LeanMCP vs MCP SDK

// Official MCP SDK - works fine for basics
const server = new McpServer({ name: "my-server" });
server.tool("hello", "Say hello", { name: z.string() }, async ({ name }) => {
  return { content: [{ type: "text", text: `Hello, ${name}!` }] };
});

// LeanMCP - also simple
@Tool({ description: "Say hello" })
hello(input: { name: string }) {
  return `Hello, ${input.name}!`;
}

// You have to build everything yourself:
// 1. JWT validation
// 2. JWKS fetching and caching
// 3. Token extraction from requests
// 4. Scope validation
// 5. Error handling
// 6. Refresh token logic
// 7. Provider-specific quirks

import jwt from 'jsonwebtoken';
import jwksClient from 'jwks-rsa';

const client = jwksClient({
  jwksUri: 'https://your-provider/.well-known/jwks.json',
  cache: true,
  rateLimit: true,
});

function getKey(header, callback) {
  client.getSigningKey(header.kid, (err, key) => {
    const signingKey = key?.getPublicKey();
    callback(null, signingKey);
  });
}

async function validateToken(token: string) {
  return new Promise((resolve, reject) => {
    jwt.verify(token, getKey, {
      issuer: 'https://your-provider/',
      audience: 'your-audience',
    }, (err, decoded) => {
      if (err) reject(err);
      else resolve(decoded);
    });
  });
}

// ... 500+ more lines for middleware, error handling, 
// scope checking, provider setup, etc.

import { AuthProvider, Authenticated } from "@leanmcp/auth";

const auth = new AuthProvider('clerk', {
  secretKey: process.env.CLERK_SECRET_KEY!
});

await auth.init();

@Authenticated(auth)
export class MyService {
  @Tool({ description: "Protected tool" })
  async getData() {
    // authUser available automatically
    return { userId: authUser.sub };
  }
}

// ❌ DANGEROUS: Don't do this!
@Tool({ description: "Login" })
async login() {
  const token = await elicit({
    message: "Enter your API token",
    schema: { token: { type: "string" } }
  });
  
  // Now both client AND server have seen the token
  // If client is compromised, token is exposed
}