# ConduitMCP v0.11.0 - Table of Contents

> Elixir Model Context Protocol (MCP) library. Dual-era servers speak MCP
2026-07-28 and 2025-11-25/2025-06-18 on one endpoint, with auth and rate
limiting. Includes a governed MCP client: stdio and Streamable HTTP, a
multi-server hub, LLM adapters and OAuth 2.1.

## Pages

- [README](readme.md)

- Changelog
  - [Changelog](changelog.md)

- Getting Started
  - [Choosing a Mode](choosing_a_mode.md)
  - [Endpoint Mode](endpoint_mode.md)
  - [DSL Mode](dsl_mode.md)
  - [Manual Mode](manual_mode.md)

- Features
  - [Authentication](authentication.md)
  - [Rate Limiting](rate_limiting.md)
  - [Multi-Node Session Stores](multi_node_sessions.md)
  - [Using Oban for MCP Tasks](oban_tasks.md)
  - [MCP Apps](mcp_apps.md)

- Modern Protocol (2026-07-28)
  - [Protocol Eras](protocol_eras.md)
  - [Multi Round-Trip Requests (MRTR)](mrtr.md)
  - [Subscriptions](subscriptions.md)
  - [Tasks Extension](tasks_extension.md)

- Client
  - [MCP Client](client.md)
  - [Client Permissions and Hooks](client_permissions_and_hooks.md)
  - [Client Hub](client_hub.md)
  - [Client LLM Adapters](client_llm_adapters.md)
  - [Client OAuth](client_oauth.md)
  - [Client Security](client_security.md)

## Modules

- [ConduitMcp.Subscriptions.Admission](ConduitMcp.Subscriptions.Admission.md): The node-local bookkeeping behind `:max_listens_per_principal`: which
`subscriptions/listen` streams of each principal are live, oldest first.
Started by `ConduitMcp.Application`; streams reach it through
`ConduitMcp.Subscriptions` (`admit/3`, `leave/2`, `live_listeners/1`).

- Core
  - [ConduitMcp](ConduitMcp.md): ConduitMCP - Elixir implementation of the Model Context Protocol (MCP).
  - [ConduitMcp.Application](ConduitMcp.Application.md): OTP application for ConduitMCP.
  - [ConduitMcp.DSL](ConduitMcp.DSL.md): DSL for defining MCP servers with a clean, declarative syntax.
  - [ConduitMcp.DSL.Helpers](ConduitMcp.DSL.Helpers.md): Helper macros for building MCP responses in the DSL.
  - [ConduitMcp.DSL.SchemaBuilder](ConduitMcp.DSL.SchemaBuilder.md): Builds JSON Schema and NimbleOptions schemas from DSL parameter definitions.
  - [ConduitMcp.OptionalDependencyError](ConduitMcp.OptionalDependencyError.md): Raised when a feature is configured whose optional dependency is not
compiled into the current build of `:conduit_mcp`.
  - [ConduitMcp.OptionalDeps](ConduitMcp.OptionalDeps.md): Runtime availability checks for ConduitMCP's conditionally compiled modules.
  - [ConduitMcp.Principal](ConduitMcp.Principal.md): The one canonical representation of "who is calling".
  - [ConduitMcp.Reflect](ConduitMcp.Reflect.md): The single boundary helper for client-supplied text that is echoed back to
the client or written to the log.
  - [ConduitMcp.Server](ConduitMcp.Server.md): Behaviour for implementing stateless MCP servers.

- Supervision
  - [ConduitMcp.Cancellation.InFlightOwner](ConduitMcp.Cancellation.InFlightOwner.md): Long-lived process that owns the `:conduit_mcp_in_flight` ETS table: one
row per request `ConduitMcp.Handler` is dispatching, written by
`ConduitMcp.Cancellation.track/2`. Started under `ConduitMcp.Supervisor`
by `ConduitMcp.Application`, so the table outlives the request processes
that write to it.

