example-remote-server

What this does Adds the example, served at alongside the other example MCP App servers, and bumps the ext-apps example family to 1.7.4. Unlike the other examples (plain factories behind the stateless handler), lazy-auth's value is its HTTP layer — public tools work unauthenticated; protected tools answer + ; a built-in mock OAuth authorization server completes the flow. So it mounts its full Express app () under . Why now / what's blocked without it The mobile clauditor e2e specs are blocked on reaching lazy-auth at (TTL-scoped path → 1-hour tokens, so 30s defaults don't expire mid-test on slow mobile runs). What changed — mounts the app before the host middleware, and adds the RFC 8414/9728 path-insertion well-known rewrite ( → into the mount). MCP SDK clients only try the insertion form for , so this rewrite is required for discovery under a base path. / — early mount (so the example's CORS/body handling stay self-contained), splash + console listings. No new deploy config: for the example is derived from this server's own (already the source of truth for the host's OAuth issuer). An explicit still wins (e.g. a tunnel). Tests on an ephemeral port fall back to the package's per-request Host resolution. Dependency bump: ext-apps + the example server family to 1.7.4 (which carries the base-path mount support in ). Lockfile resolves entirely via npmjs. Integration test covering the full flow: public /, on the protected tool, mount-prefixed discovery metadata, TTL-path PRM, and the PKCE → token → authed round trip. How we know it works + + + all green against the published 1.7.4 (7 suites / 85 tests, lazy-auth integration included), verified in a linux container matching CI. Driven additionally with the real client discovery machinery ( → PRM → → with PKCE) — full discovery + auth + silent refresh pass, on both and . Prod-like boot (, no ) advertises correct mount-prefixed OAuth URLs, trailing slash normalized.

What this does Adds the example, served at alongside the other example MCP App servers, and bumps the ext-apps example family to 1.7.3. Unlike the other examples (plain factories behind the stateless handler), lazy-auth's value is its HTTP layer — public tools work unauthenticated; protected tools answer + ; a built-in mock OAuth authorization server completes the flow. So it mounts its full Express app () under . Why now / what's blocked without it The mobile clauditor e2e specs are blocked on reaching lazy-auth at (TTL-scoped path → 1-hour tokens, so 30s defaults don't expire mid-test on slow mobile runs). What changed — mounts the app before the host middleware, and adds the RFC 8414/9728 path-insertion well-known rewrite ( → into the mount). MCP SDK clients only try the insertion form for , so this rewrite is required for discovery under a base path. / — early mount (so the example's CORS/body handling stay self-contained), splash + console listings. No new deploy config: for the example is derived from this server's own (already the source of truth for the host's OAuth issuer). An explicit still wins (e.g. a tunnel). Tests on an ephemeral port fall back to the package's per-request Host resolution. Integration test covering the full flow: public /, on the protected tool, mount-prefixed discovery metadata, TTL-path PRM, and the PKCE → token → authed round trip. How we know it works , , all green (7 suites / 85 tests, lazy-auth integration included), verified in a linux container matching CI. Driven additionally with the real client discovery machinery ( → PRM → → with PKCE) — full discovery + auth + silent refresh pass, on both and . Prod-like boot (, no ) advertises correct mount-prefixed OAuth URLs, trailing slash normalized. ⚠️ Draft: blocked on a release The base-path mount support is not yet in a published release** of . This branch temporarily pins the dependency to the merged-PR preview build (, from modelcontextprotocol/ext-apps#683) so CI runs against the real code. Before merge, the finishing commit flips both and to the registry and regenerates the lockfile against npmjs. Depends on: ext-apps#683 (merged) → next ext-apps release.

Summary Updates the mounted MCP App example servers and to 1.7.1 (release notes). ext-apps@1.7.x peers on , so this also bumps the pinned sdk from → and adapts to its refactor (now wraps a web-standard transport via ). Code changes — is now a readonly getter on the Node wrapper; inject it (and ) on the underlying web-standard transport so resumed sessions pass . Also guard , which is now optional on . — now routes through , so the mock needs /////, and the response header now arrives via instead of . [!NOTE] The resume path reaches into the private field to set and . SDK 1.29 doesn't expose a public way to attach a pre-known session ID to a fresh transport (the previous approach of assigning directly no longer compiles since it's now a getter). The underlying is a public writable field — only the path to reach it is private. Worth raising upstream for a supported API; tracked as a follow-up. Test Plan ✅ ✅ ✅ — 79/79 ✅ Smoke-tested locally: and both return valid responses