@codesoul-co/hypha-mcp / oauth

• Package index: @codesoul-co/hypha-mcp
• Source: packages/mcp/src/oauth.ts
• Exports: 8

Using this module

Use the Oauth module for using the public contracts and operations for this capability boundary. It exports 1 class, 2 functions, 5 interfaces.

Import from the package entrypoint

import {
  MCPOAuth21Client,
  mcpProtectedResourceMetadataUrlFromChallenge,
  redactMCPOAuthSecrets,
} from '@codesoul-co/hypha-mcp';

import type {
  MCPAuthorizationServerMetadata,
  MCPOAuth21ClientOptions,
  MCPOAuthAuthorizationRequest,
  MCPOAuthTokenSet,
  MCPProtectedResourceMetadata,
} from '@codesoul-co/hypha-mcp';

Usage patterns

• Use the 5 type/interface exports as static contracts in application code, adapters, or tests. Import them with import type; they do not exist at runtime.
• The module exposes 1 class as constructable runtime implementations. Each symbol entry lists its constructor and public methods.
• The module exposes 2 functions as direct operation entrypoints. Every overload, required/optional parameter, and return type is documented below.

Public exports

Symbol	Kind	Signature	Description
MCPOAuth21Client	class	new MCPOAuth21Client(options: MCPOAuth21ClientOptions): MCPOAuth21Client	MCPO Auth21 Client class with 7 public constructor or member entries; its exact declarations are listed below.
mcpProtectedResourceMetadataUrlFromChallenge	function	mcpProtectedResourceMetadataUrlFromChallenge(wwwAuthenticate: string | null | undefined): string | undefined	Extracts RFC 9728 metadata discovery from an MCP Bearer challenge.
redactMCPOAuthSecrets	function	redactMCPOAuthSecrets<T>(value: T): T	Redact MCPO Auth Secrets function with 1 public call signature; parameters and return types are listed below.
MCPAuthorizationServerMetadata	interface	interface MCPAuthorizationServerMetadata	MCP Authorization Server Metadata interface with 5 public fields or methods.
MCPOAuth21ClientOptions	interface	interface MCPOAuth21ClientOptions	MCPO Auth21 Client Options interface with 10 public fields or methods.
MCPOAuthAuthorizationRequest	interface	interface MCPOAuthAuthorizationRequest	MCPO Auth Authorization Request interface with 3 public fields or methods.
MCPOAuthTokenSet	interface	interface MCPOAuthTokenSet	MCPO Auth Token Set interface with 6 public fields or methods.
MCPProtectedResourceMetadata	interface	interface MCPProtectedResourceMetadata	MCP Protected Resource Metadata interface with 3 public fields or methods.

MCPOAuth21Client

MCPO Auth21 Client class with 7 public constructor or member entries; its exact declarations are listed below.

• Kind: class
• Import: import { MCPOAuth21Client } from '@codesoul-co/hypha-mcp';
• Source module: oauth

Declaration

export declare class MCPOAuth21Client {
    constructor(options: MCPOAuth21ClientOptions);
    discover(): Promise<{
            protectedResource: MCPProtectedResourceMetadata;
            authorizationServer: MCPAuthorizationServerMetadata;
        }>;
    createAuthorizationRequest(state?: string): Promise<MCPOAuthAuthorizationRequest>;
    exchangeAuthorizationCode(input: {
            code: string;
            codeVerifier: string;
            state: string;
            expectedState: string;
        }): Promise<MCPOAuthTokenSet>;
    refresh(): Promise<MCPOAuthTokenSet>;
    authorizationHeader(minimumValidityMs?: number): Promise<string>;
    clear(): void;
}

