Class OagMcpService

Readonlybroker

Readonlyconfig

Readonlyexecutor

Readonlyindex

Readonlyinfo

Readonlylogs

Readonlypolicy

ReadonlyworkspaceDir

apiClasses

• apiClasses(): string[]

  Names of API classes visible to a principal (for tool descriptions).

  Returns string[]

  class names

execute

• execute(input: ExecuteInput, ctx: CallContext): Promise<ExecuteOutput>

  Run the execute tool: admit the call, check the code, run it in the sandbox, then audit and report the outcome.

  Parameters

  • input: ExecuteInput

    execute input

  • ctx: CallContext

    call context

  Returns Promise<ExecuteOutput>

  execute output

search

• search(input: SearchInput, ctx: CallContext): Record<string, unknown>

  Run the search tool: describe one method by id, search by query, or browse the APIs, showing only methods the caller may call.

  Parameters

  • input: SearchInput

    search input

  • ctx: CallContext

    call context

  Returns Record<string, unknown>

  search output

warmUp

• warmUp(): void

  Warm caches (type checker) in the background.

  Returns void

Staticcreate

• create(
      opts: {
          config: {
              authorization?: {
                  default: "allow" | "deny";
                  rules: {
                      allow: string[];
                      clientIds?: string[];
                      deny: string[];
                      id: string;
                      principals?: string[];
                      scopes?: string[];
                  }[];
              };
              execution: {
                  denoPath?: string;
                  maxCodeBytes: number;
                  maxConcurrent: number;
                  maxLogBytes: number;
                  maxQueue: number;
                  maxResultBytes: number;
                  maxSdkCalls: number;
                  maxTimeoutMs: number;
                  memoryMb: number;
                  timeoutMs: number;
                  typecheck: boolean;
              };
              http: {
                  allowedHosts: string[];
                  allowedOrigins: string[];
                  host: string;
                  maxBodyBytes: number;
                  path: string;
                  port: number;
                  publicUrl?: string;
              };
              logging: {
                  auditFailClosed?: boolean;
                  auditFile?: string;
                  file?: string;
                  format?: "json"
                  | "pretty";
                  level?:
                      | "info"
                      | "warn"
                      | "error"
                      | "fatal"
                      | "debug"
                      | "trace"
                      | "silent";
              };
              mcpAuth: {
                  mode: "oauth"
                  | "static-bearer"
                  | "none";
                  oauth?: {
                      algorithms: string[];
                      allowInsecureIssuer: boolean;
                      audience?: string[];
                      clockToleranceSec: number;
                      introspection?: {
                          clientId: { env: string } | { secret: string };
                          clientSecret: { env: string } | { secret: string };
                          endpoint: string;
                      };
                      issuer: string;
                      jwksUri?: string;
                      principalIdKey?: { env: string }
                      | { secret: string };
                      requiredScopes: string[];
                      resource?: string;
                      scopesSupported?: string[];
                  };
                  staticBearer?: {
                      tokens: {
                          principal: string;
                          scopes: string[];
                          token: { env: string }
                          | { secret: string };
                      }[];
                  };
                  stdio: { principal: string; scopes: string[] };
              };
              upstream: {
                  allowedOrigins: string[];
                  baseUrl?: string;
                  followRedirects: boolean;
                  maxRedirects: number;
                  maxRequestBytes: number;
                  maxResponseBytes: number;
                  timeoutMs: number;
              };
              upstreamAuth: {
                  allowInsecureTokenUrl: boolean;
                  provider: "service-identity";
                  schemes: Record<
                      string,
                      {
                          apiKey?: { env: string }
                          | { secret: string };
                          audience?: string;
                          clientAuthMethod?: "client_secret_basic" | "client_secret_post";
                          clientId?: { env: string } | { secret: string };
                          clientSecret?: { env: string } | { secret: string };
                          password?: { env: string } | { secret: string };
                          scopes?: string[];
                          token?: { env: string } | { secret: string };
                          tokenUrl?: string;
                          username?: { env: string } | { secret: string };
                      },
                  >;
                  secretsFile?: string;
              };
          };
          configBaseDir: string;
          executor?: Executor;
          fetchImpl?: (
              input: string | URL | Request,
              init?: RequestInit,
          ) => Promise<Response>;
          logs: Logs;
          prepared: PreparedSdk;
      },
  ): Promise<OagMcpService>

  Assemble the runtime around a prepared SDK: credential provider, authorization policy, request broker, Deno executor (verified by loading the bundle with every binding) and the type checker.

  Parameters

  • opts: {
        config: {
            authorization?: {
                default: "allow" | "deny";
                rules: {
                    allow: string[];
                    clientIds?: string[];
                    deny: string[];
                    id: string;
                    principals?: string[];
                    scopes?: string[];
                }[];
            };
            execution: {
                denoPath?: string;
                maxCodeBytes: number;
                maxConcurrent: number;
                maxLogBytes: number;
                maxQueue: number;
                maxResultBytes: number;
                maxSdkCalls: number;
                maxTimeoutMs: number;
                memoryMb: number;
                timeoutMs: number;
                typecheck: boolean;
            };
            http: {
                allowedHosts: string[];
                allowedOrigins: string[];
                host: string;
                maxBodyBytes: number;
                path: string;
                port: number;
                publicUrl?: string;
            };
            logging: {
                auditFailClosed?: boolean;
                auditFile?: string;
                file?: string;
                format?: "json"
                | "pretty";
                level?:
                    | "info"
                    | "warn"
                    | "error"
                    | "fatal"
                    | "debug"
                    | "trace"
                    | "silent";
            };
            mcpAuth: {
                mode: "oauth"
                | "static-bearer"
                | "none";
                oauth?: {
                    algorithms: string[];
                    allowInsecureIssuer: boolean;
                    audience?: string[];
                    clockToleranceSec: number;
                    introspection?: {
                        clientId: { env: string } | { secret: string };
                        clientSecret: { env: string } | { secret: string };
                        endpoint: string;
                    };
                    issuer: string;
                    jwksUri?: string;
                    principalIdKey?: { env: string }
                    | { secret: string };
                    requiredScopes: string[];
                    resource?: string;
                    scopesSupported?: string[];
                };
                staticBearer?: {
                    tokens: {
                        principal: string;
                        scopes: string[];
                        token: { env: string }
                        | { secret: string };
                    }[];
                };
                stdio: { principal: string; scopes: string[] };
            };
            upstream: {
                allowedOrigins: string[];
                baseUrl?: string;
                followRedirects: boolean;
                maxRedirects: number;
                maxRequestBytes: number;
                maxResponseBytes: number;
                timeoutMs: number;
            };
            upstreamAuth: {
                allowInsecureTokenUrl: boolean;
                provider: "service-identity";
                schemes: Record<
                    string,
                    {
                        apiKey?: { env: string }
                        | { secret: string };
                        audience?: string;
                        clientAuthMethod?: "client_secret_basic" | "client_secret_post";
                        clientId?: { env: string } | { secret: string };
                        clientSecret?: { env: string } | { secret: string };
                        password?: { env: string } | { secret: string };
                        scopes?: string[];
                        token?: { env: string } | { secret: string };
                        tokenUrl?: string;
                        username?: { env: string } | { secret: string };
                    },
                >;
                secretsFile?: string;
            };
        };
        configBaseDir: string;
        executor?: Executor;
        fetchImpl?: (
            input: string | URL | Request,
            init?: RequestInit,
        ) => Promise<Response>;
        logs: Logs;
        prepared: PreparedSdk;
    }

    options

  Returns Promise<OagMcpService>

  service