Skip to content

MCP: Support authInfo #422

@kentcdodds

Description

@kentcdodds

Issue: Request Support for authInfo from Transport in McpAgent

Problem Description

Currently, the McpAgent class from 'agents/mcp' does not provide access to
the authInfo from the underlying MCP transport layer. This prevents request
handlers from accessing authentication information that should be automatically
populated by the transport.

Current Behavior

When setting request handlers in McpAgent, the extra parameter in request
handlers does not contain the authInfo property, even though the MCP SDK's
RequestHandlerExtra type defines it as:

export type RequestHandlerExtra<
	SendRequestT extends Request,
	SendNotificationT extends Notification,
> = {
	signal: AbortSignal
	authInfo?: AuthInfo // This is undefined in our handlers
	sessionId?: string
	_meta?: RequestMeta
	requestId: RequestId
	requestInfo?: RequestInfo
	sendNotification: (notification: SendNotificationT) => Promise<void>
	sendRequest: <U extends ZodType<object>>(
		request: SendRequestT,
		resultSchema: U,
		options?: RequestOptions,
	) => Promise<z.infer<U>>
}

Expected Behavior

Request handlers should be able to access authInfo from the extra parameter
when the transport has validated an access token:

this.server.server.setRequestHandler(
	SetLevelRequestSchema,
	async (request, extra) => {
		// extra.authInfo should contain validated token information
		const authInfo = extra.authInfo
		if (authInfo) {
			console.log('Authenticated user:', authInfo.clientId)
			console.log('Token scopes:', authInfo.scopes)
		}
		// ... rest of handler logic
	},
)

Impact

Without access to authInfo from the transport:

  1. Request handlers cannot access authentication context - they must rely on
    agent-level props
  2. Inconsistent authentication patterns - some handlers use
    this.props.authInfo, others can't access transport auth
  3. Limited OAuth integration - can't leverage the transport's built-in token
    validation
  4. Type safety issues - the extra.authInfo property exists in types but is
    always undefined

Proposed Solution

The McpAgent class should be updated to allow me to populate the authInfo property (or populate it for me). This would probably require a callback for resolving the authorization header to authInfo.

Workaround

Currently, we must access authentication information through
this.props.authInfo in request handlers, which works but doesn't leverage the
transport's built-in authentication capabilities.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions