Repository navigation
Chumbo 0.12.2 lets an application with its own OAuth authorization server authenticate the opaque access tokens it issues to MCP clients. Configure auth: { mode: "oauth", issuer, verify } and Chumbo calls verify({ token, resourceUrl, issuer }) with the canonical resource URL and configured issuer. The verifier owns issuer, exact resource, expiry, and revocation checks. Verified callers receive an anonymous Supabase client, so capability code enforces application permissions and the opaque bearer is never sent to Supabase. Omitting verify keeps Supabase JWT verification unchanged.
Verified with pnpm check, pnpm format:check, and npm pack --dry-run.