Add lazy-auth-server example

[mel-anthropic]

Summary

Adds examples/lazy-auth-server — an MCP App example demonstrating lazy (on-demand) OAuth: the server connects and lists tools without authentication, and only asks for auth when a protected tool is actually called, by responding 401 with a WWW-Authenticate header.

Based on this demo gist, restructured to match the repo's example conventions (Vite-built views, server.ts/main.ts split, workspace package).

What it demonstrates

• Lazy auth: initialize, tools/list, and public tools work unauthenticated; protected tools trigger OAuth via 401 + WWW-Authenticate (RFC 9728 / RFC 8414 discovery)
• Cross-app auth: the public show_auth_button app calls the protected get_secret tool via callServerTool; the host runs OAuth and retries, and the result renders inline
• Embedded mock AS: authorization-code + PKCE, HS256 JWTs, stateless auth codes, refresh + session revocation — single process, no external dependencies
• Per-connection token TTLs: /ttl/<seconds>/mcp endpoint paths let slow or automated clients request longer-lived tokens, threaded through OAuth via RFC 8707 resource indicators
• URL elicitation: elicit_url (blocking) and elicit_by_error (-32042 + retry) tools

Test plan

• npm run --workspace examples/lazy-auth-server build (tsc + vite + bun)
• Full OAuth flow verified with curl: unauthenticated connect → 401 → PKCE authorize/token → authenticated calls → refresh → revocation
• TTL-scoped endpoints verified: path-encoded TTL honored via RFC 8707 resource indicators; invalid TTLs 404
• End-to-end verified against a remote MCP host: lazy connect with no upfront auth prompt, app renders, "Auth me" → OAuth popup → secret renders, refresh + revocation

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/ext-apps

npm i https://pkg.pr.new/@modelcontextprotocol/ext-apps@679

@modelcontextprotocol/server-basic-preact

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-preact@679

@modelcontextprotocol/server-basic-react

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-react@679

@modelcontextprotocol/server-basic-solid

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-solid@679

@modelcontextprotocol/server-basic-svelte

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-svelte@679

@modelcontextprotocol/server-basic-vanillajs

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-vanillajs@679

@modelcontextprotocol/server-basic-vue

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-vue@679

@modelcontextprotocol/server-budget-allocator

npm i https://pkg.pr.new/@modelcontextprotocol/server-budget-allocator@679

@modelcontextprotocol/server-cohort-heatmap

npm i https://pkg.pr.new/@modelcontextprotocol/server-cohort-heatmap@679

@modelcontextprotocol/server-customer-segmentation

npm i https://pkg.pr.new/@modelcontextprotocol/server-customer-segmentation@679

@modelcontextprotocol/server-debug

npm i https://pkg.pr.new/@modelcontextprotocol/server-debug@679

@modelcontextprotocol/server-map

npm i https://pkg.pr.new/@modelcontextprotocol/server-map@679

@modelcontextprotocol/server-pdf

npm i https://pkg.pr.new/@modelcontextprotocol/server-pdf@679

@modelcontextprotocol/server-scenario-modeler

npm i https://pkg.pr.new/@modelcontextprotocol/server-scenario-modeler@679

@modelcontextprotocol/server-shadertoy

npm i https://pkg.pr.new/@modelcontextprotocol/server-shadertoy@679

@modelcontextprotocol/server-sheet-music

npm i https://pkg.pr.new/@modelcontextprotocol/server-sheet-music@679

@modelcontextprotocol/server-system-monitor

npm i https://pkg.pr.new/@modelcontextprotocol/server-system-monitor@679

@modelcontextprotocol/server-threejs

npm i https://pkg.pr.new/@modelcontextprotocol/server-threejs@679

@modelcontextprotocol/server-transcript

npm i https://pkg.pr.new/@modelcontextprotocol/server-transcript@679

@modelcontextprotocol/server-video-resource

npm i https://pkg.pr.new/@modelcontextprotocol/server-video-resource@679

@modelcontextprotocol/server-wiki-explorer

npm i https://pkg.pr.new/@modelcontextprotocol/server-wiki-explorer@679

commit: c9601f5