Public members

Member	Kind	Signature	Description
authorizationHeader	method	authorizationHeader(minimumValidityMs?: number): Promise<string>	Public method; parameters and return type are shown in the signature.
clear	method	clear(): void	Public method; parameters and return type are shown in the signature.
constructor	constructor	(options: MCPOAuth21ClientOptions): MCPOAuth21Client	Creates an instance of this class.
createAuthorizationRequest	method	createAuthorizationRequest(state?: string): Promise<MCPOAuthAuthorizationRequest>	Public method; parameters and return type are shown in the signature.
discover	method	discover(): Promise<{ protectedResource: MCPProtectedResourceMetadata; authorizationServer: MCPAuthorizationServerMetadata; }>	Public method; parameters and return type are shown in the signature.
exchangeAuthorizationCode	method	exchangeAuthorizationCode(input: { code: string; codeVerifier: string; state: string; expectedState: string; }): Promise<MCPOAuthTokenSet>	Public method; parameters and return type are shown in the signature.
refresh	method	refresh(): Promise<MCPOAuthTokenSet>	Public method; parameters and return type are shown in the signature.

mcpProtectedResourceMetadataUrlFromChallenge

Extracts RFC 9728 metadata discovery from an MCP Bearer challenge.

• Kind: function
• Import: import { mcpProtectedResourceMetadataUrlFromChallenge } from '@codesoul-co/hypha-mcp';
• Source module: oauth

Declaration

export declare function mcpProtectedResourceMetadataUrlFromChallenge(wwwAuthenticate: string | null | undefined): string | undefined;

Call signature

mcpProtectedResourceMetadataUrlFromChallenge(wwwAuthenticate: string | null | undefined): string | undefined

Extracts RFC 9728 metadata discovery from an MCP Bearer challenge.

Parameters

Parameter	Type	Required	Description
wwwAuthenticate	string	Yes	Required parameter; accepted values are defined by the type column.

Returns

• Type: string
• Description: The return contract is defined by the type shown above.

redactMCPOAuthSecrets

Redact MCPO Auth Secrets function with 1 public call signature; parameters and return types are listed below.

• Kind: function
• Import: import { redactMCPOAuthSecrets } from '@codesoul-co/hypha-mcp';
• Source module: oauth

Declaration

export declare function redactMCPOAuthSecrets<T>(value: T): T;

Call signature

redactMCPOAuthSecrets<T>(value: T): T

Parameters

Parameter	Type	Required	Description
value	T	Yes	Required parameter; accepted values are defined by the type column.

Returns

• Type: T
• Description: The return contract is defined by the type shown above.

MCPAuthorizationServerMetadata

MCP Authorization Server Metadata interface with 5 public fields or methods.

• Kind: interface
• Import: import type { MCPAuthorizationServerMetadata } from '@codesoul-co/hypha-mcp';
• Source module: oauth

Declaration

export interface MCPAuthorizationServerMetadata {
    issuer: string;
    authorization_endpoint: string;
    token_endpoint: string;
    code_challenge_methods_supported: string[];
    grant_types_supported?: string[];
}

Contract members

Member	Kind	Signature	Description
authorization_endpoint	property	authorization_endpoint: string	Public property; its type, readonly modifier and optionality are shown in the signature.
code_challenge_methods_supported	property	code_challenge_methods_supported: string[]	Public property; its type, readonly modifier and optionality are shown in the signature.
grant_types_supported	property	grant_types_supported?: string[]	Public property; its type, readonly modifier and optionality are shown in the signature.
issuer	property	issuer: string	Public property; its type, readonly modifier and optionality are shown in the signature.
token_endpoint	property	token_endpoint: string	Public property; its type, readonly modifier and optionality are shown in the signature.

MCPOAuth21ClientOptions

MCPO Auth21 Client Options interface with 10 public fields or methods.

• Kind: interface
• Import: import type { MCPOAuth21ClientOptions } from '@codesoul-co/hypha-mcp';
• Source module: oauth

Declaration

export interface MCPOAuth21ClientOptions {
    resource: string;
    clientId: string;
    redirectUri: string;
    fetch?: typeof fetch;
    metadataUrl?: string;
    /** Selects one server advertised by RFC 9728 metadata; defaults to the first. */
    authorizationServer?: string;
    timeoutMs?: number;
    now?: () => number;
    randomBytes?: (size: number) => Uint8Array;
    /**
     * Intended only for an in-process acceptance server. Production callers
     * must leave this disabled so OAuth metadata and token traffic require TLS.
     */
    allowInsecureLoopbackForAcceptance?: boolean;
}

