← Kembali ke Beranda

MCP Dynamic OAuth Prompt Template

Isi form di bawah, prompt otomatis ter-update. Transport Streamable HTTP wajib — sisanya menyesuaikan stack proyek Anda.

Cara Menggunakan:

Isi form konfigurasi proyek Anda di bawah.
Cek preview prompt — placeholder sudah otomatis diganti.
Klik "Salin Prompt" dan tempel ke Cursor / Claude / Gemini.

Konfigurasi Proyek

Nama Platform

Domain Production (tanpa https://)

Framework

Database / ORM

Bahasa Pemrograman

Deploy / Hosting

Env Key Base URL

Perintah Migrasi DB

Role Aplikasi

Domain Bisnis

Catatan Framework (opsional — config khusus stack Anda)

Struktur Folder

Tools Public (tanpa login)

Tools Protected (butuh login)

mcp-oauth-dcr-prompt-template.txt

Preview sinkron dengan form

Buatkan MCP Server untuk platform **{{PLATFORM_NAME}}** dengan arsitektur One-Link Solution (Lazy Auth + Streamable HTTP + OAuth Discovery otomatis).

---

## Tech Stack

### WAJIB (tidak boleh diganti)
- @modelcontextprotocol/sdk — transport **Streamable HTTP** (`WebStandardStreamableHTTPServerTransport`)
- BUKAN SSE deprecated, BUKAN Stdio untuk use case remote/ChatGPT

### Sesuaikan dengan proyek ini
- **Framework**: {{FRAMEWORK}}
- **Database / ORM**: {{DATABASE}}
- **Bahasa**: {{LANGUAGE}}
- **Deploy / Hosting**: {{DEPLOY}}

### Catatan framework
{{FRAMEWORK_NOTES}}

---

## Daftar Lengkap Path URL

Base URL production: `https://{{DOMAIN}}`

### MCP (Entry Point)
| Method | Path | Fungsi |
|--------|------|--------|
| GET | `/api/mcp` | Health check browser → "{{PLATFORM_NAME}} MCP Server (Stateless) is active." |
| GET | `/api/mcp` | Handshake Streamable HTTP (AI Host, Accept: text/event-stream) |
| POST | `/api/mcp` | JSON-RPC: list tools, call tools |

URL MCP untuk ChatGPT:
https://{{DOMAIN}}/api/mcp

### OAuth Discovery (Auto — tanpa Client ID manual)
| Method | Path | Fungsi |
|--------|------|--------|
| GET | `/.well-known/oauth-protected-resource` | Metadata resource + authorization server |
| GET | `/.well-known/oauth-authorization-server` | Metadata OAuth (issuer, endpoints, PKCE) |
| POST | `/api/oauth/register` | Dynamic Client Registration → return client_id: "mcp-default-client" |

### OAuth Flow
| Method | Path | Fungsi |
|--------|------|--------|
| GET | `/oauth/authorize` | Halaman consent (UI) — redirect ke login jika belum auth |
| POST | `/api/oauth/authorize` | Generate authorization code + simpan PKCE challenge |
| POST | `/api/oauth/token` | Tukar code → access_token + refresh_token (form-urlencoded + PKCE) |

### Auth App
| Method | Path | Fungsi |
|--------|------|--------|
| GET/POST | `/login` | Login user (support callbackUrl untuk OAuth redirect) |
| GET | `/settings` | (Opsional) Generate API Key alternatif untuk MCP |

---

## Database — Tabel MCP (Prefix mcp_)

Buat tabel dengan prefix `mcp_` di database. Sesuaikan syntax ORM dengan stack: {{DATABASE}}

### mcp_oauth_tokens — Penampung token login MCP

model McpOAuthToken {
  id                  String    @id @default(cuid())
  userId              String
  code                String?   @unique
  accessToken         String?   @unique
  refreshToken        String?   @unique
  codeChallenge       String?
  codeChallengeMethod String?
  clientId            String?   @default("mcp-default-client")
  expiresAt           DateTime?
  createdAt           DateTime  @default(now())
  updatedAt           DateTime  @updatedAt
  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
  @@map("mcp_oauth_tokens")
}

Alur data:
- User klik Authorize → isi userId, code, codeChallenge, clientId, expiresAt (code ~10 menit)
- ChatGPT tukar code → code=null, accessToken, refreshToken, expiresAt (token ~30 hari)
- Refresh token → rotate accessToken & refreshToken

