modelcontextprotocol / modelcontextprotocol/typescript-sdk
mcpAuthRouter construction-time env is incompatible with request-scoped runtimes (Cloudflare Workers, Supabase Edge, etc.)
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13.4k
- Forks
- 2.2k
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 4
Description
Is your feature request related to a problem? Please describe.
createMcpAuthRouter requires env-dependent initialization at app construction time. This does not work in request-scoped runtimes where bindings only exist per request.
In Cloudflare Workers (using Hono), Supabase Edge Functions, Deno Deploy, and similar environments, env is only available inside the request handler (for example c.env). There is no stable app-level env at construction time.
The only working pattern today is to reconstruct the router on every request:
app.post("/token", (c) =>
createMcpAuthRouter(c.env).fetch(c.req.raw, c.env)
);
This is awkward and suggests the API assumes a long-lived Node-style server.
Describe the solution you'd like
Support a request-time execution model that does not require env at construction time.
Examples:
const handler = createMcpAuthHandler();
app.all("/oauth/*", (c) => handler(c.req.raw, c.env));
or:
app.use("/oauth/*", (c) => mcpAuthHandler(c));
or:
mcpAuthRouter({ getEnv: (c) => c.env });
Any approach where env is provided at request time instead of construction time would resolve this.
Describe alternatives you've considered
Per-request router construction:
(c) => createMcpAuthRouter(c.env).fetch(c.req.raw, c.env)
This works but:
- recreates the router on every request
- prevents reuse of internal state or memoization
- requires repetitive route wiring
Additional context
Request-scoped runtimes are now common deployment targets:
- Cloudflare Workers
- Supabase Edge Functions
- Vercel Edge Runtime
- Deno Deploy
All share the same constraint: env is only available per request.
The current API design makes the SDK difficult to use in these environments and effectively limits it to Node-style servers. Supporting a fetch-style or context-driven handler would make the SDK compatible with edge runtimes without workarounds.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing createMcpAuthRouter and its fetch path, focusing on where environment-dependent initialization occurs. Compare the existing per-request createMcpAuthRouter(c.env).fetch(c.req.raw, c.env) pattern with the proposed handler or context-driven APIs. Done means request-scoped runtimes can provide env per request without reconstructing the router.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- deno, typescript
- Domain
- api, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100