Repository navigation
feat: add b2b_ecommerce example for auth0-ai-fastmcp - #175
kishore7snehil wants to merge 3 commits into
Conversation
3ee51ae to
ed71bf7
Compare
|
|
||
| async def on_call_tool(self, context: MiddlewareContext, call_next): | ||
| principal = get_caller_principal() | ||
| logger.info("tool=%s caller=%s", context.message.name, principal.sub if principal else None) |
There was a problem hiding this comment.
context.message.name is chosen by the client, and %s writes it as it is. A caller can send a tool name with a new line in it, and the log gets a second line that looks real. With a token that has no scope, I sent the name whoami\naudit INFO tool=cancel_and_refund_order caller=auth0|alice and the log got audit INFO tool=cancel_and_refund_order caller=auth0|alice caller=auth0|bob.
Can we use tool=%r here? principal.sub comes from the verified token, so %s is fine for it.
| Use b2b-ecommerce to run an order status report for ORD-1042 again. | ||
| ``` | ||
|
|
||
| The first prompt opens a browser to log in and approve access. After that the tool runs, and |
There was a problem hiding this comment.
The setup stops at claude mcp add, so I do not think the first prompt opens a browser. Claude Code shows the server as needing authentication, and the sign in is a separate step: /mcp and then Authenticate, or claude mcp login b2b-ecommerce in a shell. I did not run Claude Code live, I took this from its docs and CLI help.
Can we add this step after claude mcp add and reword this line? The #172 README has the same text.
| has to be `MCP_RESOURCE_URL` plus `/mcp`. | ||
|
|
||
| ```bash | ||
| auth0 apis create --name "B2B Ecommerce MCP" --identifier "http://localhost:3002/mcp" --signing-alg RS256 |
There was a problem hiding this comment.
In a terminal, auth0 apis create asks for token lifetime, offline access and a few more values when their flags are missing. I read this in the v1.39.0 source and in auth0 apis create --help, as I could not run it without a login. So each of the nine commands may stop at five or six prompts.
Can we add --no-input to these commands, or one line above the block to press Enter at the prompts?
| --data '{"client_id":"YOUR_OBO_CLIENT_ID","audience":"https://analytics.api/","scope":["read:analytics"]}' | ||
| ``` | ||
|
|
||
| The OBO client also needs `client_credentials` in its grant types. The CLI's `apps update` has |
There was a problem hiding this comment.
auth0 apps update does have an option for this in v1.39.0. It is --grants, and auth0 apps update --help lists it. The better reason for the Management API is different: --grants replaces the full list, and it only knows the CLI's own grant names.
Can we say that here? The #172 README has the same sentence.
There was a problem hiding this comment.
You're right that --grants exists. The reason for the Management API is that --grants replaces the whole list, and any current grant the CLI has no name for would be dropped. The text now says that. Fixed in bdafc92.
1cdf42a to
43e7f5a
Compare
ed71bf7 to
14a7f6b
Compare
43e7f5a to
aaacf22
Compare
14a7f6b to
bdafc92
Compare
aaacf22 to
afbcbf5
Compare
bdafc92 to
78d92a7
Compare
📋 Changes
Adds
examples/b2b_ecommerce, an MCP server for a pretend online store built on FastMCP that runs against a live Auth0 tenant. It showsauth0-ai-fastmcpend to end, with the store's tools returning one-line messages while token checks and exchanges are real. This PR is stacked on #174.✨ Features
token_storethat shows bothstrictandnon_strictscope matching.Auth0FastMCPwired into aFastMCPserver with itsproviderandmiddleware.whoamitool, a gated resource and a gated prompt, plus a middleware that logs the caller of each tool call.📖 Documentation
The example
README.mdlists the services and tools, then gives the Auth0 CLI steps for the tenant, how to run it, how to add a service and tool, optional organization mode, and troubleshooting. Links to the package guides resolve once those land in a follow-up PR.🧪 Testing
The example needs a live Auth0 tenant, so it has no automated tests.
ruff checkpasses.Contributor Checklist