Sstateless auth

[cranberyxl]

Important: Please ensure your pull request is targeting the canary branch. PRs to other branches may be closed or require retargeting.

⚠️ If you are updating documentation or the site, please target the main branch instead of canary.

Summary

StatelessStreamableHTTPTransport doesn't support auth, bring it up to date with modelcontextprotocol/typescript-sdk#399 so that auth works in the next.js adapter.

This makes sure that extra.authInfo is passed to the handler if req.auth is populated.

Type of Change

• Bug fixing
• [*] Adding a feature
• Improving documentation
• Adding or updating examples
• Performance - bundle size improvement (if applicable)

Affected Packages

• [*] xmcp (core framework)
• create-xmcp-app
• init-xmcp
• Documentation
• Examples

Screenshots/Examples

---

Note

Adds stateless auth propagation and aligns HTTP transport with MCP SDK.

• BaseHttpServerTransport now implements Transport; onmessage accepts MessageExtraInfo and HTTP handleRequest expects IncomingMessage & { auth?: AuthInfo }
• StatelessHttpServerTransport reads req.auth and forwards as extra.authInfo via onmessage(message, { authInfo }) for all messages

^{Written by Cursor Bugbot for commit 757ac6b. This will update automatically on new commits. Configure here.}

[vercel]

@cranberyxl is attempting to deploy a commit to the xmcp Team on Vercel.

A member of the Team first needs to authorize it.