The provider's user type, exposed as ctx.auth.user.
ReadonlybaseMCP endpoint base path, for example /mcp.
ReadonlymixedWhether the server was constructed with mixedAuth: true, so signed-out
clients can connect, list, and call noauth tools. A provider that
needs anonymous discovery can throw from setup when this is false.
ReadonlyresourceResolved canonical MCP resource URL (the RFC 8707 resource).
Rewrites the instructions text advertised to clients. The transform receives the current text, including earlier transforms, and returns the text to advertise instead. The caller's config is not mutated.
Every tool registered so far, application and provider-owned, in
registration order. Providers use it to validate the application's
tools, for example to refuse a destructive tool that lacks a required
_meta tag, or one whose securitySchemes accepts noauth.
Registers a provider-owned prompt, like server.prompt(). Prompts always
require sign-in, including on a mixedAuth server.
Registers a provider-owned static resource, like server.resource().
Resources always require sign-in, including on a mixedAuth server.
Registers a provider-owned parameterized resource, like
server.resourceTemplate(). Resource templates always require sign-in,
including on a mixedAuth server.
Registers a provider-owned tool, like server.tool(): ctx.auth is
required in the callback unless definition.securitySchemes includes
noauth.
Registers MCP middleware using the same mcp: patterns accepted by
server.use().
Server surface handed to a provider's CustomOAuthProviderOptions.setup hook while the server mounts.
The hook runs once, after the canonical resource is resolved and before the first request is served, so everything registered here participates in the same per-request registry replay as user registrations. Provider-owned tools, resources, resource templates, and prompts go through the same OAuth gate as application items, including a tool's
securitySchemeson amixedAuthserver, and their callbacks receivectx.authwith the provider's user type. The host is only usable while the hook runs.