  - [ConduitMcp.Cancellation.Owner](ConduitMcp.Cancellation.Owner.md): Long-lived process that owns the `:conduit_mcp_cancellations` ETS
table so concurrent Bandit request handlers don't race on
`:ets.new/2` when the table doesn't exist yet (each handler calls
`Cancellation.clear/2` from a `try/after`). Started under
`ConduitMcp.Supervisor` by `ConduitMcp.Application`.

  - [ConduitMcp.EtsOwner](ConduitMcp.EtsOwner.md): Shared implementation for ConduitMCP's supervised ETS table owners.
  - [ConduitMcp.Ext.Tasks.EtsStore.Owner](ConduitMcp.Ext.Tasks.EtsStore.Owner.md): Long-lived `ConduitMcp.EtsOwner` process owning `:conduit_mcp_ext_tasks`.
Started by `ConduitMcp.Application` when `:ext_tasks` is enabled with
the default `ConduitMcp.Ext.Tasks.EtsStore`.

  - [ConduitMcp.OAuth.KeyProvider.JWKS.Owner](ConduitMcp.OAuth.KeyProvider.JWKS.Owner.md): Long-lived process that owns the `:conduit_mcp_jwks_cache` ETS table so
the JWKS cache survives — and stays stable under concurrency — across
short-lived Bandit request processes. Started under `ConduitMcp.Supervisor`
by `ConduitMcp.Application` whenever this provider module is available.
  - [ConduitMcp.Session.EtsStore.Owner](ConduitMcp.Session.EtsStore.Owner.md): Long-lived process that owns the `:conduit_mcp_sessions` ETS table so the
table outlives short-lived request handlers.
  - [ConduitMcp.Tasks.EtsStore.Owner](ConduitMcp.Tasks.EtsStore.Owner.md): Long-lived process that owns the `:conduit_mcp_tasks` ETS table so
the table outlives short-lived request handlers. Started under
`ConduitMcp.Supervisor` by `ConduitMcp.Application` when the
configured tasks store is the default `ConduitMcp.Tasks.EtsStore`.
  - [ConduitMcp.Transport.SSE.Owner](ConduitMcp.Transport.SSE.Owner.md): Long-lived process that owns the `:conduit_mcp_sse_connections` ETS table,
the slot table behind `ConduitMcp.Transport.SSE`'s `:max_connections`:
one row per SSE stream, keyed by the pid serving it.
  - [ConduitMcp.Transport.SSEStream.Owner](ConduitMcp.Transport.SSEStream.Owner.md): Long-lived process that owns the `:conduit_mcp_sse_streams` ETS table,
the slot table behind the HTTP transports' `:max_streams` cap on
streamed POST responses: one row per open stream, keyed by the pid
serving it.

- Endpoint Mode
  - [ConduitMcp.Component](ConduitMcp.Component.md): Behaviour for defining individual MCP tools, resources, and prompts as separate modules.
  - [ConduitMcp.Component.Schema](ConduitMcp.Component.Schema.md): Schema DSL for defining parameters in Component modules.
  - [ConduitMcp.Endpoint](ConduitMcp.Endpoint.md): Aggregates `ConduitMcp.Component` modules into a full MCP server.

- Protocol & Handler
  - [ConduitMcp.Cancellation](ConduitMcp.Cancellation.md): Cooperative request cancellation for long-running tools.
  - [ConduitMcp.Capabilities](ConduitMcp.Capabilities.md): Builds the `capabilities` object a server advertises to MCP clients.
  - [ConduitMcp.Errors](ConduitMcp.Errors.md): Standard error codes for MCP and JSON-RPC 2.0 responses.
  - [ConduitMcp.Handler](ConduitMcp.Handler.md): Routes JSON-RPC 2.0 MCP requests to a server module's behaviour callbacks.
  - [ConduitMcp.Protocol](ConduitMcp.Protocol.md): JSON-RPC 2.0 message construction and MCP protocol versions.
  - [ConduitMcp.Protocol.Legacy](ConduitMcp.Protocol.Legacy.md): Shapes a neutral handler result (`t:ConduitMcp.Handler.result/0`) into the
JSON-RPC 2.0 response map of the legacy (`initialize`-negotiated) protocol
era.

