Module auth 

Authorization: the authenticated caller (Principal), access-token verification (TokenVerifier) and scope checks.

The Streamable HTTP transport acts as an OAuth 2.1 resource server when configured with OAuth: every request must carry a valid bearer token, and handlers that declare scopes (for example #[tool(scopes = ["files:write"])]) run only when the token grants them. stdio is not authorized this way: per the specification, it takes credentials from its environment.

Structs

JwtVerifier

Verifies JWT access tokens: signature (with the issuer’s published keys), issuer, audience, expiry and not-before.

JwtVerifierBuilder

Builder of JwtVerifier.

Principal

The caller authenticated by an access token.

TokenError

Why a token was rejected. The reason is logged on the server; clients only learn that the token is invalid.

Enums

Algorithm

A JWS signature algorithm accepted by JwtVerifier.

JwtError

Invalid JwtVerifier settings.

Traits

TokenVerifier

Checks an access token and identifies its holder.

Type Aliases

ScopeImplies

Decides whether a granted scope satisfies a required one (scope hierarchies: files might imply files:read).

VerifyFuture

The future returned by TokenVerifier::verify.