Contract members

Member	Kind	Signature	Description
allowInsecureLoopbackForAcceptance	property	allowInsecureLoopbackForAcceptance?: boolean	Intended only for an in-process acceptance server. Production callers must leave this disabled so OAuth metadata and token traffic require TLS.
authorizationServer	property	authorizationServer?: string	Selects one server advertised by RFC 9728 metadata; defaults to the first.
clientId	property	clientId: string	Public property; its type, readonly modifier and optionality are shown in the signature.
fetch	method	fetch?(input: RequestInfo | URL, init?: RequestInit): Promise<Response> | fetch?(input: string | URL | Request, init?: RequestInit): Promise<Response>	Public method; parameters and return type are shown in the signature.
metadataUrl	property	metadataUrl?: string	Public property; its type, readonly modifier and optionality are shown in the signature.
now	method	now?(): number	Public method; parameters and return type are shown in the signature.
randomBytes	method	randomBytes?(size: number): Uint8Array	Public method; parameters and return type are shown in the signature.
redirectUri	property	redirectUri: string	Public property; its type, readonly modifier and optionality are shown in the signature.
resource	property	resource: string	Public property; its type, readonly modifier and optionality are shown in the signature.
timeoutMs	property	timeoutMs?: number	Public property; its type, readonly modifier and optionality are shown in the signature.

MCPOAuthAuthorizationRequest

MCPO Auth Authorization Request interface with 3 public fields or methods.

• Kind: interface
• Import: import type { MCPOAuthAuthorizationRequest } from '@codesoul-co/hypha-mcp';
• Source module: oauth

Declaration

export interface MCPOAuthAuthorizationRequest {
    url: string;
    state: string;
    codeVerifier: string;
}

Contract members

Member	Kind	Signature	Description
codeVerifier	property	codeVerifier: string	Public property; its type, readonly modifier and optionality are shown in the signature.
state	property	state: string	Public property; its type, readonly modifier and optionality are shown in the signature.
url	property	url: string	Public property; its type, readonly modifier and optionality are shown in the signature.

MCPOAuthTokenSet

MCPO Auth Token Set interface with 6 public fields or methods.

• Kind: interface
• Import: import type { MCPOAuthTokenSet } from '@codesoul-co/hypha-mcp';
• Source module: oauth

Declaration

export interface MCPOAuthTokenSet {
    accessToken: string;
    refreshToken?: string;
    tokenType: 'Bearer';
    expiresAt: number;
    scope?: string;
    resource: string;
}

Contract members

Member	Kind	Signature	Description
accessToken	property	accessToken: string	Public property; its type, readonly modifier and optionality are shown in the signature.
expiresAt	property	expiresAt: number	Public property; its type, readonly modifier and optionality are shown in the signature.
refreshToken	property	refreshToken?: string	Public property; its type, readonly modifier and optionality are shown in the signature.
resource	property	resource: string	Public property; its type, readonly modifier and optionality are shown in the signature.
scope	property	scope?: string	Public property; its type, readonly modifier and optionality are shown in the signature.
tokenType	property	tokenType: "Bearer"	Public property; its type, readonly modifier and optionality are shown in the signature.

MCPProtectedResourceMetadata

MCP Protected Resource Metadata interface with 3 public fields or methods.

• Kind: interface
• Import: import type { MCPProtectedResourceMetadata } from '@codesoul-co/hypha-mcp';
• Source module: oauth

Declaration

export interface MCPProtectedResourceMetadata {
    resource: string;
    authorization_servers: string[];
    bearer_methods_supported?: string[];
}

Contract members

Member	Kind	Signature	Description
authorization_servers	property	authorization_servers: string[]	Public property; its type, readonly modifier and optionality are shown in the signature.
bearer_methods_supported	property	bearer_methods_supported?: string[]	Public property; its type, readonly modifier and optionality are shown in the signature.
resource	property	resource: string	Public property; its type, readonly modifier and optionality are shown in the signature.