The MCP provider turns a remote Streamable HTTP MCP endpoint into a Hookfish
OAuth provider. It discovers the protected resource and authorization server,
requires PKCE S256, and can register a client when the authorization server
supports it.
Add the MCP template
Register the reusable template in hookfish.config.ts:
The template itself is not configured for one endpoint. It creates dynamic
provider instances that supply a resource_url.
Create an MCP provider
Use automatic registration when the authorization server advertises dynamic
client registration or HTTPS client-ID metadata documents.
Hookfish stores any registered client secret in its internal vault. The secret
is write-only and never appears in provider responses.
If automatic registration is unavailable, register the callback URL with the
server yourself and use custom credentials:
Start the connection
The dynamic provider ID becomes the authorization path:
After consent, give the connection ID to an MCP client or retrieve its token
from trusted server code. The Hookfish inspector
handles this flow interactively.
Discovery requirements
The remote server must expose OAuth protected-resource metadata that names at
least one authorization server. The authorization server must advertise an
authorization endpoint, token endpoint, issuer, and PKCE S256 support.
Hookfish reads advertised scopes from the OAuth challenge or metadata when
the dynamic provider does not configure explicit scopes.