Auth Server Software Statement

MCP服务器的授权服务器，支持软件声明和jwks_uri

npm i
npm run dev

将您的MCP客户端连接到http://localhost:3000/mcp（使用HTTP流），它应该启动授权流。

所有OAuth客户端和令牌都存储在内存中，因此如果服务器重新启动，您应该清除客户端中的OAuth状态。

在MCP客户端中准备software_statement和jwks_uri

您的客户端后端负责签署 software_statement JWT。

下面是一个使用https://www.npmjs.com/package/jose.

import {
  generateKeyPair,
  SignJWT,
  exportJWK,
  calculateJwkThumbprint,
} from "jose";

const publicJWK = await exportJWK(publicKey);
publicJWK.kid = await calculateJwkThumbprint(publicJWK);

app.get("/.well-known/jwks.json", (req, res) => {
  res.json({
    keys: [publicJWK],
  });
});

app.post("/sign-client-metadata", authMiddleware, express.json(), async (req, res) => {
  const { client_metadata, registration_endpoint } = req.body;
  const software_statement = await new SignJWT({
    iss: "https://your.mcp.client.com",
    aud: registration_endpoint,
    jti: randomUUID(),
    ...client_metadata,
  })
    .setProtectedHeader({ alg: "RS256", kid: publicJWK.kid })
    .setIssuedAt()
    .setExpirationTime("1h")
    .sign(privateKey);

  res.json({
    software_statement,
    jwks_uri: `http://${HOST}:${PORT}/.well-known/jwks.json`,
  });
});