Skip to main content
Glama
amir1824

mcp-trellis

mcp-trellis

CI License: MIT

宿主无关的 MCP + OAuth 端口 —— 你自带运行时和 IdP;库负责连接器协议。

Web 标准 RequestResponse。同一个处理程序可运行在 Cloudflare Workers、Next.js App Router、Deno、Bun,以及通过 mcp-trellis/node 接入的 Node HTTP。零运行时依赖。

为什么选择 mcp-trellis

整个连接器堆栈打包在一个包中 —— 既有 MCP 处理器,也有 OAuth 2.1 授权服务器,无需数据库,也无需注册任何厂商。你负责登录、签发 token 和存储;库负责协议本身。

mcp-trellis

官方 MCP SDK

workers-oauth-provider

@mcpauth/auth

Auth0 / Clerk / Authlete

MCP 处理器

OAuth 2.1 授权服务器

❌ 自带适配

运行时

任意 Web 标准

任意 Web 标准

仅限 Workers

Node

数据库

KV(可选)

必需

运行时依赖

多个

多个

多个

自托管

❌ SaaS

内置指定连接器配置(Claude / Gemini / Codex)并强制执行

当你已经有一套独立的 AS 时,优先选择官方 SDK。当你想要 Cloudflare 的 Workers 专用实现时,优先选择 workers-oauth-provider。当你宁愿付费而不是自己运维时,优先选择托管 IdP。

同类问题空间里的命名替代方案:

  • @mcpauth/auth / getmcpauth / mcp-auth — 面向 MCP 的 OAuth,通常假设你拥有数据库或采用不同的运行时/技术栈。mcp-trellis 是零依赖选项,在一个包中同时提供 MCP 处理器 OAuth 2.1 授权服务器。

  • fastmcp-oauth — 围绕 FastMCP 的 OAuth 辅助工具。mcp-trellis 与宿主无关(Request/Response),也不绑定特定的 MCP 框架。

Related MCP server: Remote MCP Server on Cloudflare

运行时要求

  • Node 宿主:Node ≥ 20(ESM 中需要全局 WebCrypto)

  • 或任何支持 WebCrypto + fetch 的运行时(Workers、Deno、Bun)

安装

npm install mcp-trellis

快速开始

一次调用即可挂载 MCP 端点、OAuth 授权服务器以及两份发现文档:

import { createMcpApp } from "mcp-trellis";

const app = createMcpApp({
  serverInfo: { name: "demo", version: "1.0.0" },
  clients: ["claude"],
  tools: [
    {
      name: "echo",
      description: "Echo text back",
      inputSchema: {
        type: "object",
        properties: { text: { type: "string" } },
        required: ["text"],
      },
      scope: "mcp",
      handler: (_ctx, args) => String(args.text ?? ""),
    },
  ],
  auth: {
    codeSecret: process.env.OAUTH_CODE_SECRET!,
    resolveUser: async (req) => getSession(req),
    loginUrl: (_req, next) => `/login?next=${encodeURIComponent(next)}`,
    mintAccessToken: async ({ userId, scope, resource }) => ({
      // Embed `resource` as the token audience (RFC 8707).
      accessToken: await issueUserToken(userId, { aud: resource, scope }),
      expiresIn: 3600,
    }),
    verifyToken: async (token) => {
      const claims = await readUserToken(token);
      if (!claims) return null;
      return {
        userId: claims.sub,
        scopes: claims.scope.split(" "),
        audience: claims.aud,
      };
    },
  },
});

export default { fetch: (req: Request) => app.fetch(req) };

你返回 token 的 audience任何工具运行前,库会拒绝为其他资源签发的 token。详见 docs/security.md

真实的 /authorize 流程包含一个批准步骤:已解析的会话不会立即携带 code 重定向回来,而是先渲染同意界面(内置的,或通过 consent 传入你自己的实现)。首次手动点击流程的集成者应当在那里看到一个 HTML 页面,而不是立即重定向——参见 Consent

initialize 做冒烟测试(公开接口,无需 Bearer):

curl -s http://127.0.0.1:8787/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18"}}'
{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{}},"serverInfo":{"name":"demo","version":"1.0.0"},"instructions":""}}

客户端

客户端

注册方式

Token 端点认证

说明

claude

动态(DCR)、公开 + PKCE

none

Claude Custom Connectors 回调白名单已启用

gemini

预注册,机密

client_secret_basicclient_secret_post

需提供 auth.clientStore

codex

按 MCP auth 规范的 OAuth 2.1,公开 + PKCE

none

ChatGPT / Codex 共用同一份契约

预注册客户端、DCR 强制机制以及 clientStore 接线方式:docs/guide.md#clients

架构

createMcpApp 将 MCP 与 OAuth 接线,并在两者之间路由:

架构:连接器 → 边缘 → OAuth 或 MCP → 你的端口

时序:OAuth 授权与 token,随后 MCP 工具调用

宿主配置指南、端口、工具以及多租户:相关指南

文档

文档

内容

docs/guide.md

架构、客户端、配置、端口、工具、多租户

docs/reference.md

路由、方法、状态码、选项、导出

docs/security.md

协议承诺、威胁模型、不适用范围

docs/ROADMAP.md

下一步规划

示例:examples/ — HTTP 服务器、Worker、多租户、存储、审计。

贡献

欢迎提交 PR —— 参见 CONTRIBUTING.md

npm test
npm run build
npm run typecheck

许可证

MIT

A
license - permissive license
Not graded
quality - not tested
A
maintenance

Maintenance

Maintainers
Response time
2dRelease cycle
4Releases (12mo)
Commit activity

Related MCP Servers

  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables deploying a Model Context Protocol (MCP) server on Cloudflare Workers with built-in OAuth authentication. It allows local clients like Claude Desktop to securely connect to and use remote tools through an HTTP/SSE transport.
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables deploying and running a Model Context Protocol (MCP) server on Cloudflare Workers with built-in OAuth authentication. It allows users to host and access tools remotely via Server-Sent Events (SSE) transport from clients like Claude Desktop.
  • A
    license
    Not graded
    quality
    D
    maintenance
    A dual-runtime template for building Model Context Protocol servers compatible with Node.js and Cloudflare Workers. It features integrated OAuth, encrypted token storage, and multi-tenant session management to simplify the creation of secure tool, resource, and prompt interfaces.
    16
    138
    ISC
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables developers to build OAuth-protected MCP servers on Cloudflare Workers with pluggable authentication adapters, allowing user-specific access control and secure token exchange.
    13
    26
    MIT

View all related MCP servers

Related MCP Connectors

  • Self-hosted federated MCP gateway: one OAuth 2.1 MCP server in front of N apps, user-level scopes.

  • Artifact store for AI agents. Hosted OAuth at mcp.artifacta.io/mcp; local stdio via npm/PyPI.

  • Self-hosted MCP gateway: turn any API, database or MCP server into AI connectors — no code.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/amir1824/mcp-trellis'

If you have feedback or need assistance with the MCP directory API, please join our Discord server