Class DcrAuthenticator

DcrAuthenticator manages authentication for MCP HTTP servers Handles DCR registration, OAuth flows, and token management

Index

Constructors

Methods

deleteTokens ensureAuthenticated

Constructors

constructor

new DcrAuthenticator(options: DcrAuthenticatorOptions): DcrAuthenticator
Parameters
- options: DcrAuthenticatorOptions
Returns DcrAuthenticator
- Defined in src/dcr/dcr-authenticator.ts:67

Methods

deleteTokens

deleteTokens(mcpServerUrl: string): Promise<void>
Deletes both stored token families for a server, across every issuer they were bound to.

Takes the same mcpServerUrl that DcrAuthenticator.ensureAuthenticated was given - keys are built from the configured URL, never from the discovered RFC 8707 resource, precisely so this can find them without doing discovery.
Parameters
- mcpServerUrl: string
Returns Promise<void>

Throws
CredentialBindingError if the configured store cannot enumerate keys.
- Defined in src/dcr/dcr-authenticator.ts:343

ensureAuthenticated

ensureAuthenticated(
    mcpServerUrl: string,
    capabilities: AuthCapabilities,
    signal?: AbortSignal,
): Promise<TokenSet>
Ensure server is authenticated, performing DCR and OAuth if needed Proactively refreshes tokens if they're within 5 minutes of expiry
Parameters
- mcpServerUrl: string
  The MCP server's canonical URL, exactly as configured, with its path intact (https://example.com/mcp). Not a deployment root: the path is what identifies the resource an issued token is bound to.
- capabilities: AuthCapabilities
  Auth capabilities from .well-known endpoint
- Optionalsignal: AbortSignal
Returns Promise<TokenSet>
Valid token set ready to use
Throws
Error if authentication fails
Example
```
const authenticator = new DcrAuthenticator({ redirectUri: 'http://localhost:3000/callback' });
const tokens = await authenticator.ensureAuthenticated(
  'https://example.com/mcp',
  capabilities
);
```
- Defined in src/dcr/dcr-authenticator.ts:123