MCP Dart Streamable HTTP

import 'dart:io';

import 'package:mcp_dart/mcp_dart.dart';

void registerTools(McpServer server) {
  server.registerTool(
    'echo',
    description: 'Echo a message.',
    inputSchema: JsonSchema.object(
      properties: {'message': JsonSchema.string()},
      required: ['message'],
    ),
    annotations: const ToolAnnotations(readOnlyHint: true),
    callback: (args, extra) async => CallToolResult(
      content: [TextContent(text: args['message'] as String)],
    ),
  );
}

/// Application-defined: verify the JWT signature or introspect the token and
/// check issuer, audience/resource and expiry. Return its scopes, or null.
Future<Set<String>?> verifyBearerToken(String token) async => null;

Future<StreamableMcpAuthenticationResult> authenticate(
  HttpRequest request,
) async {
  final header = request.headers.value(HttpHeaders.authorizationHeader);
  if (header == null || !header.startsWith('Bearer ')) {
    return const StreamableMcpAuthenticationResult.unauthorized();
  }
  final scopes = await verifyBearerToken(header.substring(7));
  if (scopes == null) {
    return const StreamableMcpAuthenticationResult.unauthorized(
      errorDescription: 'Invalid or expired token',
    );
  }
  if (!scopes.contains('tools:read')) {
    return const StreamableMcpAuthenticationResult.insufficientScope(
      scope: 'tools:read',
    );
  }
  return const StreamableMcpAuthenticationResult.allow();
}

Future<void> main() async {
  final server = StreamableMcpServer(
    serverFactory: (sessionId) {
      final mcpServer = McpServer(
        const Implementation(name: 'echo-server', version: '1.0.0'),
      );
      registerTools(mcpServer);
      return mcpServer;
    },
    host: '0.0.0.0',
    port: 3000,
    path: '/mcp',
    allowedHosts: {'mcp.example.com'},
    allowedOrigins: {'https://app.example.com'},
    authenticationHandler: (request) => authenticate(request),
    oauthProtectedResource: OAuthProtectedResourceOptions(
      metadata: OAuthProtectedResourceMetadata(
        resource: Uri.parse('https://mcp.example.com/mcp'),
        authorizationServers: [Uri.parse('https://auth.example.com')],
        scopesSupported: const ['tools:read'],
      ),
      metadataUri: Uri.parse(
        'https://mcp.example.com/.well-known/oauth-protected-resource/mcp',
      ),
      scope: 'tools:read',
    ),
  );

  await server.start();
  stderr.writeln('Listening on :3000/mcp');
  await ProcessSignal.sigint.watch().first;
  await server.stop();
}

import 'package:mcp_dart/mcp_dart.dart';

class StaticTokenProvider implements OAuthClientProvider {
  StaticTokenProvider(this._loadToken);

  final Future<String> Function() _loadToken;

  @override
  Future<OAuthTokens?> tokens() async =>
      OAuthTokens(accessToken: await _loadToken());

  @override
  Future<void> redirectToAuthorization() async {
    throw UnauthorizedError('The MCP server rejected the stored token.');
  }
}

Future<void> listRemoteTools(Future<String> Function() loadToken) async {
  final client = McpClient(
    const Implementation(name: 'remote-client', version: '1.0.0'),
  );
  try {
    await client.connect(
      StreamableHttpClientTransport(
        Uri.parse('https://mcp.example.com/mcp'),
        opts: StreamableHttpClientTransportOptions(
          authProvider: StaticTokenProvider(loadToken),
          requestInit: const {
            'headers': {'X-Client-Name': 'remote-client'},
          },
        ),
      ),
    );
    final tools = await client.listTools();
    print(tools.tools.map((tool) => tool.name).join(', '));
  } on UnauthorizedError catch (error) {
    print('Sign-in required: $error');
  } finally {
    await client.close();
  }
}