feat(auth-middleware): add example MCP server with JWT and API key

[yasomaru]

This commit introduces a new example demonstrating the integration of authentication middleware with an MCP server. The server supports both JWT token and API key authentication, along with scope-based access control for various MCP tools. Key features include token generation endpoints, in-memory API key storage, and a health check endpoint.

New files added:

• main.go: Implements the MCP server and authentication logic.
• go.mod and go.sum: Manage dependencies for the project.
• README.md: Provides setup instructions, available endpoints, and example usage.

This example serves as a reference for implementing secure access to MCP tools.

Fixes #330

[wagnerjt]

Amazing, Cheers for this! Just one thing -- with the 0.3.0 release, there are a few breaking changes to this example. With a few minor tweaks around the CallToolResultFor it should just work :)

[yasomaru]

@wagnerjt
Thank you for the feedback! You're absolutely right about the breaking changes in the 0.3.0 release.
I've already updated the auth-middleware example to work with the new MCP SDK types.

[wagnerjt]

Unfortunately I'm not a maintainer of this repo to approve this. Just wanted to give you a heads up and again, nice example @yasomaru!

[findleyr]

Thanks! We'll review shortly. If @jba can't review today, I'll review :)

[jba]

This is awesome! Thanks so much for doing this and validating (no pun intended) the server-side auth design.

Is there anything we're missing? Something in the auth package you wish we had?

[yasomaru]

@jba

This is awesome! Thanks so much for doing this and validating (no pun intended) the server-side auth design.

Is there anything we're missing? Something in the auth package you wish we had?

Thank you for the kind words!
After implementing this example, I have a few thoughts on the auth package

1. Scope Validation Helpers
   Maybe some utility functions for common scope checking patterns? Something like

func HasScope(tokenInfo *TokenInfo, requiredScope string) bool

func HasAnyScope(tokenInfo *TokenInfo, requiredScopes []string) bool

func HasAllScopes(tokenInfo *TokenInfo, requiredScopes []string) bool

2. Token Expiration Utilities
   Helper functions for common expiration checks

func IsExpired(tokenInfo *TokenInfo) bool

func TimeUntilExpiration(tokenInfo *TokenInfo) time.Duration

But ,the current design is already quite solid and covers the main use cases really well.

[jba]

Thanks for those suggestions. I'm glad the core design is sound.
Usually we don't provide simple helpers like that unless they are hard or tricky to write, and I don't think any of those are.