HTTP endpoints and MCP

Declare endpoints as {path, handler} entries. Paths are absolute, exact, and query-independent. Handler modules are relative .ts files with a default fetch(request, env, ctx) object; EndpointHandler<Env> is available from renku/server.

Every HTTP method reaches the handler, which owns its method policy. Duplicate paths, page overlaps, reserved framework paths, and public asset collisions fail the build. Endpoint paths are excluded from PWA offline navigation fallback and cannot be prerendered.

endpoints: [{ path: "/mcp", handler: "./src/mcp.ts" }],

renku/mcp exposes Cloudflare Agents createMcpHandler and getMcpAuthContext alongside the pinned MCP SDK McpServer and z schema validator. A per-request factory registers an explicit tool catalog.

Behind the OAuth provider, oauthMcpContext(ctx) adapts its verified context into authInfo and authContext. Pass authContext to createMcpHandler and call handler.fetch(request, {authInfo}).

Factories and tool callbacks receive standard AuthInfo; getMcpAuthContext() exposes application props during the request. The callable handler(request, env, ctx) API is also available, but the pinned OAuth provider does not publish the private marker Agents needs for automatic AuthInfo discovery.

Configure route, allowedHostnames, allowedOriginHostnames and corsOptions explicitly.

Hostname allowlists do not constrain scheme or port, so applications needing exact Origin validation must enforce it upstream. antgrade uses the 2026-07-28 stateless Streamable HTTP protocol with legacy traffic rejected, bounded 64 KiB bodies, and no subscriptions.

Business data stays in existing Durable Objects.

Declare mcpApps as a map of stable view names to .tsrx client components. renku compiles each into self-contained HTML, script and StyleX CSS, independent of routing, PWA and browser session RPC.

Before connecting the transport, registerMcpViews(server) from renku/mcp/apps advertises the UI extension, registers versioned ui:// resources with CSP metadata on both listings and content, and returns their URIs.

Link a tool with _meta.ui.resourceUri and include the same metadata in successful view results so hosts can resolve the resource directly. Return useful text and structuredContent alongside its UI. renku/mcp/client exports the standard App bridge and host-theme helpers.

Register handlers before connect(), send calls through callServerTool(), and clean up subscriptions on teardown. Resource CSP allows no external network domains. App definitions and data authorization remain application concerns.

mcpApps: { workspace: "./src/mcp/workspace.tsrx" },

AuthUserObject subclasses can call protected createDelegation(browserToken, {client, resource, scopes, constraints}, seconds) after application consent.

It returns an internal capability, never a browser session. requireDelegation verifies its hash, account epoch, expiry, resource, required scope, and optional tenant constraint. An undefined scope validates identity and the tenant only; data operations must supply their required scope.

Pass consume=true at the HTTP boundary for a per-grant 120-request/minute budget. delegations and revokeDelegation require a browser session. Grants expire within 30 days and are cleaned by the authentication alarm.

Account disablement and revokeAll invalidate grants; ordinary browser logout does not.

renku/auth/oauth-server exposes Cloudflare's OAuthProvider, helper types, and boundedRequest. OAuth needs an OAUTH_KV binding. Client ID Metadata Documents require global_fetch_strictly_public.

Applications own trusted origins, consent, scope meaning, current tenant permissions, and the bridge from OAuth props to an internal delegated capability. Revalidate at the authority that reads or writes data.

Never turn a delegated token into an unrestricted browser session. antgrade's source demonstrates PKCE consent, refresh validation, and immediate connection revocation.