{"ref":"artifact:arc-mcp-xsuaa-auth","page":"/artifacts/arc-mcp-xsuaa-auth","json":"/artifacts/arc-mcp-xsuaa-auth.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"arc-mcp-xsuaa-auth","name":"@arc-mcp/xsuaa-auth","artifact_type":"package","ecosystem":"btp","domain":"security-and-compliance","secondary_domains":["ai-and-agents"],"origin_ring":"independent","description":{"one_line":"The client-to-server authentication stack for an MCP server on SAP BTP: an XSUAA OAuth proxy, dynamic client registration, a chained bearer verifier, and a separate entrypoint for per-user principal propagation.","short":"XSUAA authentication stack for an MCP server on SAP BTP","what_it_solves":"An MCP server deployed to Cloud Foundry has [XSUAA](artifact:btp-authorization-and-trust-management) at the other end of the client's OAuth flow, and the awkward parts are the ones nobody wants to write twice: the `/authorize` redirect-URI shim, XSUAA's un-encoded `+` in the OAuth `state`, and RFC 7591 dynamic client registration that survives a restart. `setupHttpAuth` composes those onto an Express application and returns the bearer middleware for the `/mcp` route, and the same primitives are exported for a server that wires them itself. Verification is a chain of XSUAA, OIDC and API key, each optional, and the scope policy is injected as a hook that the package never owns. The `./btp` entrypoint is where a verified token becomes SAP identity: it resolves a [destination](artifact:btp-destination) with the user's own JWT and returns the credentials and a proxy descriptor for the [Cloud Connector](artifact:sap-cloud-connector), leaving the header assembly to the caller. It was extracted from [arc-1](artifact:arc-mcp-arc-1)'s auth stack, which the README names beside [calmcp](artifact:consetto-calmcp) and [LISA](artifact:clementringot-lisa) as the servers it was shaped to fit.","when_not_to_use":"It stops at the `AuthInfo` and the raw bearer token, and the README lists what stays with the consuming server: rate limiting, the scope and tool policy, the MCP transport, the SAP HTTP client's headers, and helmet-style hardening. The one piece of hardening it constrains rather than defers is the cross-origin opener policy, which it deliberately leaves unset because popup-based OAuth breaks under it. It is ESM-only on Node 22 or later and shares the host's Express and MCP SDK instances as peer dependencies, so a server on Express 4 cannot take it."},"links":{"repo":"https://github.com/arc-mcp/xsuaa-auth","npm":"https://www.npmjs.com/package/@arc-mcp/xsuaa-auth"},"identity":{"author":"Marian Zeis","license":"MIT"},"source_available":true,"provides":[{"capability":"capability:authentication","what_it_does":"Puts the XSUAA OAuth flow, dynamic client registration and bearer verification in front of an MCP server's HTTP route, and maps the verified user to their own SAP identity through a destination rather than a shared service account.","facets":[{"key":"propagates_user","value":true,"source":{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README","checked":"2026-10-15","quote":"The `./btp` entrypoint maps the authenticated MCP user to their own SAP identity via the BTP Destination Service + Cloud Connector."}}],"sources":[{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README","checked":"2026-09-20","quote":"It gives an MCP server the SAP-native client→server auth stack"},{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README","checked":"2026-09-20","quote":"entrypoint adds **per-user principal propagation** via the BTP Destination Service + Cloud Connector."}]}],"requires":[{"ref":"artifact:btp-authorization-and-trust-management","requirement":"required","for":"the bound XSUAA service instance whose credentials and application URL the facade reads from the environment, and the authorization server the OAuth proxy fronts","sources":[{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README","checked":"2026-09-20","quote":"`loadXsuaaCredentials()` and `resolveAppUrl()` read the bound XSUAA service and the public route straight from the environment"}]},{"ref":"artifact:btp-destination","requirement":"conditional","condition":"the `./btp` entrypoint is used, which is the per-user principal propagation path; a server that only verifies bearer tokens never reaches it","for":"the destination the entrypoint looks up with the verified user JWT to obtain the per-user tokens","sources":[{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README","checked":"2026-09-20","quote":"The `./btp` entrypoint maps the authenticated MCP user to their own SAP identity via the BTP Destination Service + Cloud Connector."}]},{"ref":"artifact:sap-cloud-connector","requirement":"conditional","condition":"the propagated user reaches an on-premise system, for which the `./btp` entrypoint returns a connectivity proxy descriptor the caller applies","for":"the route from Cloud Foundry into the customer network that the returned `BTPProxyConfig` points at","sources":[{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README","checked":"2026-09-20","quote":"`createConnectivityProxy(cfg, locationId?, logger?)