- Modern era (2026-07-28)
  - [ConduitMcp.CacheHints](ConduitMcp.CacheHints.md): Per-component cache hints for modern (`2026-07-28`) results.
  - [ConduitMcp.Ctx](ConduitMcp.Ctx.md): The per-request context: which protocol era a request belongs to and what
it declared about itself.
  - [ConduitMcp.Discover](ConduitMcp.Discover.md): Builds the result of `server/discover`, the modern-era method a client uses
to learn which protocol versions, capabilities and instructions a server
has, without a handshake.
  - [ConduitMcp.Era](ConduitMcp.Era.md): Classifies a decoded JSON-RPC request into a protocol era and builds its
`ConduitMcp.Ctx`.
  - [ConduitMcp.Headers](ConduitMcp.Headers.md): HTTP request-metadata header codec for the MCP 2026-07-28 Streamable HTTP
transport.
  - [ConduitMcp.Log](ConduitMcp.Log.md): Log notifications (`notifications/message`) from inside a running tool.
  - [ConduitMcp.MRTR](ConduitMcp.MRTR.md): Builders for Multi Round-Trip Request (MRTR) input requests.
  - [ConduitMcp.MRTR.State](ConduitMcp.MRTR.State.md): Seals and opens the MRTR `requestState` token.
  - [ConduitMcp.Notifications](ConduitMcp.Notifications.md): Builders for server-to-client JSON-RPC notifications.
  - [ConduitMcp.Plugs.HeaderValidation](ConduitMcp.Plugs.HeaderValidation.md): Validates the MCP request-metadata headers of a modern (`2026-07-28`)
Streamable HTTP request against its JSON-RPC body.
  - [ConduitMcp.Progress](ConduitMcp.Progress.md): Progress notifications from inside a running tool.
  - [ConduitMcp.Protocol.Modern](ConduitMcp.Protocol.Modern.md): Shapes a neutral handler result (`t:ConduitMcp.Handler.result/0`) into the
JSON-RPC 2.0 response map of the modern (`2026-07-28`) protocol era, and
maps modern errors to their HTTP status.
  - [ConduitMcp.StreamSpec](ConduitMcp.StreamSpec.md): A response the transport may send as a Server-Sent Events stream instead
of a single JSON body: the `{:stream, spec}` reply of
`ConduitMcp.Handler.dispatch/3`.
  - [ConduitMcp.Subscriptions](ConduitMcp.Subscriptions.md): The node-local registry behind `subscriptions/listen` (protocol
`2026-07-28`), and the dispatch of change notifications to it.
  - [ConduitMcp.Subscriptions.Filter](ConduitMcp.Subscriptions.Filter.md): The `notifications` filter of a `subscriptions/listen` request
(`SubscriptionFilter`), reduced to the subset this server honours.
  - [ConduitMcp.Transport.SSEStream](ConduitMcp.Transport.SSEStream.md): Server-Sent Events primitives shared by every stream the HTTP transports
hold open: the legacy `GET /sse` stream of `ConduitMcp.Transport.SSE` and
the modern streamed POST responses (`ConduitMcp.StreamSpec`).

- Tasks extension (experimental)
  - [ConduitMcp.Ext.Tasks](ConduitMcp.Ext.Tasks.md): The MCP Tasks extension (`io.modelcontextprotocol/tasks`) for the modern
(`2026-07-28`) protocol era.
  - [ConduitMcp.Ext.Tasks.EtsStore](ConduitMcp.Ext.Tasks.EtsStore.md): In-memory `ConduitMcp.Ext.Tasks.Store` (experimental, unstable — see
`ConduitMcp.Ext.Tasks`).
  - [ConduitMcp.Ext.Tasks.ListenNotifier](ConduitMcp.Ext.Tasks.ListenNotifier.md): The default `ConduitMcp.Ext.Tasks.Notifier` (experimental, unstable):
delivers every task change as `notifications/tasks` to the
`subscriptions/listen` streams of this node that asked for the task
with the `taskIds` filter (`ConduitMcp.Subscriptions.Filter`).
  - [ConduitMcp.Ext.Tasks.Notifier](ConduitMcp.Ext.Tasks.Notifier.md): Hook called after every `ConduitMcp.Ext.Tasks` state change
(experimental, unstable).
  - [ConduitMcp.Ext.Tasks.Store](ConduitMcp.Ext.Tasks.Store.md): Storage behaviour for `ConduitMcp.Ext.Tasks` (experimental, unstable — see
that module).

- Transport
  - [ConduitMcp.Transport.SSE](ConduitMcp.Transport.SSE.md): Server-Sent Events (SSE) transport layer for MCP.
  - [ConduitMcp.Transport.Shared](ConduitMcp.Transport.Shared.md): The single implementation of everything `ConduitMcp.Transport.StreamableHTTP`
and `ConduitMcp.Transport.SSE` have in common.
  - [ConduitMcp.Transport.StreamableHTTP](ConduitMcp.Transport.StreamableHTTP.md): Streamable HTTP transport for MCP (recommended).

- Authentication
  - [ConduitMcp.OAuth.KeyProvider](ConduitMcp.OAuth.KeyProvider.md): Behaviour for pluggable JWKS key providers.
  - [ConduitMcp.OAuth.KeyProvider.JWKS](ConduitMcp.OAuth.KeyProvider.JWKS.md): JWKS key provider that fetches keys from an HTTP endpoint with ETS caching.
  - [ConduitMcp.OAuth.KeyProvider.Static](ConduitMcp.OAuth.KeyProvider.Static.md): Static key provider for testing and development.
  - [ConduitMcp.OAuth.ResourceMetadata](ConduitMcp.OAuth.ResourceMetadata.md): Generates OAuth 2.0 Protected Resource Metadata (RFC 9728) for MCP servers.
  - [ConduitMcp.Plugs.Auth](ConduitMcp.Plugs.Auth.md): Authentication plug for MCP servers.
  - [ConduitMcp.Plugs.OAuth](ConduitMcp.Plugs.OAuth.md): OAuth 2.1 authentication plug for MCP servers.

- Rate Limiting
  - [ConduitMcp.Plugs.MessageRateLimit](ConduitMcp.Plugs.MessageRateLimit.md): Message-level rate limiting plug for MCP servers.
  - [ConduitMcp.Plugs.RateLimit](ConduitMcp.Plugs.RateLimit.md): Rate limiting plug for MCP servers.

- Security
  - [ConduitMcp.Plugs.OriginValidation](ConduitMcp.Plugs.OriginValidation.md): Plug that validates the `Origin` request header against an allowlist.
  - [ConduitMcp.Plugs.SecurityHeaders](ConduitMcp.Plugs.SecurityHeaders.md): Plug that adds standard security response headers to all responses.

- Sessions
  - [ConduitMcp.Session](ConduitMcp.Session.md): Session management facade for MCP protocol sessions.
  - [ConduitMcp.Session.EtsStore](ConduitMcp.Session.EtsStore.md): Default in-memory session store backed by a public, named ETS table.
  - [ConduitMcp.Session.Janitor](ConduitMcp.Session.Janitor.md): Periodically prunes expired sessions from a `ConduitMcp.Session.Store`.
  - [ConduitMcp.Session.Store](ConduitMcp.Session.Store.md): Behaviour for pluggable session storage backends.

- Tasks (legacy)
  - [ConduitMcp.Tasks](ConduitMcp.Tasks.md): Task management for long-running MCP operations (experimental).
  - [ConduitMcp.Tasks.EtsStore](ConduitMcp.Tasks.EtsStore.md): ETS-backed task store. Default implementation of `ConduitMcp.Tasks.Store`.
  - [ConduitMcp.Tasks.Janitor](ConduitMcp.Tasks.Janitor.md): Periodically prunes terminal-state tasks from `ConduitMcp.Tasks`.
  - [ConduitMcp.Tasks.Store](ConduitMcp.Tasks.Store.md): Behaviour for pluggable task storage backends.

- Client: Core
  - [ConduitMcp.Client](ConduitMcp.Client.md): An MCP client: one supervised connection to one MCP server, speaking the
modern (`2026-07-28`) or a legacy (`2025-11-25`, `2025-06-18`) protocol
era, whichever the server supports.
  - [ConduitMcp.Client.Backoff](ConduitMcp.Client.Backoff.md): Reconnect delays for `ConduitMcp.Client`.
  - [ConduitMcp.Client.Cache](ConduitMcp.Client.Cache.md): The per-connection cache of a `ConduitMcp.Client`: an ETS table
(`:set`, `:protected`, `read_concurrency: true`) that only the client's
`ConduitMcp.Client.Connection` writes, and that any process reads
directly. Its id is published in the client's `ConduitMcp.Client.Registry`
value, so readers never message the connection.
  - [ConduitMcp.Client.Config](ConduitMcp.Client.Config.md): The validated options of a `ConduitMcp.Client`.
  - [ConduitMcp.Client.Connection](ConduitMcp.Client.Connection.md): The process that owns one client's connection to one MCP server.
  - [ConduitMcp.Client.DiscoverResult](ConduitMcp.Client.DiscoverResult.md): A modern (`2026-07-28`) server's answer to `server/discover`.
  - [ConduitMcp.Client.Error](ConduitMcp.Client.Error.md): The single error type returned by the MCP client.
  - [ConduitMcp.Client.Handler](ConduitMcp.Client.Handler.md): The behaviour for answering a server's requests for input: sampling,
elicitation and roots, plus optional notification and log hooks.
  - [ConduitMcp.Client.Negotiation](ConduitMcp.Client.Negotiation.md): Pure protocol-negotiation decisions for the client: which era a server
speaks, which version to use, and which capabilities to advertise.
  - [ConduitMcp.Client.Prompt](ConduitMcp.Client.Prompt.md): A prompt listed by a server (`prompts/list`).
  - [ConduitMcp.Client.Registry](ConduitMcp.Client.Registry.md): The name of the passive, unique `Registry` that `ConduitMcp.Application`
starts (partitioned by scheduler), and its key scheme.
  - [ConduitMcp.Client.Request](ConduitMcp.Client.Request.md): The caller side of a client request, and the request envelope.
  - [ConduitMcp.Client.Request.MRTR](ConduitMcp.Client.Request.MRTR.md): The client side of modern (`2026-07-28`) multi round-trip requests.
  - [ConduitMcp.Client.Resource](ConduitMcp.Client.Resource.md): A resource listed by a server (`resources/list`).
  - [ConduitMcp.Client.Secret](ConduitMcp.Client.Secret.md): An opaque wrapper for values that must never be printed or encoded by
accident: bearer tokens, refresh tokens, MRTR `requestState`, legacy
session ids, and environment values.
  - [ConduitMcp.Client.ServerInfo](ConduitMcp.Client.ServerInfo.md): A server's self-reported `Implementation` (`serverInfo`).
  - [ConduitMcp.Client.Task](ConduitMcp.Client.Task.md): A server-side task a tool call was turned into.
  - [ConduitMcp.Client.Tool](ConduitMcp.Client.Tool.md): A tool advertised by one server, as the client holds it.
  - [ConduitMcp.Client.ToolCall](ConduitMcp.Client.ToolCall.md): One intended `tools/call`: which server, which tool, with which arguments.
  - [ConduitMcp.Client.ToolResult](ConduitMcp.Client.ToolResult.md): The outcome of a `tools/call` that the server completed.

- Client: Transports
  - [ConduitMcp.Client.SSE](ConduitMcp.Client.SSE.md): An incremental parser for `text/event-stream` bodies, following the WHATWG
HTML "Parsing an event stream" algorithm.
  - [ConduitMcp.Client.SSE.Event](ConduitMcp.Client.SSE.Event.md): One dispatched server-sent event.
  - [ConduitMcp.Client.Transport](ConduitMcp.Client.Transport.md): The behaviour a client transport implements.
  - [ConduitMcp.Client.Transport.InProcess](ConduitMcp.Client.Transport.InProcess.md): A `ConduitMcp.Client.Transport` that serves requests from a server module
in the same VM, for tests and development.
  - [ConduitMcp.Client.Transport.Stdio](ConduitMcp.Client.Transport.Stdio.md): A `ConduitMcp.Client.Transport` that runs a local MCP server as an
operating-system process and speaks newline-delimited JSON-RPC over its
stdin and stdout (the MCP stdio transport).
  - [ConduitMcp.Client.Transport.Stdio.Framer](ConduitMcp.Client.Transport.Stdio.Framer.md): Splits a stdio byte stream into newline-delimited MCP messages.
  - [ConduitMcp.Client.Transport.StreamableHTTP](ConduitMcp.Client.Transport.StreamableHTTP.md): A `ConduitMcp.Client.Transport` for the MCP Streamable HTTP transport, in
both protocol eras. Needs the optional `:finch` dependency
(`{:finch, "~> 0.21"}`); without it the client raises
`ConduitMcp.OptionalDependencyError` when it starts.
  - [ConduitMcp.Client.URLPolicy](ConduitMcp.Client.URLPolicy.md): Decides whether the client may connect to a URL, before any connection is
made. It guards against server-supplied URLs (OAuth metadata, redirects,
`resource_metadata`) pointing the client at internal networks (SSRF).

- Client: Governance
  - [ConduitMcp.Client.Fingerprint](ConduitMcp.Client.Fingerprint.md): The digest a tool's approvals are pinned to.
  - [ConduitMcp.Client.Grants](ConduitMcp.Client.Grants.md): "Always allow" approvals of a `ConduitMcp.Client` (PO-10, PO-11).
  - [ConduitMcp.Client.Hooks](ConduitMcp.Client.Hooks.md): Host code that runs around a client's tool calls (and, optionally, its
tool listings, resource reads and prompt gets), configured with the
client's `:hooks` option and run by `ConduitMcp.Client.Pipeline`.
  - [ConduitMcp.Client.Pipeline](ConduitMcp.Client.Pipeline.md): The governed tool call: selection, hooks, schema validation, policy and
approval around one `tools/call`, run **in the calling process**.
  - [ConduitMcp.Client.Policy](ConduitMcp.Client.Policy.md): Authorization for tool calls (and, opt-in, resource reads and prompt
gets): decides `:allow`, `:ask` or `:deny` for one call.
  - [ConduitMcp.Client.Policy.Decision](ConduitMcp.Client.Policy.Decision.md): The outcome of `ConduitMcp.Client.Policy.evaluate/4` (and its resource and
prompt variants).
  - [ConduitMcp.Client.Policy.Paths](ConduitMcp.Client.Policy.Paths.md): Path canonicalization and path predicates for `ConduitMcp.Client.Policy`
argument rules (PO-9).
  - [ConduitMcp.Client.SchemaValidator](ConduitMcp.Client.SchemaValidator.md): JSON Schema validation of tool arguments and `structuredContent`, behind a
behaviour so the validator can be swapped.
  - [ConduitMcp.Client.SchemaValidator.JSV](ConduitMcp.Client.SchemaValidator.JSV.md): The default `ConduitMcp.Client.SchemaValidator`, built on
[JSV](https://hex.pm/packages/jsv) (JSON Schema 2020-12 and draft 7).
  - [ConduitMcp.Client.ToolFilter](ConduitMcp.Client.ToolFilter.md): Tool visibility: which tools an application (and its LLM) can see at all.

- Client: Hub
  - [ConduitMcp.Client.Hub](ConduitMcp.Client.Hub.md): Many MCP servers behind one tool list: a supervisor of one
`ConduitMcp.Client` per server, plus the functions that list their tools
under collision-free names and route a model's tool call to the right
server through the governed call pipeline (`ConduitMcp.Client.Pipeline`).
  - [ConduitMcp.Client.Hub.Config](ConduitMcp.Client.Hub.Config.md): The validated options of a `ConduitMcp.Client.Hub`.
  - [ConduitMcp.Client.Naming](ConduitMcp.Client.Naming.md): Builds the exposed (model-facing) tool names for one or more servers.
  - [ConduitMcp.Client.ToolSet](ConduitMcp.Client.ToolSet.md): The tools offered to an LLM, keyed by the name the model sees.

- Client: Adapters
  - [ConduitMcp.Client.Adapters](ConduitMcp.Client.Adapters.md): The agent-loop side of the LLM adapters: list a hub's (or one client's)
tools in a provider's format, then run the tool calls a model made and
answer them in the same format.
  - [ConduitMcp.Client.Adapters.Anthropic](ConduitMcp.Client.Adapters.Anthropic.md): Converts between a `ConduitMcp.Client.ToolSet` and the Anthropic Messages
API tool format. Pure functions over string-keyed maps; no HTTP.
  - [ConduitMcp.Client.Adapters.Gemini](ConduitMcp.Client.Adapters.Gemini.md): Converts between a `ConduitMcp.Client.ToolSet` and Gemini API
(`generateContent`) function calling. Pure functions over string-keyed
maps; no HTTP.
  - [ConduitMcp.Client.Adapters.OpenAI](ConduitMcp.Client.Adapters.OpenAI.md): Converts between a `ConduitMcp.Client.ToolSet` and OpenAI function tools,
for both the Chat Completions API (`api: :chat`) and the Responses API
(`api: :responses`). Pure functions over string-keyed maps; no HTTP.