### (Opsional) mcp_api_keys

model McpApiKey {
  id        String   @id @default(cuid())
  userId    String
  key       String   @unique
  label     String?  @default("default")
  createdAt DateTime @default(now())
  expiresAt DateTime?
  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
  @@map("mcp_api_keys")
}

Migrasi: {{MIGRATE_CMD}}

---

## Struktur Folder

{{FOLDER_STRUCTURE}}

---

## Implementasi MCP Route (/api/mcp)

WAJIB:
- WebStandardStreamableHTTPServerTransport
- sessionIdGenerator: undefined (stateless, cocok serverless)
- Header X-Accel-Buffering: no

Lazy Auth — sebelum SDK handle request, jika tools/call protected tanpa Bearer token:
HTTP 401
WWW-Authenticate: Bearer realm="{{PLATFORM_NAME}}", resource_metadata="https://{{DOMAIN}}/.well-known/oauth-protected-resource"

JSON-RPC error data sertakan login_url dan oauth_metadata (issuer, authorization_endpoint, token_endpoint).

GET /api/mcp:
- Tanpa Accept: text/event-stream → plain text status
- Dengan stream → header Link ke /.well-known/oauth-protected-resource

---

## OAuth Discovery Response

GET /.well-known/oauth-protected-resource (base URL dinamis dari request):
{ "resource": "https://{{DOMAIN}}", "authorization_servers": ["https://{{DOMAIN}}"], "resource_name": "{{PLATFORM_NAME}} MCP" }

GET /.well-known/oauth-authorization-server:
{ "issuer": "https://{{DOMAIN}}/", "authorization_endpoint": "https://{{DOMAIN}}/oauth/authorize", "token_endpoint": "https://{{DOMAIN}}/api/oauth/token", "registration_endpoint": "https://{{DOMAIN}}/api/oauth/register", "response_types_supported": ["code"], "code_challenge_methods_supported": ["S256"], "token_endpoint_auth_methods_supported": ["client_secret_post", "none"], "grant_types_supported": ["authorization_code", "refresh_token"] }

POST /api/oauth/register:
{ "client_id": "mcp-default-client", "token_endpoint_auth_method": "none", "grant_types": ["authorization_code", "refresh_token"], "response_types": ["code"] }

---

## Auth Resolver (mcp-auth.ts)

1. Cek Bearer token di mcp_oauth_tokens.accessToken (belum expired)
2. Fallback: User.apiKey atau mcp_api_keys.key
Return userId atau null

Token generation:
- code: randomBytes(24).hex, expiry 10 menit
- accessToken & refreshToken: randomBytes(32).hex, expiry 30 hari
- Default client_id: mcp-default-client

---

## Tools MCP

Public (tanpa login):
{{PUBLIC_TOOLS}}

Protected (PROTECTED_TOOLS[], butuh login):
{{PROTECTED_TOOLS}}

---

## Environment Variables

{{ENV_KEY}}=https://{{DOMAIN}}
(+ DATABASE_URL / connection string sesuai {{DATABASE}})

---

## Setup ChatGPT

| Field | Nilai |
|-------|-------|
| Server URL | https://{{DOMAIN}}/api/mcp |
| Authentication | None (BUKAN OAuth manual) |
| Client ID | Tidak perlu diisi |

Login muncul otomatis saat user panggil protected tool di chat.

---

## Checklist Verifikasi

- GET https://{{DOMAIN}}/api/mcp → status text OK
- GET /.well-known/oauth-protected-resource → JSON valid
- GET /.well-known/oauth-authorization-server → ada registration_endpoint
- Tabel mcp_oauth_tokens ada di database
- Public tool jalan tanpa token
- Protected tool → 401 → tombol login ChatGPT
- Setelah login → row mcp_oauth_tokens punya accessToken

---

## Aturan (JANGAN)

- JANGAN pakai SSE deprecated atau path /api/mcp/sse
- JANGAN ganti transport ke Stdio untuk use case ChatGPT remote
- JANGAN wajibkan Client ID manual di ChatGPT UI
- JANGAN hardcode domain
- JANGAN buat tabel token tanpa prefix mcp_

---

## Ringkasan Platform

- Nama Platform: {{PLATFORM_NAME}}
- Domain: https://{{DOMAIN}}
- Role: {{ROLES}}
- Business: {{BUSINESS}}
- Framework: {{FRAMEWORK}}

Buat implementasi modular, data dari database, dan ikuti pola Lazy Auth + DCR + Streamable HTTP persis seperti di atas.