example-remote-server
A hosted version of the Everything server - for demonstration and testing purposes, hosted at https://example-server.modelcontextprotocol.io/mcp
by modelcontextprotocolTypeScript
Commit activity
Last 12 weeks · 6 commits
Community health
5 of 6 standards met
87
✓README✓License✓Contributing✓Code of Conduct○Issue Template✓PR Template
Recent PRs & issues
Active · 7 in progress · Last activity 2w ago
See all on GitHub →
Quick Start: dev:internal: Use cross-env to set environment variable so it works on Windows Fixes #52 Motivation and Context Sets environment variables in a cross-platform way, so it works on Windows How Has This Been Tested? Yes, on Windows Breaking Changes No Types of changes [X] Bug fix (non-breaking change which fixes an issue) [ ] New feature (non-breaking change which adds functionality) [ ] Breaking change (fix or feature that would cause existing functionality to change) [ ] Documentation update Checklist [X] I have read the MCP Documentation [X] My code follows the repository's style guidelines [ ] New and existing tests pass locally [ ] I have added appropriate error handling [ ] I have added or updated documentation as needed Additional context
Describe the bug The following command (from the Quick Start) does not work on Windows PowerShell, but that is not documented. My recommended solution is to use cross-env, which will populate the environment variables on any platform. To Reproduce Steps to reproduce the behavior: 1. Expected behavior Server launches normally. Logs
Fixes #22. The MCP module's already advertises a URL in 401 headers (via ), but nothing ever served that path — so clients that follow the spec's discovery flow got a 404. In EXTERNAL mode this made authorization-server discovery effectively impossible except through the legacy shim. Changes (in , mirroring the existing inline metadata shim style): Serve RFC 9728 Protected Resource Metadata at (the exact URL advertised in 401s) and (RFC 9728 §3.1 path insertion, for clients that derive the metadata URL from the endpoint themselves). points at the in-process server in INTERNAL mode and at in EXTERNAL mode. Kept the shim rather than removing it as the issue suggests: clients of the 2025-03-26 spec revision discover auth by querying that path on the MCP server directly, and in EXTERNAL mode the shim correctly points them at the external AS endpoints. It's now commented as a back-compat shim; happy to remove it instead if you'd prefer strict current-spec behavior. Verified** by booting both modes and curling: EXTERNAL (): both PRM endpoints return , and the URL in the 401's now resolves. INTERNAL: PRM returns the server itself as the authorization server. , , and the jest suite (79 tests, 6 suites) all pass. 🤖 Generated with Claude Code
Recent fixes
Bumps and the 15 example server packages from to (release notes). The user-visible reason: enlarges the consent buttons' touch targets so the flow is reliably tappable on mobile (modelcontextprotocol/ext-apps#714). Verification In a clean container (mirrors CI): → → (91/91) → , all green. Lockfile resolves only from .
What this does Adds the example, served at alongside the other example MCP App servers, and bumps the ext-apps example family to 1.7.4. Unlike the other examples (plain factories behind the stateless handler), lazy-auth's value is its HTTP layer — public tools work unauthenticated; protected tools answer + ; a built-in mock OAuth authorization server completes the flow. So it mounts its full Express app () under . Why now / what's blocked without it The mobile clauditor e2e specs are blocked on reaching lazy-auth at (TTL-scoped path → 1-hour tokens, so 30s defaults don't expire mid-test on slow mobile runs). What changed — mounts the app before the host middleware, and adds the RFC 8414/9728 path-insertion well-known rewrite ( → into the mount). MCP SDK clients only try the insertion form for , so this rewrite is required for discovery under a base path. / — early mount (so the example's CORS/body handling stay self-contained), splash + console listings. No new deploy config: for the example is derived from this server's own (already the source of truth for the host's OAuth issuer). An explicit still wins (e.g. a tunnel). Tests on an ephemeral port fall back to the package's per-request Host resolution. Dependency bump: ext-apps + the example server family to 1.7.4 (which carries the base-path mount support in ). Lockfile resolves entirely via npmjs. Integration test covering the full flow: public /, on the protected tool, mount-prefixed discovery metadata, TTL-path PRM, and the PKCE → token → authed round trip. How we know it works + + + all green against the published 1.7.4 (7 suites / 85 tests, lazy-auth integration included), verified in a linux container matching CI. Driven additionally with the real client discovery machinery ( → PRM → → with PKCE) — full discovery + auth + silent refresh pass, on both and . Prod-like boot (, no ) advertises correct mount-prefixed OAuth URLs, trailing slash normalized.
What this does Adds the example, served at alongside the other example MCP App servers, and bumps the ext-apps example family to 1.7.3. Unlike the other examples (plain factories behind the stateless handler), lazy-auth's value is its HTTP layer — public tools work unauthenticated; protected tools answer + ; a built-in mock OAuth authorization server completes the flow. So it mounts its full Express app () under . Why now / what's blocked without it The mobile clauditor e2e specs are blocked on reaching lazy-auth at (TTL-scoped path → 1-hour tokens, so 30s defaults don't expire mid-test on slow mobile runs). What changed — mounts the app before the host middleware, and adds the RFC 8414/9728 path-insertion well-known rewrite ( → into the mount). MCP SDK clients only try the insertion form for , so this rewrite is required for discovery under a base path. / — early mount (so the example's CORS/body handling stay self-contained), splash + console listings. No new deploy config: for the example is derived from this server's own (already the source of truth for the host's OAuth issuer). An explicit still wins (e.g. a tunnel). Tests on an ephemeral port fall back to the package's per-request Host resolution. Integration test covering the full flow: public /, on the protected tool, mount-prefixed discovery metadata, TTL-path PRM, and the PKCE → token → authed round trip. How we know it works , , all green (7 suites / 85 tests, lazy-auth integration included), verified in a linux container matching CI. Driven additionally with the real client discovery machinery ( → PRM → → with PKCE) — full discovery + auth + silent refresh pass, on both and . Prod-like boot (, no ) advertises correct mount-prefixed OAuth URLs, trailing slash normalized. ⚠️ Draft: blocked on a release The base-path mount support is not yet in a published release** of . This branch temporarily pins the dependency to the merged-PR preview build (, from modelcontextprotocol/ext-apps#683) so CI runs against the real code. Before merge, the finishing commit flips both and to the registry and regenerates the lockfile against npmjs. Depends on: ext-apps#683 (merged) → next ext-apps release.
Structured data for AI agents
Repository: modelcontextprotocol/example-remote-server. Description: A hosted version of the Everything server - for demonstration and testing purposes, hosted at https://example-server.modelcontextprotocol.io/mcp Stars: 77, Forks: 36. Primary language: TypeScript. Languages: TypeScript (87.3%), Shell (8.7%), HTML (2.3%), CSS (1.4%), JavaScript (0.3%). License: MIT. Open PRs: 7, open issues: 5. Last activity: 2w ago. Community health: 87%. Top contributors: jerome3o-anthropic, bhosmer-ant, ochafik, claude, pcarleton, Guro, antonpk1.