl-1">) }] };</span><br/><span class="hl-1">      },</span><br/><span class="hl-1">    },</span><br/><span class="hl-1">  ],</span><br/><span class="hl-1">});</span><br/><br/><span class="hl-6">// In your Lambda handler:</span><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">response</span><span class="hl-1"> = </span><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">server</span><span class="hl-1">.</span><span class="hl-0">handle</span><span class="hl-1">(</span><span class="hl-4">parsedBody</span><span class="hl-1">, </span><span class="hl-4">event</span><span class="hl-1">.</span><span class="hl-4">headers</span><span class="hl-1">);</span>
+</code><button type="button">Copy</button></pre>
+
 <h2 id="breaking-change-removed" class="tsd-anchor-link">Breaking Change: <code>axios</code> Removed<a href="#breaking-change-removed" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2>
 <p>CDK Serverless no longer depends on <code>axios</code>. The library now uses the
 platform-native <code>fetch</code> API (stable in Node.js 18+; the Lambda functions
@@ -136,4 +247,4 @@ issue.</p>
 </ul>
 <h2 id="authors" class="tsd-anchor-link">Authors<a href="#authors" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2>
 <p>Brought to you by <a href="https://taimos.de">Taimos</a></p>
-</div></div><div class="col-sidebar"><div class="page-menu"><div class="tsd-navigation settings"><details class="tsd-accordion"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>Settings</h3></summary><div class="tsd-accordion-details"><div class="tsd-filter-visibility"><span class="settings-label">Member Visibility</span><ul id="tsd-filter-options"><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-protected" name="protected"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Protected</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-inherited" name="inherited" checked/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Inherited</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-external" name="external"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>External</span></label></li></ul></div><div class="tsd-theme-toggle"><label class="settings-label" for="tsd-theme">Theme</label><select id="tsd-theme"><option value="os">OS</option><option value="light">Light</option><option value="dark">Dark</option></select></div></div></details></div><details open class="tsd-accordion tsd-page-navigation"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>On This Page</h3></summary><div class="tsd-accordion-details"><a href="#cdk-serverless"><span>CDK <wbr/>Serverless</span></a><ul><li><ul><li><a href="#features"><span>Features</span></a></li></ul></li><li><a href="#quick-start"><span>Quick <wbr/>Start</span></a></li><li><ul><li><a href="#adding-projen-constructs"><span>Adding projen constructs</span></a></li><li><a href="#using-the-cdk-serverless-l3-constructs"><span>Using the <wbr/>CDK serverless <wbr/>L3 constructs</span></a></li></ul></li><li><a href="#testing-utilities"><span>Testing <wbr/>Utilities</span></a></li><li><ul><li><a href="#lambdatestutil"><span>Lambda<wbr/>Test<wbr/>Util</span></a></li><li><ul><li><a href="#rest-api-testing"><span>REST <wbr/>API <wbr/>Testing</span></a></li><li><a href="#graphql-testing"><span>Graph<wbr/>QL <wbr/>Testing</span></a></li></ul></li><li><a href="#integtestutil"><span>Integ<wbr/>Test<wbr/>Util</span></a></li></ul></li><li><a href="#breaking-change-removed"><span>Breaking <wbr/>Change:  <wbr/>Removed</span></a></li><li><ul><li><a href="#impact-on-lambda-handlers-"><span>Impact on <wbr/>Lambda handlers ()</span></a></li><li><a href="#impact-on-"><span>Impact on  ()</span></a></li></ul></li><li><a href="#contribute"><span>Contribute</span></a></li><li><ul><li><a href="#how-to-contribute-to-cdk-serverless"><span>How to contribute to <wbr/>CDK <wbr/>Serverless</span></a></li><li><ul><li><a href="#did-you-find-a-bug"><span>Did you find a bug?</span></a></li><li><a href="#did-you-write-a-patch-that-fixes-a-bug"><span>Did you write a patch that fixes a bug?</span></a></li><li><a href="#did-you-fix-whitespace-format-code-or-make-a-purely-cosmetic-patch"><span>Did you fix whitespace, format code, or make a purely cosmetic patch?</span></a></li><li><a href="#do-you-intend-to-add-a-new-feature-or-change-an-existing-one"><span>Do you intend to add a new feature or change an existing one?</span></a></li><li><a href="#do-you-want-to-contribute-to-the-cdk-serverless-documentation"><span>Do you want to contribute to the <wbr/>CDK <wbr/>Serverless documentation?</span></a></li></ul></li></ul></li><li><a href="#authors"><span>Authors</span></a></li></ul></div></details></div><div class="site-menu"><nav class="tsd-navigation"><a href="modules.html">cdk-serverless</a><ul class="tsd-small-nested-navigation" id="tsd-nav-container"><li>Loading...</li></ul></nav></div></div></div><footer><p class="tsd-generator">Generated using <a href="https://typedoc.org/" target="_blank">TypeDoc</a></p></footer><div class="overlay"></div></body></html>
