mcp/client

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

MCP Client creation for remote authentication

Create an MCP Client using createMcpAuthClient imported from 'better-auth/plugins/mcp/client'. It requires an authURL parameter pointing to the Better Auth server's URL (the same baseURL plus basePath from the auth config). The MCP Client is a lightweight, framework-agnostic HTTP client that validates Bearer tokens against a remote Better Auth server and is included in the 'better-auth' package.

MCP Client handler wrapper for protecting routes

Use the mcpAuth.handler method to wrap MCP route handlers for Web Standard Request/Response (works with Deno, Bun, Cloudflare Workers, etc.). The handler receives req and session parameters, where session contains userId, scopes, and clientId properties.

MCP Client discovery endpoint setup

The MCP Client provides mcpAuth.discoveryHandler() and mcpAuth.protectedResourceHandler(serverUrl) methods to mount OAuth discovery endpoints at the root of the MCP server. The discoveryHandler proxies GET /.well-known/oauth-authorization-server from Better Auth. The protectedResourceHandler returns GET /.well-known/oauth-protected-resource and points MCP clients to Better Auth. These proxy and cache metadata from the Better Auth server, allowing MCP clients to discover authorization, token, and registration endpoints automatically.

MCP Client configuration options

The MCP Client accepts the following configuration options: authURL (string, required) - full URL to Better Auth endpoints (baseURL + basePath); resource (string, optional) - resource identifier for the protected resource metadata, defaults to the origin of the server URL; allowedOrigin (string, optional) - allowed CORS origin, defaults to the authURL origin, set to '*' to allow all origins (not recommended for production); fetch (typeof fetch, optional) - custom fetch implementation, defaults to global fetch.

MCP Client session object structure

The session object returned by verifyToken and passed to handlers contains: accessToken (string) - the opaque access token; refreshToken (string) - the refresh token; accessTokenExpiresAt (string) - when the access token expires; refreshTokenExpiresAt (string) - when the refresh token expires; clientId (string) - the OAuth client ID that requested the token; userId (string) - the authenticated user's ID; scopes (string) - space-separated list of granted scopes.

Hono framework adapter for MCP Client

Import mcpAuthHono from 'better-auth/plugins/mcp/client/adapters'. Call it with an object containing authURL pointing to the Better Auth server. It returns middleware and discoveryRoutes functions. Call discoveryRoutes(app, serverUrl) to mount OAuth discovery endpoints. Use app.use('/mcp/*', middleware) to protect MCP routes. The session is available in context via c.get('mcpSession') with userId, scopes, and other session properties.

Express framework adapter for MCP Client

Import createMcpAuthClient from 'better-auth/plugins/mcp/client'. Create an instance with authURL pointing to the Better Auth server. Use app.use('/mcp', mcpAuth.middleware()) to protect MCP routes. The session is available on req.mcpSession with userId, scopes, and other session properties.

Official MCP SDK adapter for Better Auth

Import mcpAuthOfficial from 'better-auth/plugins/mcp/client/adapters'. Call it with an object containing authURL pointing to the Better Auth server. Use auth.handler to wrap route handlers that receive req and session parameters. The handler can connect the session to an MCP server instance.

mcp-use framework adapter for MCP Client

Import mcpAuthMcpUse from 'better-auth/plugins/mcp/client/adapters'. It serves as a drop-in replacement for oauthWorkOSProvider, oauthSupabaseProvider, etc. Call it with an object containing authURL pointing to the Better Auth server and pass it to the MCPServer constructor's oauth option.

Give your agent this brain