Modules
Model Context Protocol (MCP) for Elixir — server and client.
Accepts a raw API key presented as a bearer token.
Tries several verifiers in order and takes the first success.
Client-side authorization strategy for the Streamable HTTP transport.
Built-in compound JWT verifier for dual-auth MCP tokens.
Audience-checking JWT verifier for an MCP mount.
OAuth 2.1 client strategy for MCP Streamable HTTP: discovery (RFC 9728
protected-resource metadata → RFC 8414 / OIDC authorization-server
metadata), PKCE S256 authorization-code flow with the RFC 8707 resource
parameter, token refresh, and insufficient_scope step-up.
Serves the RFC 9728 protected-resource metadata document MCP clients use to discover your authorization server
Canonical resource identifiers (RFC 8707 / RFC 9728).
OAuth 2.1 authorization-server facade for MCP hosts.
Trade a host API key for a short-lived, audience-bound access token —
POST /api/mcp/token.
The authorization endpoint (RFC 6749 §4.1.1, OAuth 2.1) and the consent decision that goes with it.
Client-ID Metadata Documents: a client_id that is itself an https URL serving
the client's own metadata.
Default CIMD fetcher, over :req. Used automatically when :req is in your
deps; pass cimd: [fetcher: ...] to substitute anything else.
An OAuth client of this authorization server, and the validation that admits one.
Validated configuration for the authorization-server facade — the struct every
plug in Noizu.MCP.Auth.Server receives.
Consent policy and the default consent screen.
OAuth error codes and rendering (RFC 6749 §4.1.2.1/§5.2, RFC 7591 §3.2.2, RFC 8707 §2, RFC 6750 §3.1).
The JWKS document — GET /oauth/jwks. RS256 mode only.
RFC 8414 authorization-server metadata, aliased at
/.well-known/openid-configuration.
PKCE (RFC 7636), S256 only.
Parameter extraction for the OAuth endpoints.
Shared plumbing for the authorization-server endpoints: parameter reading,
client authentication, uniform error rendering, cache-control: no-store,
CORS, and the rate-limit hook.
Redirect-URI validation and matching (RFC 6749 §3.1.2, RFC 8252, OAuth 2.1).
RFC 7591 dynamic client registration — POST /oauth/register.
Token revocation (RFC 7009) — POST /oauth/revoke.
One forward for the whole authorization server.
Guards for the one place the authorization server fetches a URL a client
chose: the CIMD (client-id metadata document) fetch, where client_id is
itself an https URL the server dereferences.
Secret generation, hashing and constant-time comparison for the authorization-server facade.
Persistence contract for the authorization-server facade.
An issued access token, tracked only when track_access_tokens: true.
jti is raw on the way in; the adapter stores its hash. Tracking buys
immediate revocation; not tracking means a token is good until it expires,
which is why the TTL ceiling is 15 minutes.
A pending authorization code. code is raw on the way in and is never
stored; the adapter persists Secret.token_hash(code).
A recorded grant of scope by a subject to a client. Unique on
{subject, client_id}; scope is the union granted so far, so a request for
a scope outside it re-prompts (the spec's confused-deputy requirement).
In-memory Noizu.MCP.Auth.Server.Store adapter.
Postgres Noizu.MCP.Auth.Server.Store adapter, in raw SQL.
A refresh token. token is raw on the way in and never stored.
The token endpoint — POST /oauth/token. Two grants:
authorization_code and refresh_token.
Minting: access tokens (signed JWTs), refresh tokens and authorization codes (opaque random, hashed at rest).
How the authorization server authenticates the human.
The default Noizu.MCP.Auth.Server.Upstream: reuse the host application's
existing login.
Optional fallback Noizu.MCP.Auth.Server.Upstream: run an OIDC
authorization-code round trip against the IdP ourselves.
Fixed bearer-token auth strategy: {Noizu.MCP.Auth.Static, token: "..."}.
A 401 is terminal — there is nothing to refresh.
Server-side bearer-token verification for the Streamable HTTP transport.
Parse and format WWW-Authenticate challenges (RFC 9110 §11.6.1), as used
by the MCP authorization spec to point clients at protected-resource
metadata and signal insufficient_scope step-up.
MCP client: connect to an MCP server over a transport and call its tools, resources, and prompts.
Callbacks for server-initiated MCP traffic on the client side.
Telemetry events emitted by Noizu.MCP.Client.
Per-request handler context.
A tailored description: one string chosen per render context, with gap-fill interpolation for verbosity levels that no variant covers and — for weak harnesses/models — per-runner/model overrides (spec §3).
Protocol-level MCP / JSON-RPC error.
Inline @eval annotations for description tuning (spec §4).
Core of the mix noizu.mcp.eval description-tuning harness (spec §4).
Behaviour for grading a single rubric criterion against a transcript (spec §4).
Deterministic no-LLM judge for tests and CI (spec §4).
Behaviour for executing an eval prompt against a target (spec §4).
