mix attesto_mcp.install (AttestoMCP v1.0.5)

Copy Markdown View Source

Scaffolds an MCP protected resource into a Phoenix application

Wires the building blocks an MCP server needs to act as an OAuth 2.0 protected resource into a host Phoenix application:

  • The OAuth 2.0 Protected Resource Metadata endpoint (RFC 9728 Section 3), mounted from the per-resource well-known path (RFC 9728 Section 3.1) with the same route form emitted by AttestoMCP.Router.attesto_mcp_protected_resource_metadata/2. The installer emits root: false, so multiple installations never create an ambiguous or order-dependent root document; a host may explicitly nominate one resource later if legacy-client compatibility requires it.
  • A Phoenix pipeline that enforces bearer-token authentication and the required OAuth scopes (RFC 6750 Bearer Token Usage, RFC 6749 Section 3.3 scope semantics) via AttestoMCP.Plug.ProtectResource. The generated protection derives the exact resource audience from the same path as metadata and rejects tokens issued to sibling MCP resources.

This task is idempotent per resource path: re-running it recognizes only a complete matching scaffold, so it will not duplicate the pipeline, metadata, or protected scope. Legacy raw metadata routes, implicit root ownership, and partial target wiring produce an actionable issue without changing the router; make root ownership explicit and complete or remove the old scaffold before rerunning the installer.

Example

mix attesto_mcp.install --resource-path /mcp --scopes mcp:use

Options

  • --resource-path - the path component of the protected resource being served, for example /mcp (RFC 9728 Section 3.1). The metadata endpoint is mounted at /.well-known/oauth-protected-resource<resource-path> and the protecting pipeline is piped through the matching scope. Defaults to /mcp.
  • --scopes - a comma-separated list of OAuth scope strings the bearer token must carry to access the protected resource (RFC 6749 Section 3.3). Defaults to mcp:use.
  • --router - the Phoenix router module to wire the routes into. Defaults to the application's discovered router.