mcp-trellis
mcp-trellis
宿主无关的 MCP + OAuth 端口 —— 你自带运行时和 IdP;库负责连接器协议。
Web 标准 Request → Response。同一个处理程序可运行在 Cloudflare Workers、Next.js App Router、Deno、Bun,以及通过 mcp-trellis/node 接入的 Node HTTP。零运行时依赖。
为什么选择 mcp-trellis
整个连接器堆栈打包在一个包中 —— 既有 MCP 处理器,也有 OAuth 2.1 授权服务器,无需数据库,也无需注册任何厂商。你负责登录、签发 token 和存储;库负责协议本身。
mcp-trellis | 官方 MCP SDK | workers-oauth-provider | @mcpauth/auth | Auth0 / Clerk / Authlete | |
MCP 处理器 | ✅ | ✅ | ❌ | ❌ | ❌ |
OAuth 2.1 授权服务器 | ✅ | ❌ 自带适配 | ✅ | ✅ | ✅ |
运行时 | 任意 Web 标准 | 任意 Web 标准 | 仅限 Workers | Node | — |
数据库 | 无 | — | KV(可选) | 必需 | — |
运行时依赖 | 零 | 多个 | 多个 | 多个 | — |
自托管 | ✅ | ✅ | ✅ | ✅ | ❌ SaaS |
内置指定连接器配置(Claude / Gemini / Codex)并强制执行 | ✅ | ❌ | ❌ | ❌ | ❌ |
当你已经有一套独立的 AS 时,优先选择官方 SDK。当你想要 Cloudflare 的 Workers 专用实现时,优先选择 workers-oauth-provider。当你宁愿付费而不是自己运维时,优先选择托管 IdP。
同类问题空间里的命名替代方案:
@mcpauth/auth/getmcpauth/mcp-auth— 面向 MCP 的 OAuth,通常假设你拥有数据库或采用不同的运行时/技术栈。mcp-trellis 是零依赖选项,在一个包中同时提供 MCP 处理器 和 OAuth 2.1 授权服务器。fastmcp-oauth— 围绕 FastMCP 的 OAuth 辅助工具。mcp-trellis 与宿主无关(Request/Response),也不绑定特定的 MCP 框架。
Related MCP server: Remote MCP Server on Cloudflare
运行时要求
Node 宿主:Node ≥ 20(ESM 中需要全局 WebCrypto)
或任何支持 WebCrypto +
fetch的运行时(Workers、Deno、Bun)
安装
npm install mcp-trellis快速开始
一次调用即可挂载 MCP 端点、OAuth 授权服务器以及两份发现文档:
import { createMcpApp } from "mcp-trellis";
const app = createMcpApp({
serverInfo: { name: "demo", version: "1.0.0" },
clients: ["claude"],
tools: [
{
name: "echo",
description: "Echo text back",
inputSchema: {
type: "object",
properties: { text: { type: "string" } },
required: ["text"],
},
scope: "mcp",
handler: (_ctx, args) => String(args.text ?? ""),
},
],
auth: {
codeSecret: process.env.OAUTH_CODE_SECRET!,
resolveUser: async (req) => getSession(req),
loginUrl: (_req, next) => `/login?next=${encodeURIComponent(next)}`,
mintAccessToken: async ({ userId, scope, resource }) => ({
// Embed `resource` as the token audience (RFC 8707).
accessToken: await issueUserToken(userId, { aud: resource, scope }),
expiresIn: 3600,
}),
verifyToken: async (token) => {
const claims = await readUserToken(token);
if (!claims) return null;
return {
userId: claims.sub,
scopes: claims.scope.split(" "),
audience: claims.aud,
};
},
},
});
export default { fetch: (req: Request) => app.fetch(req) };你返回 token 的 audience;任何工具运行前,库会拒绝为其他资源签发的 token。详见 docs/security.md。
真实的 /authorize 流程包含一个批准步骤:已解析的会话不会立即携带 code 重定向回来,而是先渲染同意界面(内置的,或通过 consent 传入你自己的实现)。首次手动点击流程的集成者应当在那里看到一个 HTML 页面,而不是立即重定向——参见 Consent。
用 initialize 做冒烟测试(公开接口,无需 Bearer):
curl -s http://127.0.0.1:8787/mcp \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18"}}'{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{}},"serverInfo":{"name":"demo","version":"1.0.0"},"instructions":""}}客户端
客户端 | 注册方式 | Token 端点认证 | 说明 |
| 动态(DCR)、公开 + PKCE |
| Claude Custom Connectors 回调白名单已启用 |
| 预注册,机密 |
| 需提供 |
| 按 MCP auth 规范的 OAuth 2.1,公开 + PKCE |
| ChatGPT / Codex 共用同一份契约 |
预注册客户端、DCR 强制机制以及 clientStore 接线方式:docs/guide.md#clients。
架构
createMcpApp 将 MCP 与 OAuth 接线,并在两者之间路由:
宿主配置指南、端口、工具以及多租户:相关指南。
文档
文档 | 内容 |
架构、客户端、配置、端口、工具、多租户 | |
路由、方法、状态码、选项、导出 | |
协议承诺、威胁模型、不适用范围 | |
下一步规划 |
示例:examples/ — HTTP 服务器、Worker、多租户、存储、审计。
贡献
欢迎提交 PR —— 参见 CONTRIBUTING.md。
npm test
npm run build
npm run typecheck许可证
MIT
This server cannot be installed
Maintenance
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceEnables deploying a Model Context Protocol (MCP) server on Cloudflare Workers with built-in OAuth authentication. It allows local clients like Claude Desktop to securely connect to and use remote tools through an HTTP/SSE transport.
- FlicenseNot gradedqualityCmaintenanceEnables deploying and running a Model Context Protocol (MCP) server on Cloudflare Workers with built-in OAuth authentication. It allows users to host and access tools remotely via Server-Sent Events (SSE) transport from clients like Claude Desktop.
- AlicenseNot gradedqualityDmaintenanceA dual-runtime template for building Model Context Protocol servers compatible with Node.js and Cloudflare Workers. It features integrated OAuth, encrypted token storage, and multi-tenant session management to simplify the creation of secure tool, resource, and prompt interfaces.16138ISC
- AlicenseNot gradedqualityDmaintenanceEnables developers to build OAuth-protected MCP servers on Cloudflare Workers with pluggable authentication adapters, allowing user-specific access control and secure token exchange.1326MIT
Related MCP Connectors
Self-hosted federated MCP gateway: one OAuth 2.1 MCP server in front of N apps, user-level scopes.
Artifact store for AI agents. Hosted OAuth at mcp.artifacta.io/mcp; local stdio via npm/PyPI.
Self-hosted MCP gateway: turn any API, database or MCP server into AI connectors — no code.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/amir1824/mcp-trellis'
If you have feedback or need assistance with the MCP directory API, please join our Discord server