@spfn/mcp exposes your application's tools, resources, and prompts through an OAuth-protected MCP endpoint. The official SDK owns the protocol; your application owns identity, policy, context, and business logic.
MCP negotiation, JSON-RPC, Streamable HTTP, schema validation, and legacy compatibility belong to the official SDK. Token validation, authorization, catalog filtering, billing, and application state stay in application code. The adapter connects those layers without exporting transport internals into your routes.
createMcpRoute() registers POST, GET, and DELETE at /mcp, then mounts through the same defineRouter(...).packages() composition used across SPFN. Every request resolves validated auth and request metadata before a handler sees application context.
Mount a standards-backed MCP endpoint in an SPFN router.
JSON Schema inputs, annotations, typed context, structured results.
Validated auth, protocol era, and per-request correlation IDs.
Application-provided readable resources through MCP primitives.
Discoverable, application-owned prompt definitions.
Explicit McpError messages; internal failures stay internal.
Optional Host and Origin allowlists for remote deployments.
No bundled catalog, grants, billing, or rate-limit policy.