Five On It

Appearance

five-on-it / apps/mcp/src/http

apps/mcp/src/http ​

The Streamable HTTP transport, POST /mcp, for the Compose stack. Stateless: every request gets its own MCP server whose API calls carry the request's Authorization header, so a caller acts as whoever their bearer token names, with that account's rights and quotas. The token is an OAuth access token the platform API issued (the API is the authorization server: apps/api/src/oauth.ts), or a session POST /auth/login answered, sent as a header.

The server is OAuth's protected resource (RFC 9728, the MCP's authorization):

  • GET /.well-known/oauth-protected-resource/mcp (and without /mcp) names the resource, <public address>/mcp, and the API's issuer as its authorization server.
  • A request whose token the API refuses (expired, revoked) is answered 401 with WWW-Authenticate: Bearer error="invalid_token", resource_metadata="…": the client refreshes it, or signs in again.
  • A call of a tool that acts as a creator (every tool but OPEN_TOOLS) without a token is answered 401 with WWW-Authenticate: Bearer resource_metadata="…": Claude Code then finds the API from the metadata, signs the creator in on its page and calls again.

Everything else stays open to anonymous callers: the protocol's handshake, the tools' list, the resources, the prompts and the reading tools.

Interfaces ​

Functions ​