oferty-spike-mcp

Spike #1 of the "Online Offers" project: will the built-in OAuth 2.1 server of Supabase Auth (beta) work with the Claude app through Dynamic Client Registration.

The code is throwaway. Zero tests, zero error handling beyond what the spike itself diagnoses, zero real MCP tools. All that remains after completion is a notes file with conclusions.

What's here

We use SDK v2 (@modelcontextprotocol/server + @modelcontextprotocol/node). @modelcontextprotocol/sdk is legacy v1 — most online tutorials describe exactly that one.

Related MCP server: Remote MCP Server on Cloudflare

Environment variables

See .env.example. All four are required; the process won't start without them.

Local run

npm ci
APP_ORIGIN=http://localhost:3000 SUPABASE_URL=https://twoj.supabase.co \
  SUPABASE_ANON_KEY=... SPIKE_STATIC_TOKEN=... npm start

Endpoints

• POST /mcp — Streamable HTTP, stateless

• GET /.well-known/oauth-protected-resource/mcp — RFC 9728

• GET /.well-known/oauth-authorization-server — Supabase metadata, passed through verbatim

• GET /oauth/consent?authorization_id=… — consent page

• GET /healthz — process liveness, deliberately does not ping Supabase

Diagnostics

Without a token, POST /mcp responds with 401 and a WWW-Authenticate header pointing to the Protected Resource Metadata — that's how you know lazy auth is working.

When you suspect a connector reconnection issue (the most suspicious part of the spike), supabase.auth.oauth.listGrants() and revokeGrant({ clientId }) come in handy — they let you view and delete a saved grant without touching the database by hand.