13. Deep Read: services/mcp/auth.ts

This Is a Platform File

services/mcp/auth.ts shows that MCP support here is not a toy connector. It handles metadata discovery, timeout-bound fetches, callback ports, secure token storage, lock files, revocation, non-standard OAuth behaviors, and cross-app access flows.

Main Engineering Lessons

• Protocol integrations need their own error normalization layer.
• User-controlled metadata URLs still need defense-in-depth checks such as HTTPS enforcement.
• Credentials must be keyed by both server identity and configuration, not just display name.
• Revocation and token invalidation are part of a serious auth system, not optional extras.

Why It Matters for Your Own Skills

If you want to support external tool servers, MCP-like integrations, or plugin backends, this file teaches the difference between “it works on my machine” auth and a product-grade auth subsystem.