+</div></div><div class="col-sidebar"><div class="page-menu"><div class="tsd-navigation settings"><details class="tsd-accordion"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>Settings</h3></summary><div class="tsd-accordion-details"><div class="tsd-filter-visibility"><span class="settings-label">Member Visibility</span><ul id="tsd-filter-options"><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-protected" name="protected"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Protected</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-inherited" name="inherited" checked/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Inherited</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-external" name="external"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>External</span></label></li></ul></div><div class="tsd-theme-toggle"><label class="settings-label" for="tsd-theme">Theme</label><select id="tsd-theme"><option value="os">OS</option><option value="light">Light</option><option value="dark">Dark</option></select></div></div></details></div><details open class="tsd-accordion tsd-page-navigation"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>On This Page</h3></summary><div class="tsd-accordion-details"><a href="#cdk-serverless"><span>CDK <wbr/>Serverless</span></a><ul><li><ul><li><a href="#features"><span>Features</span></a></li></ul></li><li><a href="#quick-start"><span>Quick <wbr/>Start</span></a></li><li><ul><li><a href="#adding-projen-constructs"><span>Adding projen constructs</span></a></li><li><a href="#using-the-cdk-serverless-l3-constructs"><span>Using the <wbr/>CDK serverless <wbr/>L3 constructs</span></a></li></ul></li><li><a href="#testing-utilities"><span>Testing <wbr/>Utilities</span></a></li><li><ul><li><a href="#lambdatestutil"><span>Lambda<wbr/>Test<wbr/>Util</span></a></li><li><ul><li><a href="#rest-api-testing"><span>REST <wbr/>API <wbr/>Testing</span></a></li><li><a href="#graphql-testing"><span>Graph<wbr/>QL <wbr/>Testing</span></a></li></ul></li><li><a href="#integtestutil"><span>Integ<wbr/>Test<wbr/>Util</span></a></li></ul></li><li><a href="#mcp-auth"><span>MCP <wbr/>Auth</span></a></li><li><ul><li><a href="#with-cognito"><span>With <wbr/>Cognito</span></a></li><li><a href="#with-any-oauth2-provider"><span>With any <wbr/>O<wbr/>Auth2 provider</span></a></li><li><a href="#configuration-options"><span>Configuration options</span></a></li><li><a href="#mcp-server-runtime"><span>MCP <wbr/>Server runtime</span></a></li></ul></li><li><a href="#breaking-change-removed"><span>Breaking <wbr/>Change:  <wbr/>Removed</span></a></li><li><ul><li><a href="#impact-on-lambda-handlers-"><span>Impact on <wbr/>Lambda handlers ()</span></a></li><li><a href="#impact-on-"><span>Impact on  ()</span></a></li></ul></li><li><a href="#contribute"><span>Contribute</span></a></li><li><ul><li><a href="#how-to-contribute-to-cdk-serverless"><span>How to contribute to <wbr/>CDK <wbr/>Serverless</span></a></li><li><ul><li><a href="#did-you-find-a-bug"><span>Did you find a bug?</span></a></li><li><a href="#did-you-write-a-patch-that-fixes-a-bug"><span>Did you write a patch that fixes a bug?</span></a></li><li><a href="#did-you-fix-whitespace-format-code-or-make-a-purely-cosmetic-patch"><span>Did you fix whitespace, format code, or make a purely cosmetic patch?</span></a></li><li><a href="#do-you-intend-to-add-a-new-feature-or-change-an-existing-one"><span>Do you intend to add a new feature or change an existing one?</span></a></li><li><a href="#do-you-want-to-contribute-to-the-cdk-serverless-documentation"><span>Do you want to contribute to the <wbr/>CDK <wbr/>Serverless documentation?</span></a></li></ul></li></ul></li><li><a href="#authors"><span>Authors</span></a></li></ul></div></details></div><div class="site-menu"><nav class="tsd-navigation"><a href="modules.html">cdk-serverless</a><ul class="tsd-small-nested-navigation" id="tsd-nav-container"><li>Loading...</li></ul></nav></div></div></div><footer><p class="tsd-generator">Generated using <a href="https://typedoc.org/" target="_blank">TypeDoc</a></p></footer><div class="overlay"></div></body></html>

package/docs/projen/index.html

@@ -55,6 +55,117 @@
 <pre><code class="typescript"><span class="hl-3">import</span><span class="hl-1"> { </span><span class="hl-4">IntegTestUtil</span><span class="hl-1"> } </span><span class="hl-3">from</span><span class="hl-1"> </span><span class="hl-2">&#39;cdk-serverless/tests/integ-test-util&#39;</span><span class="hl-1">;</span><br/><br/><span class="hl-6">// Initialize with your stack outputs</span><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">test</span><span class="hl-1"> = </span><span class="hl-5">new</span><span class="hl-1"> </span><span class="hl-0">IntegTestUtil</span><span class="hl-1">({</span><br/><span class="hl-1">  </span><span class="hl-4">region:</span><span class="hl-1"> </span><span class="hl-2">&#39;us-east-1&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">apiOptions:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">baseURL:</span><span class="hl-1"> </span><span class="hl-2">&#39;https://api.example.com&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">  </span><span class="hl-4">authOptions:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">userPoolId:</span><span class="hl-1"> </span><span class="hl-2">&#39;us-east-1_xxxxx&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">    </span><span class="hl-4">userPoolClientId:</span><span class="hl-1"> </span><span class="hl-2">&#39;xxxxxxxx&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">    </span><span class="hl-4">identityPoolId:</span><span class="hl-1"> </span><span class="hl-2">&#39;us-east-1:xxxxxxxx&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">  </span><span class="hl-4">datastoreOptions:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">tableName:</span><span class="hl-1"> </span><span class="hl-2">&#39;MyTable&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">});</span><br/><br/><span class="hl-6">// Create and authenticate a test user</span><br/><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">test</span><span class="hl-1">.