.NET API
IMcpOAuthCoordinator
Tracon.Abstractions.dllThe coordinator that manages the OAuth Mode 1 (authorization code) flow for MCP servers.
public interface IMcpOAuthCoordinatorRemarks
Section titled “Remarks”The abstraction lives in Tracon.Abstractions because
Tracon.AspNetCore (the endpoints) does not depend on the
Tracon.Mcp package — the same reason as IMcpToolRefresher.
Tokens are never written to the database. At the end of a successful flow, the access and refresh tokens are kept only in memory, bounded by the process lifetime.
DI lifetime — singleton. Registered as a singleton with
TryAdd; a consumer’s own registration wins. This is required, not
incidental: the in-memory tokens and pending-flow state (matched by
state between IMcpOAuthCoordinator.StartAsync and IMcpOAuthCoordinator.CompleteAsync)
must survive across the two separate HTTP requests of one OAuth round trip,
which a scoped registration could not guarantee. An implementation must be
safe under concurrent flows from unrelated tenants.
Methods
Section titled “Methods”CompleteAsync(string, string?, string?, CancellationToken)
Section titled “ CompleteAsync(string, string?, string?, CancellationToken)”Handles the provider’s callback request: forwards the code to the
pending flow matched by state and waits for the token exchange result.
ValueTask<McpOAuthCompleteResult> CompleteAsync(string state, string? code, string? iss, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”state string
The value generated by McpOAuthStartResult.State.
code string?
The authorization code returned by the provider.
iss string?
The RFC 9207 iss parameter (if present).
cancellationToken CancellationToken
The cancellation token.
Returns
Section titled “Returns”ValueTask<McpOAuthCompleteResult>
StartAsync(string, string, CancellationToken)
Section titled “ StartAsync(string, string, CancellationToken)”Starts the authorization flow for a server and returns the provider’s authorization address.
ValueTask<McpOAuthStartResult> StartAsync(string tenantId, string serverName, CancellationToken cancellationToken = default)Parameters
Section titled “Parameters”tenantId string
The tenant identifier.
serverName string
The server name.
cancellationToken CancellationToken
The cancellation token.