Help us shape the future of Go! Take the 2026 Go Developer Survey

auth

package
v1.0.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 2, 2026 License: MIT Imports: 20 Imported by: 0

Documentation

Overview

Package auth signs tap in to MCP servers and keeps what the sign-in gives it. The servers it signs in to are the ones that use OAuth, as the MCP authorization spec describes.

Signing in is interactive and happens once, in Authorize: the SDK's authorization-code handler discovers the authorization server, registers tap as a client, and exchanges the code that the person's browser brings back. What it yields is saved beside the config, in a file only its owner can read. Serving is not interactive: Handler lends the saved token to a connection, renews it when it runs out, and reports Required when there is nothing to lend.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Handler

func Handler(configPath, name, endpoint string) sdk.OAuthHandler

Handler returns the OAuth handler for a connection to the named server's endpoint.

func Has

func Has(configPath, name, endpoint string) bool

Has reports whether a sign-in is saved for the server at this endpoint.

func IsRequiredMessage added in v1.0.1

func IsRequiredMessage(msg string) bool

IsRequiredMessage reports whether msg is tap's own sign-in instruction rather than a connector's diagnostics. The instruction carries only a server's name, so a relay may show it to remote clients where it masks every other error.

func Path

func Path(configPath string) string

Path is the file that holds the sign-ins for the config at configPath.

func Remove

func Remove(configPath, name string) (bool, error)

Remove forgets a server's sign-in and reports whether there was one.

Types

type Options

type Options struct {
	ConfigPath, Name, Endpoint string
	// Headers are the server's static headers, sent with the MCP requests.
	Headers http.Header
	// ClientID and ClientSecret name an OAuth client registered by hand, for authorization
	// servers that do not let clients register themselves.
	ClientID, ClientSecret string
	// Port fixes the port of the loopback address the browser is sent back to; zero picks a
	// free one.
	Port int
	// Open shows the sign-in page to the person, usually by starting a browser. It may be nil.
	Open func(page string) error
	// Paste, when not nil, is read for the address the browser ended on, for a browser that
	// cannot reach this machine's loopback address.
	Paste io.Reader
	// Say receives what the person needs to read while they wait.
	Say     io.Writer
	Version string
}

Options describe one sign-in.

type Required

type Required struct{ Server string }

Required is the error for a server that wants a sign-in tap does not have.

func (*Required) Error

func (r *Required) Error() string

type Result

type Result struct {
	SignedIn bool
	Tools    int
}

Result reports a sign-in: whether the server asked for one, and how many tools it lists now.

func Authorize

func Authorize(ctx context.Context, o Options) (*Result, error)

Authorize connects to the server and, when it asks, signs in through the person's browser and saves the result. It returns when the server has answered with its tools, or ctx ends.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL