Module: Hitch

Defined in:

lib/hitch.rb,
lib/hitch/pkce.rb,
lib/hitch/doctor.rb,
lib/hitch/engine.rb,
lib/hitch/version.rb,
lib/hitch/grant_types.rb,
lib/hitch/mcp/protocol.rb,
lib/hitch/resource_uri.rb,
app/models/hitch/client.rb,
lib/hitch/configuration.rb,
app/models/hitch/mcp/tool.rb,
lib/hitch/mcp/test_helper.rb,
lib/hitch/rack_form_guard.rb,
lib/hitch/rate_limit_store.rb,
app/models/hitch/mcp/result.rb,
lib/hitch/mcp/configuration.rb,
app/models/hitch/mcp/context.rb,
app/models/hitch/access_token.rb,
app/models/hitch/device_grant.rb,
app/models/hitch/mcp/internal.rb,
app/models/hitch/mcp/registry.rb,
app/models/hitch/mcp/forbidden.rb,
app/models/hitch/device_activation.rb,
app/models/hitch/application_record.rb,
app/models/hitch/client/credentials.rb,
app/models/hitch/client_id_metadata.rb,
app/models/hitch/mcp/rate_limit_key.rb,
lib/generators/hitch/tool_generator.rb,
app/models/hitch/client_redirect_uri.rb,
lib/generators/hitch/generator_guards.rb,
app/models/hitch/authorization_request.rb,
app/models/hitch/client_authentication.rb,
app/controllers/hitch/tokens_controller.rb,
app/models/hitch/mcp/internal/media_type.rb,
app/controllers/concerns/hitch/issuer_url.rb,
app/controllers/hitch/metadata_controller.rb,
app/models/hitch/client_id_metadata/cache.rb,
app/models/hitch/mcp/internal/cors_policy.rb,
app/models/hitch/mcp/internal/json_values.rb,
app/models/hitch/mcp/internal/observation.rb,
app/models/hitch/mcp/internal/sdk_adapter.rb,
app/models/hitch/mcp/internal/server_info.rb,
app/models/hitch/oauth_request_parameters.rb,
lib/hitch/device_authorization_rate_limit.rb,
lib/hitch/dynamic_registration_rate_limit.rb,
app/models/hitch/mcp/internal/header_field.rb,
app/controllers/concerns/hitch/cors_support.rb,
app/controllers/concerns/hitch/mcp/endpoint.rb,
app/controllers/hitch/preflights_controller.rb,
app/models/hitch/client_id_metadata/fetcher.rb,
app/models/hitch/mcp/internal/hmac_identity.rb,
app/controllers/hitch/activations_controller.rb,
app/controllers/hitch/application_controller.rb,
app/controllers/hitch/revocations_controller.rb,
app/models/hitch/client_id_metadata/throttle.rb,
app/models/hitch/mcp/internal/host_authority.rb,
app/controllers/concerns/hitch/uri_validation.rb,
app/models/hitch/mcp/internal/local_diagnosis.rb,
app/models/hitch/mcp/internal/schema_contract.rb,
app/controllers/concerns/hitch/host_validation.rb,
app/controllers/hitch/registrations_controller.rb,
app/models/hitch/mcp/internal/bearer_challenge.rb,
app/models/hitch/mcp/internal/error_normalizer.rb,
app/models/hitch/mcp/internal/registry_runtime.rb,
app/models/hitch/mcp/internal/sanitized_report.rb,
app/models/hitch/mcp/internal/verified_request.rb,
lib/generators/hitch/install/install_generator.rb,
app/controllers/hitch/authorizations_controller.rb,
app/models/hitch/mcp/internal/result_normalizer.rb,
app/controllers/concerns/hitch/client_resolution.rb,
app/controllers/concerns/hitch/request_admission.rb,
app/controllers/hitch/public_endpoint_controller.rb,
app/controllers/concerns/hitch/oauth_form_admission.rb,
app/controllers/concerns/hitch/registration_admission.rb,
app/models/hitch/mcp/internal/endpoint_error_reporter.rb,
app/controllers/hitch/device_authorizations_controller.rb,
app/controllers/concerns/hitch/device_authorization_gate.rb,
app/controllers/concerns/hitch/oauth_parameter_validation.rb,
app/models/hitch/mcp/internal/sdk_adapter/response_normalizer.rb

Overview

hitch-rails turns a Rails app into an authorization server implemented against the MCP 2026-07-28 authorization profile — OAuth 2.1 + PKCE (S256), Resource Indicators with audience binding (RFC 8707), discovery metadata (RFC 8414 + RFC 9728), token revocation (RFC 7009), and CORS for browser-based MCP clients — plus an authenticated host-mounted MCP endpoint with a deny-default tool Registry behind a private Ruby SDK boundary, rate limiting counted through the host application's own cache store, sanitized observation events, and a read-only operator doctor.

Spec reference: https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization

Usage:

# config/initializers/hitch.rb
Hitch.configure do |config|
config.resource_uri = "https://example.com/mcp"  # for RFC 8707
config.allowed_hosts = []
config.allowed_origins = []
end

Defined Under Namespace

Modules: ClientResolution, CorsSupport, DeviceAuthorizationGate, Generators, GrantTypes, HostValidation, IssuerUrl, MCP, OauthFormAdmission, OauthParameterValidation, Pkce, RateLimitStore, RegistrationAdmission, RequestAdmission, UriValidation Classes: AccessToken, ActivationsController, ApplicationController, ApplicationRecord, AuthorizationRequest, AuthorizationsController, Client, ClientAuthentication, ClientIdMetadata, ClientRedirectUri, Configuration, DeviceActivation, DeviceAuthorizationRateLimit, DeviceAuthorizationsController, DeviceGrant, Doctor, DynamicRegistrationRateLimit, Engine, MetadataController, OauthRequestParameters, PreflightsController, PublicEndpointController, RackFormGuard, RegistrationsController, ResourceUri, RevocationsController, TokensController

Constant Summary

VERSION =

"0.4.0"

Class Method Summary

• .configuration ⇒ Configuration
• .configure {|Configuration| ... } ⇒ Configuration

  The (potentially modified) configuration.

• .reset_configuration! ⇒ Object

  Reset configuration (useful in tests).

Class Method Details

.configuration ⇒ Configuration

Returns:

• (Configuration)

# File 'lib/hitch.rb', line 44

def configuration
  @configuration ||= Configuration.new
end

.configure {|Configuration| ... } ⇒ Configuration

Returns the (potentially modified) configuration.

Yields:

• (Configuration) —

  the gem's configuration

Returns:

• (Configuration) —

  the (potentially modified) configuration

# File 'lib/hitch.rb', line 38

def configure
  yield(configuration) if block_given?
  configuration
end

.reset_configuration! ⇒ Object

Reset configuration (useful in tests).

# File 'lib/hitch.rb', line 49

def reset_configuration!
  @configuration = nil
end