` | A `BTPProxyConfig` descriptor for the Cloud Connector connectivity proxy."}]},{"ref":"artifact:sap-xssec","for":"XSUAA token validation and security context, which the package consumes internally for its XSUAA verifier.","requirement":"required","basis":"binding","role":"dependency","sources":[{"url":"https://github.com/arc-mcp/xsuaa-auth","title":"xsuaa-auth README","checked":"2026-10-18","quote":"`@sap/xssec` and `@sap-cloud-sdk/connectivity` are regular dependencies and install automatically."}]},{"ref":"artifact:btp-connectivity","for":"reading the connectivity binding from VCAP_SERVICES so the Cloud Connector proxy descriptor can be built.","requirement":"conditional","condition":"the ./btp entrypoint is used for per-user principal propagation via Cloud Connector","basis":"binding","role":"principal-propagation","sources":[{"url":"https://github.com/arc-mcp/xsuaa-auth","title":"xsuaa-auth README","checked":"2026-10-18","quote":"Build a `BTPConfig` from `VCAP_SERVICES` (XSUAA + destination + connectivity bindings)."}]},{"ref":"artifact:sap-cloud-sdk-connectivity","for":"destination lookup and the connectivity proxy that the package's BTP entrypoint builds on.","requirement":"required","basis":"binding","role":"dependency","sources":[{"url":"https://github.com/arc-mcp/xsuaa-auth","title":"xsuaa-auth README","checked":"2026-10-18","quote":"`@sap/xssec` and `@sap-cloud-sdk/connectivity` are regular dependencies and install automatically."}]}],"maintainers":["actor:arc-mcp","actor:marianfoo"],"compat":{"runtimes":["node"],"deployment":["cf"]},"type_properties":{"distribution":{"value":["npm"],"sources":[{"url":"https://github.com/arc-mcp/xsuaa-auth","title":"@arc-mcp/xsuaa-auth — README","checked":"2026-10-18","quote":"npm install @arc-mcp/xsuaa-auth"}]}},"provenance":{"discovered_via":[{"source":"source:github","channel":"arc-mcp"}],"first_seen":"2026-09-18"},"drafted_with_ai":true,"contributors":["actor:geert-janklaps","actor:marianfoo"],"history":[{"date":"2026-10-15","field":"provides[capability:authentication].facets","from":null,"to":"propagates_user","reason":"The BTP door now compares its authentication options on whether the signed-in identity reaches the next system. The README's sentence about the `./btp` entrypoint states it for this package, and it was read again on this date."}]},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"good","evidence":"released this month"},{"label":"Continuity","tier":"good","evidence":"6 contributors, 1 publisher, org-owned"},{"label":"Repository","tier":"good","evidence":"pushed 2026-10, not archived"}],"compatibility":[{"label":"Declared for","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Survived majors","tier":"unknown","evidence":"no BTP release lines in the atlas"},{"label":"Maintainer's CI","tier":"good","evidence":"CI green, 2026-10-23"}],"practice":[{"label":"Tests","tier":"good","evidence":"26 test files, npm test"},{"label":"Docs","tier":"good","evidence":"docs/ with 8 pages, README 31 KB"},{"label":"Changelog","tier":"good","evidence":"CHANGELOG in the repo"}],"reach":[{"value":2455,"unit":"installs/week"},{"value":3,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-24","latest_version":"1.2.0","majors":{"1":{"version":"1.0.0","date":"2026-07-23"},"0.1":{"version":"0.1.0","date":"2026-06-17"}},"license":"MIT","first_release":"2026-06-17","last_release":"2026-10-23","releases":13,"cadence_days":4,"maintainers":1,"repository":"git+https://github.com/arc-mcp/xsuaa-auth.git","repository_directory":null,"peer_cds":null,"dependencies":2,"node_engine":">=22","test_script":true,"types":false,"downloads_weekly":2455,"downloads_monthly":8715,"stars":3,"forks":4,"open_issues":3,"archived":false,"pushed_at":"2026-10-23","license_spdx":"MIT","org_owned":true,"default_branch":"main","created_at":"2026-06-17T19:09:45Z","open_prs":2,"tree_truncated":false,"test_files":26,"workflows":4,"other_ci":false,"readme_bytes":31660,"docs_files":8,"changelog":true,"license_file":true,"dts_files":0,"first_commit":"2026-06-17","last_commit":"2026-10-23","commits":77,"contributors":6,"ci_status":"success","ci_run_at":"2026-10-23","ci_workflow":"CI","ci_event":"push","readme_path":"README.md","readme_sha":"338bec0394a8da572139951b734dd75dc040e212","months_since_release":0,"dormant":false,"repo_read":"2026-10-24"},"release_notes":{"license":"MIT","quotable":true,"source":{"kind":"npm","path":"CHANGELOG.md","version":"1.2.0","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md"},"format":"conventional","releases":[{"version":"1.2.0","date":"2026-10-23","date_source":"heading","heading":"1.2.0 (2026-10-23)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#120-2026-10-23","sections":[{"kind":"feature","heading":"Features","items":1},{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"94562b0c007284e6"},{"version":"1.1.1","date":"2026-10-22","date_source":"heading","heading":"1.1.1 (2026-10-22)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#111-2026-10-22","sections":[{"kind":"fix","heading":"Bug Fixes","items":2}],"hash":"8901e1e86cdce55e"},{"version":"1.1.0","date":"2026-09-17","date_source":"heading","heading":"1.1.0 (2026-09-17)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#110-2026-09-17","sections":[{"kind":"feature","heading":"Features","items":1}],"hash":"69917cb225f355c5"},{"version":"1.0.2","date":"2026-08-10","date_source":"heading","heading":"1.0.2 (2026-08-10)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#102-2026-08-10","sections":[{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"9231b0a8914312d1"},{"version":"1.0.1","date":"2026-07-27","date_source":"heading","heading":"1.0.1 (2026-07-27)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#101-2026-07-27","sections":[{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"549696d6fc2a357b"},{"version":"1.0.0","date":"2026-07-23","date_source":"heading","heading":"1.0.0 (2026-07-23)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#100-2026-07-23","sections":[{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"c7c191414c8ee367"},{"version":"0.1.8","date":"2026-07-20","date_source":"heading","heading":"0.1.8 (2026-07-20)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#018-2026-07-20","sections":[{"kind":"feature","heading":"Features","items":4},{"kind":"fix","heading":"Bug Fixes","items":5}],"hash":"b15c955bb934b9e3"},{"version":"0.1.7","date":"2026-07-20","date_source":"heading","heading":"0.1.7 (2026-07-20)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#017-2026-07-20","sections":[{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"f51556e75b96aaee"},{"version":"0.1.6","date":"2026-07-19","date_source":"heading","heading":"0.1.6 (2026-07-19)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#016-2026-07-19","sections":[{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"471cf6b1de3d224a"},{"version":"0.1.5","date":"2026-07-17","date_source":"heading","heading":"0.1.5 (2026-07-17)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#015-2026-07-17","sections":[{"kind":"feature","heading":"Features","items":1}],"hash":"1f7450fc36964d9d"},{"version":"0.1.4","date":"2026-06-26","date_source":"heading","heading":"0.1.4 (2026-06-26)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#014-2026-06-26","sections":[{"kind":"feature","heading":"Features","items":1},{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"128938d737878041"},{"version":"0.1.3","date":"2026-06-18","date_source":"heading","heading":"0.1.3 (2026-06-18)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#013-2026-06-18","sections":[{"kind":"feature","heading":"Features","items":1}],"hash":"1f6b8286be072110"},{"version":"0.1.2","date":"2026-06-17","date_source":"heading","heading":"0.1.2 (2026-06-17)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#012-2026-06-17","sections":[{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"8de922f76cb4bf66"},{"version":"0.1.1","date":"2026-06-17","date_source":"heading","heading":"0.1.1 (2026-06-17)","url":"https://github.com/arc-mcp/xsuaa-auth/blob/main/CHANGELOG.md#011-2026-06-17","sections":[{"kind":"feature","heading":"Features","items":1},{"kind":"fix","heading":"Bug Fixes","items":1}],"hash":"0036f5f7fbf2b7af"}],"versions":[{"version":"1.2.0","date":"2026-10-23"},{"version":"1.1.1","date":"2026-10-22"},{"version":"1.1.0","date":"2026-09-17"},{"version":"1.0.2","date":"2026-08-10"},{"version":"1.0.1","date":"2026-07-27"},{"version":"1.0.0","date":"2026-07-23"},{"version":"0.1.8","date":"2026-07-20"},{"version":"0.1.6","date":"2026-07-19"},{"version":"0.1.5","date":"2026-07-17"},{"version":"0.1.4","date":"2026-06-26"},{"version":"0.1.3","date":"2026-06-18"},{"version":"0.1.2","date":"2026-06-17"},{"version":"0.1.0","date":"2026-06-17"}],"crawled_at":"2026-10-25"},"edges":{"maintainers":[{"ref":"actor:arc-mcp","name":"ARC MCP","json":"/actors/arc-mcp.json"},{"ref":"actor:marianfoo","name":"Marian Zeis","json":"/actors/marianfoo.json"}],"contributors":[{"ref":"actor:geert-janklaps","name":"Geert-Jan Klaps","json":"/actors/geert-janklaps.json"},{"ref":"actor:marianfoo","name":"Marian Zeis","json":"/actors/marianfoo.json"}],"explained_by":[],"alternative_to_this":[],"needed_by":[{"ref":"artifact:clementringot-lisa","name":"LISA","json":"/artifacts/clementringot-lisa.json","requirement":"required"},{"ref":"artifact:clementringot-rosa","name":"ROSA","json":"/artifacts/clementringot-rosa.json","requirement":"conditional","role":"authentication","condition":"XSUAA auth mode is active"}],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}