Expand description
Outbound OAuth support for upstream MCP servers.
Reusable runtime mechanics for the outbound authorization_code + PKCE flow
used when proxying to OAuth-protected upstream MCP servers. This is the
SDK-side half of upstream OAuth: per-(upstream, subject) token storage,
single-flight refresh, encryption-at-rest with AAD binding, and the
per-subject AuthClient cache. Browser/API route handling, sessions,
AuthContext, cookies, and admin checks stay with the product binary.
Gated behind the upstream-oauth-rmcp feature because it depends on the rmcp
client/auth transport stack and oauth2.
Modulesยง
- cache
- Per-
(upstream, subject)AuthClientcache. - config
- Minimal, self-contained upstream configuration shape.
- encryption
- chacha20poly1305 AEAD wrapper for token-at-rest encryption.
- manager
- Upstream OAuth lifecycle manager.
- refresh
- Single-flight refresh coordination for upstream OAuth clients.
- runtime
- store
- SQLite-backed rmcp
CredentialStoreandStateStoreadapters. - types
- Shared types for outbound upstream OAuth.