</span><span class="hl-0">createUser</span><span class="hl-1">(</span><span class="hl-2">&#39;test@example.com&#39;</span><span class="hl-1">, {</span><br/><span class="hl-1">  </span><span class="hl-2">&#39;custom:attribute&#39;</span><span class="hl-4">:</span><span class="hl-1"> </span><span class="hl-2">&#39;value&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">}, [</span><span class="hl-2">&#39;admin&#39;</span><span class="hl-1">]);</span><br/><br/><span class="hl-6">// Get an authenticated API client</span><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">client</span><span class="hl-1"> = </span><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">test</span><span class="hl-1">.</span><span class="hl-0">getAuthenticatedClient</span><span class="hl-1">(</span><span class="hl-2">&#39;test@example.com&#39;</span><span class="hl-1">);</span><br/><br/><span class="hl-6">// Make API calls</span><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">response</span><span class="hl-1"> = </span><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">client</span><span class="hl-1">.</span><span class="hl-0">get</span><span class="hl-1">(</span><span class="hl-2">&#39;/items&#39;</span><span class="hl-1">);</span><br/><br/><span class="hl-6">// Clean up test data</span><br/><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">test</span><span class="hl-1">.</span><span class="hl-0">cleanupItems</span><span class="hl-1">();</span><br/><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">test</span><span class="hl-1">.</span><span class="hl-0">removeUser</span><span class="hl-1">(</span><span class="hl-2">&#39;test@example.com&#39;</span><span class="hl-1">);</span>
 </code><button type="button">Copy</button></pre>
 
+<h2 id="mcp-auth" class="tsd-anchor-link">MCP Auth<a href="#mcp-auth" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2>
+<p>CDK Serverless includes built-in support for adding <a href="https://spec.modelcontextprotocol.io">Model Context Protocol (MCP)</a> OAuth authentication to your API. This enables MCP clients like Claude and ChatGPT to authenticate with your API using standard OAuth 2.0 flows.</p>
+<p>When activated, the following endpoints are automatically added to your OpenAPI spec:</p>
+<table>
+<thead>
+<tr>
+<th>Endpoint</th>
+<th>Method</th>
+<th>RFC</th>
+<th>Purpose</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>/.well-known/oauth-protected-resource</code></td>
+<td>GET</td>
+<td>RFC 9728</td>
+<td>Resource metadata discovery</td>
+</tr>
+<tr>
+<td><code>/.well-known/oauth-authorization-server</code></td>
+<td>GET</td>
+<td>RFC 8414</td>
+<td>Authorization server metadata</td>
+</tr>
+<tr>
+<td><code>/oauth/authorize</code></td>
+<td>GET</td>
+<td>—</td>
+<td>Authorize proxy (redirect to upstream)</td>
+</tr>
+<tr>
+<td><code>/oauth/token</code></td>
+<td>POST</td>
+<td>—</td>
+<td>Token proxy (forward to upstream)</td>
+</tr>
+<tr>
+<td><code>/oauth/register</code></td>
+<td>POST</td>
+<td>RFC 7591</td>
+<td>Dynamic client registration</td>
+</tr>
+</tbody>
+</table>
+<p>All MCP auth endpoints are anonymous (no API authorizer applied).</p>
+<h3 id="with-cognito" class="tsd-anchor-link">With Cognito<a href="#with-cognito" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3>
+<p>MCP clients like Claude enforce that all OAuth endpoints (discovery, authorize, token, register) live on the <strong>same origin</strong> as the API itself. Cognito's hosted UI lives on a different domain (<code>auth.example.com</code>), so MCP clients cannot talk to it directly. Additionally:</p>
+<ul>
+<li>Cognito Managed Login v2 requires the RFC 8707 <code>resource</code> parameter for custom scopes in authorize requests — MCP clients do not send this parameter.</li>
+<li>MCP clients construct the token endpoint URL from the OAuth metadata <code>issuer</code> field rather than using the explicit <code>token_endpoint</code> — so the token exchange must be proxied through the API domain.</li>
+<li>Dynamic Client Registration (RFC 7591) is not natively supported by Cognito.</li>
+</ul>
+<p>The MCP auth proxy solves all three problems: it serves discovery metadata on the API domain, strips unsupported parameters before forwarding to Cognito, and implements a simplified registration endpoint that returns a pre-provisioned client ID.</p>
+<p>If your API already uses <code>CognitoAuthentication</code>, add MCP auth with minimal config — a dedicated user pool client is created automatically:</p>
