modelcontextprotocol / modelcontextprotocol/typescript-sdk

mcpAuthRouter construction-time env is incompatible with request-scoped runtimes (Cloudflare Workers, Supabase Edge, etc.)

Open
#1,860 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

auth enhancement needs decision P3
Dominant language
TypeScript
Stars
13.4k
Forks
2.2k
Avg merge
3d 15h
Merged PRs (30d)
4

Description

Is your feature request related to a problem? Please describe.
createMcpAuthRouter requires env-dependent initialization at app construction time. This does not work in request-scoped runtimes where bindings only exist per request.

In Cloudflare Workers (using Hono), Supabase Edge Functions, Deno Deploy, and similar environments, env is only available inside the request handler (for example c.env). There is no stable app-level env at construction time.

The only working pattern today is to reconstruct the router on every request:

app.post("/token", (c) =>
  createMcpAuthRouter(c.env).fetch(c.req.raw, c.env)
);

This is awkward and suggests the API assumes a long-lived Node-style server.


Describe the solution you'd like
Support a request-time execution model that does not require env at construction time.

Examples:

const handler = createMcpAuthHandler();
app.all("/oauth/*", (c) => handler(c.req.raw, c.env));

or:

app.use("/oauth/*", (c) => mcpAuthHandler(c));

or:

mcpAuthRouter({ getEnv: (c) => c.env });

Any approach where env is provided at request time instead of construction time would resolve this.


Describe alternatives you've considered
Per-request router construction:

(c) => createMcpAuthRouter(c.env).fetch(c.req.raw, c.env)

This works but:

  • recreates the router on every request
  • prevents reuse of internal state or memoization
  • requires repetitive route wiring

Additional context
Request-scoped runtimes are now common deployment targets:

  • Cloudflare Workers
  • Supabase Edge Functions
  • Vercel Edge Runtime
  • Deno Deploy

All share the same constraint: env is only available per request.

The current API design makes the SDK difficult to use in these environments and effectively limits it to Node-style servers. Supporting a fetch-style or context-driven handler would make the SDK compatible with edge runtimes without workarounds.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing createMcpAuthRouter and its fetch path, focusing on where environment-dependent initialization occurs. Compare the existing per-request createMcpAuthRouter(c.env).fetch(c.req.raw, c.env) pattern with the proposed handler or context-driven APIs. Done means request-scoped runtimes can provide env per request without reconstructing the router.

Written by the indexing model from the issue text.

Assessment

Tech stack
deno, typescript
Domain
api, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.