It does an oauth redirect flow and the client stores the access token and sends it with requests after.

I have built a couple using the spec from a month ago. It works alright.

A lot of bad decisions are in the official implementations. For instance not using native Request / Response types in node, so you’re forced to write a bunch of garbage code to convert it, or install express just to use an mcp server.

If I had the time I’d really make my own mcp implementation in typescript at least.

I find most of the implementations to be so over engineered and abstracted on what could be simple function calls on top of the built in language

For simple stuff like a json file that returns the location of your auth routes, you need to add a “middleware”

When in reality you can just make a route and explicitly return that information.

Every piece is some new abstraction it feels vibe coded.