+<pre><code class="typescript"><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">api</span><span class="hl-1"> = </span><span class="hl-5">new</span><span class="hl-1"> </span><span class="hl-0">TestApiRestApi</span><span class="hl-1">(</span><span class="hl-5">this</span><span class="hl-1">, </span><span class="hl-2">&#39;Api&#39;</span><span class="hl-1">, {</span><br/><span class="hl-1">  </span><span class="hl-4">stageName:</span><span class="hl-1"> </span><span class="hl-2">&#39;dev&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">domainName:</span><span class="hl-1"> </span><span class="hl-2">&#39;example.com&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">apiHostname:</span><span class="hl-1"> </span><span class="hl-2">&#39;api&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">authentication:</span><span class="hl-1"> </span><span class="hl-4">cognitoAuth</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">cors:</span><span class="hl-1"> </span><span class="hl-5">true</span><span class="hl-1">,</span><br/><span class="hl-1">  </span><span class="hl-4">mcpAuth:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">cognito:</span><span class="hl-1"> {</span><br/><span class="hl-1">      </span><span class="hl-4">auth:</span><span class="hl-1"> </span><span class="hl-4">cognitoAuth</span><span class="hl-1">,           </span><span class="hl-6">// your CognitoAuthentication construct</span><br/><span class="hl-1">      </span><span class="hl-4">authDomain:</span><span class="hl-1"> </span><span class="hl-2">&#39;auth.example.com&#39;</span><span class="hl-1">, </span><span class="hl-6">// Cognito custom/hosted domain (required)</span><br/><span class="hl-1">    },</span><br/><span class="hl-1">    </span><span class="hl-4">serverInfo:</span><span class="hl-1"> { </span><span class="hl-4">name:</span><span class="hl-1"> </span><span class="hl-2">&#39;my-mcp-server&#39;</span><span class="hl-1">, </span><span class="hl-4">version:</span><span class="hl-1"> </span><span class="hl-2">&#39;1.0.0&#39;</span><span class="hl-1"> },</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">});</span>
+</code><button type="button">Copy</button></pre>
+
+<p>The <code>apiDomain</code> is derived from the RestApi's own domain config (<code>apiHostname</code> + <code>domainName</code>), and <code>stageName</code> is reused — no duplication needed.</p>
+<h3 id="with-any-oauth2-provider" class="tsd-anchor-link">With any OAuth2 provider<a href="#with-any-oauth2-provider" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3>
+<p>For non-Cognito providers, use <code>generic</code> mode with explicit endpoint URLs:</p>
+<pre><code class="typescript"><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">api</span><span class="hl-1"> = </span><span class="hl-5">new</span><span class="hl-1"> </span><span class="hl-0">TestApiRestApi</span><span class="hl-1">(</span><span class="hl-5">this</span><span class="hl-1">, </span><span class="hl-2">&#39;Api&#39;</span><span class="hl-1">, {</span><br/><span class="hl-1">  </span><span class="hl-6">// ...</span><br/><span class="hl-1">  </span><span class="hl-4">mcpAuth:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-4">generic:</span><span class="hl-1"> {</span><br/><span class="hl-1">      </span><span class="hl-4">authorizeEndpoint:</span><span class="hl-1"> </span><span class="hl-2">&#39;https://auth.example.com/authorize&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">      </span><span class="hl-4">tokenEndpoint:</span><span class="hl-1"> </span><span class="hl-2">&#39;https://auth.example.com/token&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">      </span><span class="hl-4">clientId:</span><span class="hl-1"> </span><span class="hl-2">&#39;my-pre-provisioned-client-id&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">    },</span><br/><span class="hl-1">    </span><span class="hl-4">serverInfo:</span><span class="hl-1"> { </span><span class="hl-4">name:</span><span class="hl-1"> </span><span class="hl-2">&#39;my-mcp-server&#39;</span><span class="hl-1">, </span><span class="hl-4">version:</span><span class="hl-1"> </span><span class="hl-2">&#39;1.0.0&#39;</span><span class="hl-1"> },</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">});</span>
+</code><button type="button">Copy</button></pre>
+
+<h3 id="configuration-options" class="tsd-anchor-link">Configuration options<a href="#configuration-options" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3>
+<table>
+<thead>
+<tr>
+<th>Option</th>
+<th>Default</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td><code>serverInfo</code></td>
+<td>(required)</td>
+<td><code>{ name, version }</code> returned in MCP initialize</td>
+</tr>
+<tr>
+<td><code>allowedRedirectUris</code></td>
+<td>Claude + ChatGPT callbacks</td>
+<td>Allowlist for dynamic registration</td>
+</tr>
+<tr>
+<td><code>protocolVersions</code></td>
+<td><code>['2025-11-25', '2025-03-26', '2024-11-05']</code></td>
+<td>Supported MCP versions</td>
+</tr>
+<tr>
+<td><code>scopes</code></td>
+<td><code>['openid', 'email', 'profile']</code></td>
+<td>Advertised OAuth scopes</td>
+</tr>
+<tr>
+<td><code>stripParameters</code></td>
+<td><code>['resource']</code></td>
+<td>Params stripped from authorize/token proxying</td>
+</tr>
+<tr>
+<td><code>lambdaOptions</code></td>
+<td>—</td>
+<td>Lambda config for MCP auth handlers</td>
+</tr>
+</tbody>
+</table>
+<h3 id="mcp-server-runtime" class="tsd-anchor-link">MCP Server runtime<a href="#mcp-server-runtime" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3>
+<p>The <code>cdk-serverless/mcp-auth</code> module also exports a JSON-RPC server for implementing the MCP tool endpoint itself:</p>
