Skip to content

feat(server-auth-legacy): add frozen v1 Authorization-Server package#1908

Draft
felixweinberger wants to merge 1 commit intomainfrom
fweinberger/v2-bc-server-auth-legacy
Draft

feat(server-auth-legacy): add frozen v1 Authorization-Server package#1908
felixweinberger wants to merge 1 commit intomainfrom
fweinberger/v2-bc-server-auth-legacy

Conversation

@felixweinberger
Copy link
Copy Markdown
Contributor

Part of the v2 backwards-compatibility series — see reviewer guide.

New @modelcontextprotocol/server-auth-legacy package — frozen v1 copy of mcpAuthRouter/ProxyOAuthServerProvider/handlers. npm deprecated on publish with a message pointing to a real IdP + the RS helpers in /express.

Motivation and Context

New @modelcontextprotocol/server-auth-legacy package — frozen v1 copy of mcpAuthRouter/ProxyOAuthServerProvider/handlers. npm deprecated on publish with a message pointing to a real IdP + the RS helpers in /express.

v1 vs v2 pattern & evidence

v1 pattern:

`import { mcpAuthRouter } from '@modelcontextprotocol/sdk/server/auth/router.js'`

v2-native:

Use a dedicated OAuth Authorization Server (IdP); SDK only ships Resource-Server glue

Evidence: Unblocks consumers on the v1 AS impl with a clear migration signal.

How Has This Been Tested?

  • Existing v1 tests ported
  • Integration: validated bump-only against 5 OSS repos via the v2-bc-integration validation branch
  • pnpm typecheck:all && pnpm lint:all && pnpm test:all green

Breaking Changes

None — additive @deprecated shim. Removed in v3.

Types of changes

  • New feature (non-breaking change which adds functionality)

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added or updated documentation as needed

Additional context

Stacks on: none

@felixweinberger felixweinberger added the v2-bc v2 backwards-compatibility series label Apr 15, 2026
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Apr 15, 2026

🦋 Changeset detected

Latest commit: 099bdf1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@modelcontextprotocol/server-auth-legacy Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@felixweinberger felixweinberger added this to the v2.0.0-bc milestone Apr 15, 2026
@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Apr 15, 2026

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@1908

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@1908

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@1908

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@1908

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@1908

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@1908

commit: 099bdf1

@felixweinberger felixweinberger force-pushed the fweinberger/v2-bc-server-auth-legacy branch from c1f5cdf to 652b1db Compare April 16, 2026 09:42
Frozen, deprecated copy of the v1 SDK's src/server/auth/ Authorization
Server helpers (mcpAuthRouter, ProxyOAuthServerProvider, OAuth handlers,
middleware, and error subclasses) as a standalone package for v1 -> v2
migration.

The package carries a package.json "deprecated" field directing users to
a dedicated IdP plus the Resource Server helpers in
@modelcontextprotocol/express. Imports of OAuth types/schemas are
rewritten to @modelcontextprotocol/core; AuthInfo is re-exported from
core for structural compatibility with v2 request-handler context.

Minimal edits vs v1 source: override modifiers and noUncheckedIndexedAccess
fixes to satisfy the v2 strict tsconfig; behaviour is unchanged.
@felixweinberger felixweinberger force-pushed the fweinberger/v2-bc-server-auth-legacy branch from 652b1db to 099bdf1 Compare April 16, 2026 09:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v2-bc v2 backwards-compatibility series

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant