Anubis.Client.Authorization (anubis_mcp v2.2.0)

Discovers the OAuth configuration of a protected MCP HTTP endpoint.

Discovery stops at validated metadata: consent, client registration, PKCE, token storage and refresh belong to the host application's OAuth client. Uses an application-owned Finch pool, just like the HTTP transport.

Summary

Functions

discover(mcp_url, opts \\ [])

Discovers resource metadata and OAuth/OIDC authorization server metadata.

get_schema(atom)

resource_schema(data)

resource_schema!(data)

server_schema(data)

server_schema!(data)

Functions

discover(mcp_url, opts \\ [])

@spec discover(String.t(), keyword()) ::
  {:ok, Anubis.Client.Authorization.Metadata.t()}
  | {:error, Anubis.MCP.Error.t()}

Discovers resource metadata and OAuth/OIDC authorization server metadata.

{:ok, metadata} = Anubis.Client.Authorization.discover("https://example.com/mcp")

Options:

:challenge — a Challenge returned by the HTTP transport, for reactive discovery.
:authorization_server — selects an advertised issuer; required when more than one is advertised.
:finch_name — an existing Finch pool (default Anubis.Finch).
:http_options — Finch request options (defaults receive_timeout: 5_000, request_timeout: 10_000). HTTP/1 uses an idle receive timeout and a best-effort total response timeout. Finch HTTP/2 uses receive_timeout as a total response timeout and ignores request_timeout. Overrides may relax or disable these limits.
:allow_insecure_localhost — permits HTTP on localhost/loopback for development (default false).
:url_policy — optional fn url -> :ok | {:error, reason} end, called before each metadata fetch. Hosts accepting untrusted server URLs must enforce their network access policy here and at the network layer, including private-address and DNS-rebinding restrictions.

Metadata requests carry no credentials, do not follow redirects and accept at most 1 MiB. Discovery falls back on 404/405; invalid documents fail validation. Missing metadata returns an error and does not establish that authorization is unnecessary.

Errors are Anubis.MCP.Error structs. A multiple-issuer error includes data.authorization_servers so the host can select one and retry.