+<pre><code class="typescript"><span class="hl-3">import</span><span class="hl-1"> { </span><span class="hl-4">createMcpServer</span><span class="hl-1"> } </span><span class="hl-3">from</span><span class="hl-1"> </span><span class="hl-2">&#39;cdk-serverless/mcp-auth&#39;</span><span class="hl-1">;</span><br/><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">server</span><span class="hl-1"> = </span><span class="hl-0">createMcpServer</span><span class="hl-1">({</span><br/><span class="hl-1">  </span><span class="hl-4">serverInfo:</span><span class="hl-1"> { </span><span class="hl-4">name:</span><span class="hl-1"> </span><span class="hl-2">&#39;my-server&#39;</span><span class="hl-1">, </span><span class="hl-4">version:</span><span class="hl-1"> </span><span class="hl-2">&#39;1.0.0&#39;</span><span class="hl-1"> },</span><br/><span class="hl-1">  </span><span class="hl-4">protocolVersions:</span><span class="hl-1"> [</span><span class="hl-2">&#39;2025-11-25&#39;</span><span class="hl-1">],</span><br/><span class="hl-1">  </span><span class="hl-4">resolver:</span><span class="hl-1"> {</span><br/><span class="hl-1">    </span><span class="hl-5">async</span><span class="hl-1"> </span><span class="hl-0">resolve</span><span class="hl-1">(</span><span class="hl-4">headers</span><span class="hl-1">) {</span><br/><span class="hl-1">      </span><span class="hl-6">// Validate Bearer token, return principal or throw McpUnauthorizedError</span><br/><span class="hl-1">      </span><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">token</span><span class="hl-1"> = </span><span class="hl-4">headers</span><span class="hl-1">.</span><span class="hl-4">authorization</span><span class="hl-1">?.</span><span class="hl-0">replace</span><span class="hl-1">(</span><span class="hl-2">&#39;Bearer &#39;</span><span class="hl-1">, </span><span class="hl-2">&#39;&#39;</span><span class="hl-1">);</span><br/><span class="hl-1">      </span><span class="hl-3">if</span><span class="hl-1"> (!</span><span class="hl-4">token</span><span class="hl-1">) </span><span class="hl-3">throw</span><span class="hl-1"> </span><span class="hl-5">new</span><span class="hl-1"> </span><span class="hl-0">McpUnauthorizedError</span><span class="hl-1">(</span><span class="hl-2">&#39;Bearer&#39;</span><span class="hl-1">);</span><br/><span class="hl-1">      </span><span class="hl-3">return</span><span class="hl-1"> </span><span class="hl-0">verifyToken</span><span class="hl-1">(</span><span class="hl-4">token</span><span class="hl-1">);</span><br/><span class="hl-1">    },</span><br/><span class="hl-1">  },</span><br/><span class="hl-1">  </span><span class="hl-4">tools:</span><span class="hl-1"> [</span><br/><span class="hl-1">    {</span><br/><span class="hl-1">      </span><span class="hl-4">name:</span><span class="hl-1"> </span><span class="hl-2">&#39;search&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">      </span><span class="hl-4">description:</span><span class="hl-1"> </span><span class="hl-2">&#39;Search documents&#39;</span><span class="hl-1">,</span><br/><span class="hl-1">      </span><span class="hl-4">inputSchema:</span><span class="hl-1"> { </span><span class="hl-4">type:</span><span class="hl-1"> </span><span class="hl-2">&#39;object&#39;</span><span class="hl-1">, </span><span class="hl-4">properties:</span><span class="hl-1"> { </span><span class="hl-4">query:</span><span class="hl-1"> { </span><span class="hl-4">type:</span><span class="hl-1"> </span><span class="hl-2">&#39;string&#39;</span><span class="hl-1"> } } },</span><br/><span class="hl-1">      </span><span class="hl-5">async</span><span class="hl-1"> </span><span class="hl-0">invoke</span><span class="hl-1">(</span><span class="hl-4">principal</span><span class="hl-1">, </span><span class="hl-4">args</span><span class="hl-1">) {</span><br/><span class="hl-1">        </span><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">results</span><span class="hl-1"> = </span><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-0">search</span><span class="hl-1">(</span><span class="hl-4">principal</span><span class="hl-1">, (</span><span class="hl-4">args</span><span class="hl-1"> </span><span class="hl-3">as</span><span class="hl-1"> </span><span class="hl-8">any</span><span class="hl-1">).</span><span class="hl-4">query</span><span class="hl-1">);</span><br/><span class="hl-1">        </span><span class="hl-3">return</span><span class="hl-1"> { </span><span class="hl-4">content:</span><span class="hl-1"> [{ </span><span class="hl-4">type:</span><span class="hl-1"> </span><span class="hl-2">&#39;text&#39;</span><span class="hl-1">, </span><span class="hl-4">text:</span><span class="hl-1"> </span><span class="hl-7">JSON</span><span class="hl-1">.</span><span class="hl-0">stringify</span><span class="hl-1">(</span><span class="hl-4">results</span><span class="hl-1">) }] };</span><br/><span class="hl-1">      },</span><br/><span class="hl-1">    },</span><br/><span class="hl-1">  ],</span><br/><span class="hl-1">});</span><br/><br/><span class="hl-6">// In your Lambda handler:</span><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-7">response</span><span class="hl-1"> = </span><span class="hl-3">await</span><span class="hl-1"> </span><span class="hl-4">server</span><span class="hl-1">.</span><span class="hl-0">handle</span><span class="hl-1">(</span><span class="hl-4">parsedBody</span><span class="hl-1">, </span><span class="hl-4">event</span><span class="hl-1">.</span><span class="hl-4">headers</span><span class="hl-1">);</span>
