Skip to main content
Glama
deenesjakoruzh
AIBiz-Automatyzacje

oferty-spike-mcp

by AIBiz-Automatyzacje
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

oferty-spike-mcp

'Oferty Online' 프로젝트의 Spike #1: Supabase Auth(베타)에 내장된 OAuth 2.1 서버가 Dynamic Client Registration을 통해 Claude 앱과 통신할 수 있는지 여부.

코드는 버릴 예정입니다. 테스트 없음, spike 자체가 진단하는 것 외의 오류 처리 없음, 실제 MCP 도구 없음. 실행 후에는 결론이 담긴 메모만 남습니다.

구성

파일

역할

src/server.js

HTTP 라우팅, Host 검증, lazy auth, discovery

src/mcp.js

MCP v2 서버 + 토큰에서 신원을 반환하는 ping() 도구

src/verifier.js

두 가지 경로: 정적 Bearer(Claude Code) 및 Supabase 토큰(Claude 앱)

src/consent.js

동의 페이지 — 우리가 직접 작성하는 유일한 것

src/supabase-metadata.js

시작 시 AS 메타데이터 가져오기, fail fast

SDK v2(@modelcontextprotocol/server + @modelcontextprotocol/node)를 사용합니다. @modelcontextprotocol/sdk는 레거시 v1입니다 — 웹에 있는 대부분의 튜토리얼이 바로 그것을 설명합니다.

Related MCP server: Remote MCP Server on Cloudflare

환경 변수

.env.example 참조. 네 개 모두 필수이며, 이들이 없으면 프로세스가 시작되지 않습니다.

로컬 실행

npm ci
APP_ORIGIN=http://localhost:3000 SUPABASE_URL=https://twoj.supabase.co \
  SUPABASE_ANON_KEY=... SPIKE_STATIC_TOKEN=... npm start

엔드포인트

  • POST /mcp — Streamable HTTP, stateless

  • GET /.well-known/oauth-protected-resource/mcp — RFC 9728

  • GET /.well-known/oauth-authorization-server — Supabase 메타데이터, 그대로 전달됨

  • GET /oauth/consent?authorization_id=… — 동의 페이지

  • GET /healthz — 프로세스의 생존 여부, 의도적으로 Supabase를 ping하지 않음

진단

토큰 없이 POST /mcp는 Protected Resource Metadata를 가리키는 WWW-Authenticate 헤더와 함께 401로 응답합니다 — 이를 통해 lazy authentication이 작동함을 알 수 있습니다.

커넥터 재연결 문제가 의심될 때(spike에서 가장 의심스러운 지점) supabase.auth.oauth.listGrants()와 revokeGrant({ clientId })가 유용합니다 — 데이터베이스를 수동으로 건드리지 않고 저장된 동의를 확인하고 삭제할 수 있습니다.

This server cannot be deployed

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Related MCP Connectors

  • Probe V0A
    io.github.lexbritten

    Experimental MCP server for current empirical verification of explicit public HTTPS endpoint claims.

    API TestingPenetration Testing
    21
  • StytchOAuth
    dev.stytch.mcp

    The Stytch MCP server is a reference implementation that demonstrates remote MCP server authentication and authorization using Stytch Connected Apps. It provides OAuth 2.1-compliant authorization (including PKCE), Dynamic Client Registration, and validates Stytch-issued access tokens to enable AI agents to securely interact with external services through permissioned access, supporting scopes like openid, email, profile, and manage:project_data.

    SecurityAutonomous AgentsApp Automation
    2
  • LodestoneBOAuth
    com.studiocorsair

    Remote streamable-HTTP MCP server running on a single Cloudflare Worker. Your assistant gets live Airbnb, Amazon, Booking.com, Google Flights, Maps and Reddit data, social search on X, Instagram and TikTok, the Meta Ad Library, and image/video generation without any keys. Connect your own accounts to let it send WhatsApp or Telegram messages, work an IMAP inbox, manage Meta Ads campaigns and publish to X and LinkedIn. OAuth 2.1 with PKCE; stored credentials are AES-256-GCM encrypted.

    CommunicationSocial MediaTravel & Transportation
    571
  • mcp-empty-public
    io.github.brkd-h1

    Minimal streamable HTTP MCP server used for owned-account registry connectivity tests.

    API TestingDeveloper Tools
    11

Related MCP Servers

  • lighthouse-mcp-oauth

    Ulaklar
    F
    license
    Not graded
    quality
    D
    maintenance
    Enables Claude.ai to connect to a Hermes MCP server via OAuth 2.1 authorization code flow with PKCE, acting as a reverse proxy and single-user authorization gateway.
    -

  • Remote MCP Server on

    berndgill
    F
    license
    Not graded
    quality
    C
    maintenance
    Enables remote MCP server deployment on Cloudflare Workers with OAuth login, supporting tool calling via SSE from clients like MCP Inspector or Claude Desktop.
    -

  • mcp-oauth-server-next

    ctalau
    F
    license
    Not graded
    quality
    C
    maintenance
    A proof-of-concept HTTP MCP server requiring OAuth 2.0 authentication before tool use. Demonstrates the full authentication flow with Claude Code, including discovery, client registration, PKCE authorization, and bearer token verification.
    -

  • simple-mcp

    pcparts001
    F
    license
    Not graded
    quality
    B
    maintenance
    A simple HTTP-based MCP server that provides demo tools (get_test_string, echo, check_maintenance), greeting prompts, and test resources, with optional OAuth 2.1 support.
    -