MCP-Sicherheit im Detail: KI-Assistenten ins Produkt lassen, ohne die Türen zu öffnen

import { createRemoteJWKSet, jwtVerify } from "jose";

const issuer = "https://login.example.com/";
const jwks = createRemoteJWKSet(new URL(issuer + ".well-known/jwks.json"));

export async function authenticate(req: Request) {
  const token = req.headers.get("authorization")?.replace(/^Bearer /, "");
  if (!token) throw new Unauthorized(); // 401 + WWW-Authenticate: resource_metadata=...

  const { payload } = await jwtVerify(token, jwks, {
    issuer,
    audience: "https://mcp.example.com", // tokens for other services are rejected
  });
  return { userId: payload.sub!, scopes: String(payload.scope ?? "").split(" ") };
}

// One scope per tool, read-only unless writing is the point
const tools = {
  list_courses:        { scope: "courses:read",  writes: false },
  get_booking:         { scope: "bookings:read", writes: false },
  update_course_title: { scope: "courses:write", writes: true }, // confirm step, see 5
} as const;

function allowed(tool: keyof typeof tools, scopes: string[]) {
  return scopes.includes(tools[tool].scope);
}