+</code><button type="button">Copy</button></pre>
+
 <h2 id="breaking-change-removed" class="tsd-anchor-link">Breaking Change: <code>axios</code> Removed<a href="#breaking-change-removed" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2>
 <p>CDK Serverless no longer depends on <code>axios</code>. The library now uses the
 platform-native <code>fetch</code> API (stable in Node.js 18+; the Lambda functions
@@ -136,4 +247,4 @@ issue.</p>
 </ul>
 <h2 id="authors" class="tsd-anchor-link">Authors<a href="#authors" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2>
 <p>Brought to you by <a href="https://taimos.de">Taimos</a></p>
-</div></div><div class="col-sidebar"><div class="page-menu"><div class="tsd-navigation settings"><details class="tsd-accordion"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>Settings</h3></summary><div class="tsd-accordion-details"><div class="tsd-filter-visibility"><span class="settings-label">Member Visibility</span><ul id="tsd-filter-options"><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-protected" name="protected"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Protected</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-inherited" name="inherited" checked/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Inherited</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-external" name="external"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>External</span></label></li></ul></div><div class="tsd-theme-toggle"><label class="settings-label" for="tsd-theme">Theme</label><select id="tsd-theme"><option value="os">OS</option><option value="light">Light</option><option value="dark">Dark</option></select></div></div></details></div><details open class="tsd-accordion tsd-page-navigation"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>On This Page</h3></summary><div class="tsd-accordion-details"><a href="#cdk-serverless"><span>CDK <wbr/>Serverless</span></a><ul><li><ul><li><a href="#features"><span>Features</span></a></li></ul></li><li><a href="#quick-start"><span>Quick <wbr/>Start</span></a></li><li><ul><li><a href="#adding-projen-constructs"><span>Adding projen constructs</span></a></li><li><a href="#using-the-cdk-serverless-l3-constructs"><span>Using the <wbr/>CDK serverless <wbr/>L3 constructs</span></a></li></ul></li><li><a href="#testing-utilities"><span>Testing <wbr/>Utilities</span></a></li><li><ul><li><a href="#lambdatestutil"><span>Lambda<wbr/>Test<wbr/>Util</span></a></li><li><ul><li><a href="#rest-api-testing"><span>REST <wbr/>API <wbr/>Testing</span></a></li><li><a href="#graphql-testing"><span>Graph<wbr/>QL <wbr/>Testing</span></a></li></ul></li><li><a href="#integtestutil"><span>Integ<wbr/>Test<wbr/>Util</span></a></li></ul></li><li><a href="#breaking-change-removed"><span>Breaking <wbr/>Change:  <wbr/>Removed</span></a></li><li><ul><li><a href="#impact-on-lambda-handlers-"><span>Impact on <wbr/>Lambda handlers ()</span></a></li><li><a href="#impact-on-"><span>Impact on  ()</span></a></li></ul></li><li><a href="#contribute"><span>Contribute</span></a></li><li><ul><li><a href="#how-to-contribute-to-cdk-serverless"><span>How to contribute to <wbr/>CDK <wbr/>Serverless</span></a></li><li><ul><li><a href="#did-you-find-a-bug"><span>Did you find a bug?</span></a></li><li><a href="#did-you-write-a-patch-that-fixes-a-bug"><span>Did you write a patch that fixes a bug?</span></a></li><li><a href="#did-you-fix-whitespace-format-code-or-make-a-purely-cosmetic-patch"><span>Did you fix whitespace, format code, or make a purely cosmetic patch?</span></a></li><li><a href="#do-you-intend-to-add-a-new-feature-or-change-an-existing-one"><span>Do you intend to add a new feature or change an existing one?</span></a></li><li><a href="#do-you-want-to-contribute-to-the-cdk-serverless-documentation"><span>Do you want to contribute to the <wbr/>CDK <wbr/>Serverless documentation?</span></a></li></ul></li></ul></li><li><a href="#authors"><span>Authors</span></a></li></ul></div></details></div><div class="site-menu"><nav class="tsd-navigation"><a href="modules.html">cdk-serverless</a><ul class="tsd-small-nested-navigation" id="tsd-nav-container"><li>Loading...</li></ul></nav></div></div></div><footer><p class="tsd-generator">Generated using <a href="https://typedoc.org/" target="_blank">TypeDoc</a></p></footer><div class="overlay"></div></body></html>
+</div></div><div class="col-sidebar"><div class="page-menu"><div class="tsd-navigation settings"><details class="tsd-accordion"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>Settings</h3></summary><div class="tsd-accordion-details"><div class="tsd-filter-visibility"><span class="settings-label">Member Visibility</span><ul id="tsd-filter-options"><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-protected" name="protected"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Protected</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-inherited" name="inherited" checked/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Inherited</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-external" name="external"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>External</span></label></li></ul></div><div class="tsd-theme-toggle"><label class="settings-label" for="tsd-theme">Theme</label><select id="tsd-theme"><option value="os">OS</option><option value="light">Light</option><option