Struct AuthorizedServer 

pub struct AuthorizedServer<S: ServerHandler, A = NoAuth> { /* private fields */ }

A ServerHandler wrapper that adds authorization-based schema shaping.

Wraps any inner ServerHandler and intercepts list_tools / call_tool to filter tools and shape schemas based on the request’s AuthContext.

Compile-time guarantee

In the spirit of Proof<C> — which makes skipping a capability check uncompilable — forgetting to wire authentication is a build error, not a runtime panic. ServerHandler is implemented only for AuthorizedServer<S, Authorized<P>>, so a server with no auth source chosen cannot be served:

use mcp_authorization::AuthorizedServer;
use rmcp::handler::server::ServerHandler;
use rmcp::model::{ServerInfo, ServerCapabilities, Implementation};

struct Inner;
impl ServerHandler for Inner {
    fn get_info(&self) -> ServerInfo {
        ServerInfo::new(ServerCapabilities::builder().enable_tools().build())
            .with_server_info(Implementation::new("inner", "0.0.0"))
    }
}
fn requires_handler<T: ServerHandler>(_: T) {}

// No auth source chosen → not a ServerHandler → does not compile.
requires_handler(AuthorizedServer::new(Inner));

Choosing an auth source makes it servable:

use mcp_authorization::AuthorizedServer;
use rmcp::handler::server::ServerHandler;
use rmcp::model::{ServerInfo, ServerCapabilities, Implementation};

struct Inner;
impl ServerHandler for Inner {
    fn get_info(&self) -> ServerInfo {
        ServerInfo::new(ServerCapabilities::builder().enable_tools().build())
            .with_server_info(Implementation::new("inner", "0.0.0"))
    }
}
fn requires_handler<T: ServerHandler>(_: T) {}

// deny_by_default() (or with_auth(..)) yields a real ServerHandler.
requires_handler(AuthorizedServer::new(Inner).deny_by_default());

Implementations

impl<S: ServerHandler> AuthorizedServer<S, NoAuth>

pub fn new(inner: S) -> Self

Start building an authorized server. No auth source is chosen yet, so the result is not yet a ServerHandler — call with_auth or deny_by_default.

impl<S: ServerHandler, A> AuthorizedServer<S, A>

pub fn register<I, O>( self, name: impl Into<String>, description: impl Into<String>, ) -> Self

where I: JsonSchema + AuthSchemaMetadata + DeserializeOwned + 'static, O: JsonSchema + AuthSchemaMetadata + Serialize + 'static,

Register a tool with typed input/output for schema generation and authorization metadata.

pub fn authorize(self, tool_name: &str, capability: &'static str) -> Self

Set tool-level authorization for a named tool. The tool is hidden from list_tools if the request’s AuthContext lacks this capability.

pub fn with_auth<P: AuthProvider>( self, provider: P, ) -> AuthorizedServer<S, Authorized<P>>

Choose an explicit auth source. Required before serving any network transport. Transitions the server into the servable Authorized state.

provider is anything implementing AuthProvider, including a closure Fn(&RequestContext<RoleServer>) -> AuthContext.

pub fn deny_by_default(self) -> AuthorizedServer<S, Authorized<DenyByDefault>>

Install DenyByDefault: use an AuthContext injected by middleware if present, otherwise resolve to AuthContext::empty.

The ergonomic choice for stdio / local / dev: the server is immediately servable and an unauthenticated client sees the least-privileged view (only ungated tools) rather than an error.

pub fn inner(&self) -> &S

Get a reference to the inner handler.

pub fn registry(&self) -> &AuthToolRegistry

Get a reference to the authorization registry.

Trait Implementations

impl<S: ServerHandler, P: AuthProvider + 'static> ServerHandler for AuthorizedServer<S, Authorized<P>>

fn get_info(&self) -> ServerInfo

fn list_tools( &self, _request: Option<PaginatedRequestParams>, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<ListToolsResult, McpError>> + MaybeSendFuture + '_

fn call_tool( &self, request: CallToolRequestParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<CallToolResult, McpError>> + MaybeSendFuture + '_

fn initialize( &self, request: InitializeRequestParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<InitializeResult, McpError>> + MaybeSendFuture + '_

fn ping( &self, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<(), McpError>> + MaybeSendFuture + '_

fn complete( &self, request: CompleteRequestParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<CompleteResult, McpError>> + MaybeSendFuture + '_

fn set_level( &self, request: SetLevelRequestParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<(), McpError>> + MaybeSendFuture + '_

fn get_prompt( &self, request: GetPromptRequestParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<GetPromptResult, McpError>> + MaybeSendFuture + '_

fn list_prompts( &self, request: Option<PaginatedRequestParams>, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<ListPromptsResult, McpError>> + MaybeSendFuture + '_

fn list_resources( &self, request: Option<PaginatedRequestParams>, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<ListResourcesResult, McpError>> + MaybeSendFuture + '_

fn list_resource_templates( &self, request: Option<PaginatedRequestParams>, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<ListResourceTemplatesResult, McpError>> + MaybeSendFuture + '_

fn read_resource( &self, request: ReadResourceRequestParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<ReadResourceResult, McpError>> + MaybeSendFuture + '_

fn subscribe( &self, request: SubscribeRequestParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<(), McpError>> + MaybeSendFuture + '_

fn unsubscribe( &self, request: UnsubscribeRequestParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<(), McpError>> + MaybeSendFuture + '_

fn get_tool(&self, name: &str) -> Option<Tool>

Get a tool definition by name.

fn on_custom_request( &self, request: CustomRequest, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<CustomResult, McpError>> + MaybeSendFuture + '_

fn on_cancelled( &self, notification: CancelledNotificationParam, context: NotificationContext<RoleServer>, ) -> impl Future<Output = ()> + MaybeSendFuture + '_

fn on_progress( &self, notification: ProgressNotificationParam, context: NotificationContext<RoleServer>, ) -> impl Future<Output = ()> + MaybeSendFuture + '_

fn on_initialized( &self, context: NotificationContext<RoleServer>, ) -> impl Future<Output = ()> + MaybeSendFuture + '_

fn on_roots_list_changed( &self, context: NotificationContext<RoleServer>, ) -> impl Future<Output = ()> + MaybeSendFuture + '_

fn on_custom_notification( &self, notification: CustomNotification, context: NotificationContext<RoleServer>, ) -> impl Future<Output = ()> + MaybeSendFuture + '_

fn enqueue_task( &self, request: CallToolRequestParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<CreateTaskResult, McpError>> + MaybeSendFuture + '_

fn list_tasks( &self, request: Option<PaginatedRequestParams>, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<ListTasksResult, McpError>> + MaybeSendFuture + '_

fn get_task_info( &self, request: GetTaskInfoParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<GetTaskResult, McpError>> + MaybeSendFuture + '_

fn get_task_result( &self, request: GetTaskResultParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<GetTaskPayloadResult, McpError>> + MaybeSendFuture + '_

fn cancel_task( &self, request: CancelTaskParams, context: RequestContext<RoleServer>, ) -> impl Future<Output = Result<CancelTaskResult, McpError>> + MaybeSendFuture + '_