ReadonlyfunctionsThe Lambda functions created for the OAuth endpoints.
+ReadonlymcpThe environment variables map that should be injected into the MCP RPC +handler Lambda (if you have one) so it can read MCP config at runtime.
+ReadonlynodeThe tree node.
+Returns a string representation of this construct.
+Applies one or more mixins to this construct.
+Mixins are applied in order. The list of constructs is captured at the
+start of the call, so constructs added by a mixin will not be visited.
+Use multiple with() calls if subsequent mixins should apply to added
+constructs.
The mixins to apply
+This construct for chaining
+StaticisChecks if x is a construct.
Use this method instead of instanceof to properly detect Construct
+instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the constructs library on
+disk are seen as independent, completely different libraries. As a
+consequence, the class Construct in each copy of the constructs library
+is seen as a different class, and an instance of one class will not test as
+instanceof the other class. npm install will not create installations
+like this, but users may manually symlink construct libraries together or
+use a monorepo tool: in those cases, multiple copies of the constructs
+library can be accidentally installed, and instanceof will behave
+unpredictably. It is safest to avoid using instanceof, and using
+this type-testing method instead.
Any object
+true if x is an object created from a class which extends Construct.
Convenience construct that creates an McpAuth backed by Amazon Cognito.
+It creates a dedicated Cognito user pool client configured for the +authorization code + PKCE flow and wires it into the generic McpAuth +construct. Use this when your authentication is managed by Cognito; +use McpAuth directly for other OAuth2/OIDC providers.
+const mcpAuth = new McpCognitoAuth(this, 'McpAuth', {
auth: cognitoAuthentication,
apiDomain: 'api.example.com',
authDomain: 'auth.example.com',
serverInfo: { name: 'my-mcp-server', version: '1.0.0' },
stageName: 'dev',
});
const api = new MyApiRestApi(this, 'Api', {
mcpAuth: mcpAuth.mcpAuth,
// ...
});
+ReadonlymcpThe underlying service-agnostic McpAuth construct.
+Pass this to RestApi's mcpAuth prop.
ReadonlynodeThe tree node.
+ReadonlyuserThe Cognito user pool client created for MCP connectors.
+Returns a string representation of this construct.
+Applies one or more mixins to this construct.
+Mixins are applied in order. The list of constructs is captured at the
+start of the call, so constructs added by a mixin will not be visited.
+Use multiple with() calls if subsequent mixins should apply to added
+constructs.
The mixins to apply
+This construct for chaining
+StaticisChecks if x is a construct.
Use this method instead of instanceof to properly detect Construct
+instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the constructs library on
+disk are seen as independent, completely different libraries. As a
+consequence, the class Construct in each copy of the constructs library
+is seen as a different class, and an instance of one class will not test as
+instanceof the other class. npm install will not create installations
+like this, but users may manually symlink construct libraries together or
+use a monorepo tool: in those cases, multiple copies of the constructs
+library can be accidentally installed, and instanceof will behave
+unpredictably. It is safest to avoid using instanceof, and using
+this type-testing method instead.
Any object
+true if x is an object created from a class which extends Construct.
The type definition for the API paths.
The type definition for the API operations.
-The operation IDs to add to the anonymous set.
Protectedcleanupreturn the generated Lambda function for the specified API operation
return a list of all generated Lambda functions
-Visitor method to modify the given functions
+Returns the MCP auth construct if mcpAuth was configured. +Useful for accessing the created Lambda functions or env vars.
+Visitor method to modify the given functions
the list of functions to visit
the function to call for every function
ProtectedpatchAWS does not properly apply the 'security' option to every single path-method. @@ -88,4 +91,4 @@ this type-testing method instead.
Any object
true if x is an object created from a class which extends Construct.
CDK construct that creates Lambda functions for the MCP OAuth façade. +Service-agnostic — proxies authorize/token requests to any upstream +OAuth2/OIDC provider.
+Use with
+RestApiby passingmcpAuthprop, which auto-injects the +required paths into the OpenAPI spec and wires Lambda integrations.Example
+ +