Deterministic no-LLM runner for tests and CI (spec §4).
A compiled eval specification attached to a tool (spec §4).
Interactive HTML inspector for MCP servers — the engine behind
mix mcp.client. Starts a localhost-only Bandit endpoint serving a
single-page UI plus a JSON/SSE bridge to Noizu.MCP.Client sessions.
Noizu.MCP.Client.Handler for the inspector: server-initiated sampling and
elicitation requests are parked in the inspector session and surfaced in the
browser (Pending tab), blocking until a human answers. Roots come from the
session's editable roots list.
HTTP surface of the inspector: serves the single-page UI from
priv/inspector/ and a JSON + SSE bridge to inspector sessions.
One inspector session: owns a Noizu.MCP.Client connected to the target
server (through Noizu.MCP.Inspector.TapTransport), buffers an event stream
for the browser (raw frames, notifications, progress, async call results,
pending sampling/elicitation requests), and parks server-initiated requests
until a human answers them in the UI.
Transport decorator used by the inspector: wraps a real client transport and
mirrors every wire frame to the inspector session as
{:inspector_frame, :tx | :rx, binary} so the UI can show raw JSON-RPC
history without touching Noizu.MCP.Client.
JSON-RPC 2.0 framing for MCP.
A JSON-RPC error response.
A JSON-RPC notification (no response expected).
An inbound or outbound JSON-RPC request (expects a response).
A successful JSON-RPC response.
Sans-IO MCP session core, shared by server sessions and client connections.
Compile-time registry of MCP methods: kind (request/notification) and direction (client→server, server→client, or both).
Protocol version negotiation.
Render context threaded through every description render site.
JSON Schema validation (2020-12, MCP's default dialect) backed by JSV.
Define an MCP server.
Buffer for Streamable HTTP messages that had no live stream to deliver to,
enabling SSE resumability via Last-Event-ID.
Prompts feature plumbing: the helpers behind the generated
handle_list_prompts/2 and handle_get_prompt/3 defaults.
Resources feature plumbing: the helpers behind the generated
handle_list_resources/2, handle_list_resource_templates/2,
handle_read_resource/2, and handle_subscribe/2 defaults.
Tools feature plumbing: the helpers behind the generated
handle_list_tools/2 and handle_call_tool/3 defaults.
Define an MCP prompt as a module.
Define an MCP resource as a module.
Define an MCP resource template (RFC 6570 {var} URIs) as a module.
One MCP session: a GenServer owning the protocol state (Noizu.MCP.Peer)
for a single connected client.
Supervision tree for one logical MCP server: a session registry, a dynamic
supervisor for per-client sessions, a task supervisor for handler execution,
and (when transport: :stdio) the stdio transport with its single implicit
session.
Define an MCP tool as a module.
Normalized runtime descriptor for one registered tool.
Define several MCP tools in one module by annotating functions with @mcp.
Built-in catalog discovery tool.
Test helpers for exercising Noizu.MCP.Server modules over an in-memory
transport — no sockets, async: true safe.
Transport behaviours.
Client-side transport behaviour. See Noizu.MCP.Transport.
Minimal Server-Sent Events codec used by the Streamable HTTP transport. Encoder for the server side, incremental parser for the client side.
A parsed server-sent event.
Server-side transport sink behaviour. See Noizu.MCP.Transport.
stdio server transport: newline-delimited JSON-RPC on stdin/stdout.
stdio client transport: spawns an MCP server as a subprocess and speaks newline-delimited JSON-RPC over its stdin/stdout.
Streamable HTTP client transport (Req-based).
Streamable HTTP server transport (MCP 2025-11-25): a single MCP endpoint handling POST/GET/DELETE, mountable in Phoenix or any Plug stack
In-memory transport for tests.
In-memory client transport: connects a Noizu.MCP.Client to a
Noizu.MCP.Server running in the same VM, preserving the full
encode/decode boundary.
An MCP content block: text, image, audio, resource link, or embedded resource.
Identity of an MCP client or server (clientInfo / serverInfo).
An MCP prompt definition as advertised by prompts/list.
A prompt argument (protocol-level string key/value).
A message in a prompts/get result.
An MCP resource definition as advertised by resources/list.
The contents of a read resource. Text resources carry :text; binary
resources carry :blob (raw binary, base64-encoded on the wire).
An MCP resource template (resources/templates/list), RFC 6570 URI template.
A filesystem root exposed by an MCP client (roots/list).
An MCP tool definition as advertised by tools/list.
The result of a tools/call — content blocks, optional structured content,
and the isError execution-error flag.
Minimal RFC 6570 (level 1) URI template support: simple {var} expressions.
Mix Tasks
Start Noizu.MCP.Inspector — a rich interactive HTML client for exploring
and exercising MCP servers (tools, resources, prompts, sampling,
elicitation, raw JSON-RPC history) — and open it in your browser.
Run the description-tuning eval harness (spec §4) against a Noizu.MCP.Server.