value="dark">Dark</option></select></div></div></details></div><details open class="tsd-accordion tsd-page-navigation"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>On This Page</h3></summary><div class="tsd-accordion-details"><a href="#cdk-serverless"><span>CDK <wbr/>Serverless</span></a><ul><li><ul><li><a href="#features"><span>Features</span></a></li></ul></li><li><a href="#quick-start"><span>Quick <wbr/>Start</span></a></li><li><ul><li><a href="#adding-projen-constructs"><span>Adding projen constructs</span></a></li><li><a href="#using-the-cdk-serverless-l3-constructs"><span>Using the <wbr/>CDK serverless <wbr/>L3 constructs</span></a></li></ul></li><li><a href="#testing-utilities"><span>Testing <wbr/>Utilities</span></a></li><li><ul><li><a href="#lambdatestutil"><span>Lambda<wbr/>Test<wbr/>Util</span></a></li><li><ul><li><a href="#rest-api-testing"><span>REST <wbr/>API <wbr/>Testing</span></a></li><li><a href="#graphql-testing"><span>Graph<wbr/>QL <wbr/>Testing</span></a></li></ul></li><li><a href="#integtestutil"><span>Integ<wbr/>Test<wbr/>Util</span></a></li></ul></li><li><a href="#mcp-auth"><span>MCP <wbr/>Auth</span></a></li><li><ul><li><a href="#with-cognito"><span>With <wbr/>Cognito</span></a></li><li><a href="#with-any-oauth2-provider"><span>With any <wbr/>O<wbr/>Auth2 provider</span></a></li><li><a href="#configuration-options"><span>Configuration options</span></a></li><li><a href="#mcp-server-runtime"><span>MCP <wbr/>Server runtime</span></a></li></ul></li><li><a href="#breaking-change-removed"><span>Breaking <wbr/>Change:  <wbr/>Removed</span></a></li><li><ul><li><a href="#impact-on-lambda-handlers-"><span>Impact on <wbr/>Lambda handlers ()</span></a></li><li><a href="#impact-on-"><span>Impact on  ()</span></a></li></ul></li><li><a href="#contribute"><span>Contribute</span></a></li><li><ul><li><a href="#how-to-contribute-to-cdk-serverless"><span>How to contribute to <wbr/>CDK <wbr/>Serverless</span></a></li><li><ul><li><a href="#did-you-find-a-bug"><span>Did you find a bug?</span></a></li><li><a href="#did-you-write-a-patch-that-fixes-a-bug"><span>Did you write a patch that fixes a bug?</span></a></li><li><a href="#did-you-fix-whitespace-format-code-or-make-a-purely-cosmetic-patch"><span>Did you fix whitespace, format code, or make a purely cosmetic patch?</span></a></li><li><a href="#do-you-intend-to-add-a-new-feature-or-change-an-existing-one"><span>Do you intend to add a new feature or change an existing one?</span></a></li><li><a href="#do-you-want-to-contribute-to-the-cdk-serverless-documentation"><span>Do you want to contribute to the <wbr/>CDK <wbr/>Serverless documentation?</span></a></li></ul></li></ul></li><li><a href="#authors"><span>Authors</span></a></li></ul></div></details></div><div class="site-menu"><nav class="tsd-navigation"><a href="modules.html">cdk-serverless</a><ul class="tsd-small-nested-navigation" id="tsd-nav-container"><li>Loading...</li></ul></nav></div></div></div><footer><p class="tsd-generator">Generated using <a href="https://typedoc.org/" target="_blank">TypeDoc</a></p></footer><div class="overlay"></div></body></html>

package/lib/constructs/index.d.ts

@@ -3,6 +3,8 @@ export * from './authentication';
 export * from './base-api';
 export * from './func';
 export * from './graphql';
+export * from './mcp-auth';
+export * from './mcp-cognito-auth';
 export * from './rest-api';
 export * from './table';
 export * from './workflow';

package/lib/constructs/index.js

@@ -19,7 +19,9 @@ __exportStar(require("./authentication"), exports);
 __exportStar(require("./base-api"), exports);
 __exportStar(require("./func"), exports);
 __exportStar(require("./graphql"), exports);
+__exportStar(require("./mcp-auth"), exports);
+__exportStar(require("./mcp-cognito-auth"), exports);
 __exportStar(require("./rest-api"), exports);
 __exportStar(require("./table"), exports);
 __exportStar(require("./workflow"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29uc3RydWN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsOENBQTRCO0FBQzVCLG1EQUFpQztBQUNqQyw2Q0FBMkI7QUFDM0IseUNBQXVCO0FBQ3ZCLDRDQUEwQjtBQUMxQiw2Q0FBMkI7QUFDM0IsMENBQXdCO0FBQ3hCLDZDQUEyQiIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vYXNzZXQtY2RuJztcbmV4cG9ydCAqIGZyb20gJy4vYXV0aGVudGljYXRpb24nO1xuZXhwb3J0ICogZnJvbSAnLi9iYXNlLWFwaSc7XG5leHBvcnQgKiBmcm9tICcuL2Z1bmMnO1xuZXhwb3J0ICogZnJvbSAnLi9ncmFwaHFsJztcbmV4cG9ydCAqIGZyb20gJy4vcmVzdC1hcGknO1xuZXhwb3J0ICogZnJvbSAnLi90YWJsZSc7XG5leHBvcnQgKiBmcm9tICcuL3dvcmtmbG93JzsiXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29uc3RydWN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsOENBQTRCO0FBQzVCLG1EQUFpQztBQUNqQyw2Q0FBMkI7QUFDM0IseUNBQXVCO0FBQ3ZCLDRDQUEwQjtBQUMxQiw2Q0FBMkI7QUFDM0IscURBQW1DO0FBQ25DLDZDQUEyQjtBQUMzQiwwQ0FBd0I7QUFDeEIsNkNBQTJCIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0ICogZnJvbSAnLi9hc3NldC1jZG4nO1xuZXhwb3J0ICogZnJvbSAnLi9hdXRoZW50aWNhdGlvbic7XG5leHBvcnQgKiBmcm9tICcuL2Jhc2UtYXBpJztcbmV4cG9ydCAqIGZyb20gJy4vZnVuYyc7XG5leHBvcnQgKiBmcm9tICcuL2dyYXBocWwnO1xuZXhwb3J0ICogZnJvbSAnLi9tY3AtYXV0aCc7XG5leHBvcnQgKiBmcm9tICcuL21jcC1jb2duaXRvLWF1dGgnO1xuZXhwb3J0ICogZnJvbSAnLi9yZXN0LWFwaSc7XG5leHBvcnQgKiBmcm9tICcuL3RhYmxlJztcbmV4cG9ydCAqIGZyb20gJy4vd29ya2Zsb3cnO1xuIl19

package/lib/constructs/mcp-auth.d.ts

@@ -0,0 +1,117 @@
+import { Construct } from 'constructs';
+import { LambdaFunction, LambdaOptions } from './func';
+/**
+ * Configuration for the MCP Auth CDK construct.
+ * Service-agnostic: works with any OAuth2/OIDC provider.
+ */
+export interface McpAuthProps {
+    /**
+     * The API domain that acts as the MCP OAuth issuer.
+     * All OAuth discovery endpoints will reference this domain.
+     * Example: 'api.example.com'
+     */
+    readonly apiDomain: string;
+    /**
+     * The upstream OAuth authorize endpoint URL.
+     * The authorize Lambda proxies (302 redirects) to this URL.
+     * Example: 'https://auth.example.com/oauth2/authorize'
+     */
+    readonly authorizeEndpoint: string;
+    /**
+     * The upstream OAuth token endpoint URL.
+     * The token Lambda proxies POST requests to this URL.
+     * Example: 'https://auth.example.com/oauth2/token'
+     */
+    readonly tokenEndpoint: string;
+    /**
+     * Allowed redirect URIs for dynamic client registration.
+     * Clients registering with URIs not in this list are rejected.
+     */
+    readonly allowedRedirectUris: string[];
+    /**
+     * The pre-provisioned OAuth client ID returned by the register endpoint.
+     */
+    readonly clientId: string;
+    /**
+     * MCP server info returned in the 'initialize' response.
+     */
+    readonly serverInfo: {
+        readonly name: string;
+        readonly version: string;
+    };
+    /**
+     * Supported MCP protocol versions (newest first).
+     * @default ['2025-11-25', '2025-03-26', '2024-11-05']
+     */
+    readonly protocolVersions?: string[];
+    /**
+     * OAuth scopes to advertise in discovery metadata.
+     * @default ['openid', 'email', 'profile']
+     */
+    readonly scopes?: string[];
+    /**
+     * Parameters to strip from authorize/token proxy requests.
+     * @default ['resource']
+     */
+    readonly stripParameters?: string[];
+    /**
+     * Additional environment variables to inject into all MCP auth Lambda functions.
+     */
+    readonly additionalEnv?: Record<string, string>;
+    /**
+     * Lambda function options for MCP auth handlers.
+     */
+    readonly lambdaOptions?: LambdaOptions;
+    /**
+     * Stage name for function naming and tagging.
+     */
+    readonly stageName: string;
+}
+/**
+ * Provides the Lambda function references for MCP OAuth endpoints.
+ * These can be wired into API Gateway (via RestApi integration)
+ * or used standalone.
+ */
+export interface McpAuthFunctions {
+    /** GET /.well-known/oauth-protected-resource */
+    readonly protectedResource: LambdaFunction;
+    /** GET /.well-known/oauth-authorization-server */
+    readonly authorizationServer: LambdaFunction;
+    /** GET /oauth/authorize */
+    readonly authorize: LambdaFunction;
+    /** POST /oauth/token */
+    readonly token: LambdaFunction;
+    /** POST /oauth/register */
+    readonly register: LambdaFunction;
+}
+/**
+ * CDK construct that creates Lambda functions for the MCP OAuth façade.
+ * Service-agnostic — proxies authorize/token requests to any upstream
+ * OAuth2/OIDC provider.
+ *
+ * Use with `RestApi` by passing `mcpAuth` prop, which auto-injects the
+ * required paths into the OpenAPI spec and wires Lambda integrations.
+ *
+ * @example
+ * const mcpAuth = new McpAuth(this, 'McpAuth', {
+ *   apiDomain: 'api.example.com',
+ *   authorizeEndpoint: 'https://auth.example.com/oauth2/authorize',
+ *   tokenEndpoint: 'https://auth.example.com/oauth2/token',
+ *   allowedRedirectUris: ['https://claude.ai/oauth/callback'],
+ *   clientId: 'my-client-id',
+ *   serverInfo: { name: 'my-mcp-server', version: '1.0.0' },
+ *   stageName: 'dev',
+ * });
+ */
+export declare class McpAuth extends Construct {
+    /**
+     * The Lambda functions created for the OAuth endpoints.
+     */
+    readonly functions: McpAuthFunctions;
+    /**
+     * The environment variables map that should be injected into the MCP RPC
+     * handler Lambda (if you have one) so it can read MCP config at runtime.
+     */
+    readonly mcpEnvVars: Record<string, string>;
+    constructor(scope: Construct, id: string, props: McpAuthProps);
+}