- Client: OAuth
  - [ConduitMcp.Client.OAuth](ConduitMcp.Client.OAuth.md): OAuth 2.1 for the MCP client (the MCP authorization spec, both protocol
eras, Streamable HTTP only). Compiled only with the optional `:finch`
dependency.
  - [ConduitMcp.Client.OAuth.CIMD](ConduitMcp.Client.OAuth.CIMD.md): Client ID Metadata Documents (the MCP authorization spec's preferred
client registration; `draft-ietf-oauth-client-id-metadata-document`).
  - [ConduitMcp.Client.OAuth.Callback](ConduitMcp.Client.OAuth.Callback.md): Validates an authorization response (the query parameters delivered to the
redirect URI) against its `ConduitMcp.Client.OAuth.Pending`, before the
code goes anywhere near a token endpoint.
  - [ConduitMcp.Client.OAuth.Challenge](ConduitMcp.Client.OAuth.Challenge.md): Parses `WWW-Authenticate` header values (RFC 9110 §11.6.1, RFC 6750 §3) and
reads the Bearer challenge an MCP server sends with a 401 or 403.
  - [ConduitMcp.Client.OAuth.ClientCredentials](ConduitMcp.Client.OAuth.ClientCredentials.md): Machine-to-machine authorization: the OAuth 2.1 `client_credentials`
grant (the MCP `io.modelcontextprotocol/oauth-client-credentials`
extension). No user and no browser: the client authenticates as itself
and gets a token for the MCP server. Compiled only with `:finch`.
  - [ConduitMcp.Client.OAuth.Config](ConduitMcp.Client.OAuth.Config.md): The options of the client's OAuth 2.1 support, validated into a struct.
  - [ConduitMcp.Client.OAuth.Discovery](ConduitMcp.Client.OAuth.Discovery.md): Pure parts of authorization-server discovery (MCP authorization spec,
*Authorization Server Discovery*): the metadata URLs to try, in order, and
validation of the decoded metadata documents. Nothing here does I/O; the
HTTP layer fetches each candidate (without an `Authorization` header, with
every URL passing `ConduitMcp.Client.URLPolicy` `:public_only`) and stops
at the first usable document.
  - [ConduitMcp.Client.OAuth.Discovery.Fetch](ConduitMcp.Client.OAuth.Discovery.Fetch.md): The network side of authorization-server discovery: fetches the
candidates `ConduitMcp.Client.OAuth.Discovery` lists, in order, and
validates what comes back with its pure validators. Compiled only with
the optional `:finch` dependency.
  - [ConduitMcp.Client.OAuth.Error](ConduitMcp.Client.OAuth.Error.md): The error type of the OAuth 2.1 client (`ConduitMcp.Client.OAuth.*`).
  - [ConduitMcp.Client.OAuth.Loopback](ConduitMcp.Client.OAuth.Loopback.md): Interactive authorization for CLI and desktop apps: a one-shot callback
server on `127.0.0.1` (RFC 8252 §7.3 loopback redirect). Compiled only
with `:finch`.
  - [ConduitMcp.Client.OAuth.PKCE](ConduitMcp.Client.OAuth.PKCE.md): Proof Key for Code Exchange (RFC 7636), `S256` only.
  - [ConduitMcp.Client.OAuth.Pending](ConduitMcp.Client.OAuth.Pending.md): An authorization-code flow between the authorization request and the
callback: everything the client must remember to validate the response
and redeem the code.
  - [ConduitMcp.Client.OAuth.Registration](ConduitMcp.Client.OAuth.Registration.md): Chooses the client identity presented to an authorization server, in
the MCP authorization spec's order (compiled only with `:finch`)
  - [ConduitMcp.Client.OAuth.Resource](ConduitMcp.Client.OAuth.Resource.md): The canonical resource URI of an MCP server: the value sent as the RFC 8707
`resource` parameter in authorization and token requests, compared exactly
against Protected Resource Metadata `resource`, and used in token-store keys.
  - [ConduitMcp.Client.OAuth.Scopes](ConduitMcp.Client.OAuth.Scopes.md): Scope lists and step-up bookkeeping.
  - [ConduitMcp.Client.OAuth.TokenStore](ConduitMcp.Client.OAuth.TokenStore.md): Where the OAuth client keeps tokens and registered clients.
  - [ConduitMcp.Client.OAuth.TokenStore.ETS](ConduitMcp.Client.OAuth.TokenStore.ETS.md): The default `ConduitMcp.Client.OAuth.TokenStore`: an in-memory table,
lost when the store stops.
  - [ConduitMcp.Client.OAuth.Tokens](ConduitMcp.Client.OAuth.Tokens.md): The tokens the client holds for one `{principal, issuer, resource}`.

- Validation
  - [ConduitMcp.Validation](ConduitMcp.Validation.md): Runtime parameter validation using NimbleOptions.
  - [ConduitMcp.Validation.SchemaConverter](ConduitMcp.Validation.SchemaConverter.md): Converts DSL parameter definitions to NimbleOptions validation schemas.
  - [ConduitMcp.Validation.Validators](ConduitMcp.Validation.Validators.md): Common validation functions for use with the ConduitMCP DSL.

- Observability
  - [ConduitMcp.PromEx](ConduitMcp.PromEx.md): A PromEx plugin for monitoring ConduitMCP operations.
  - [ConduitMcp.Telemetry](ConduitMcp.Telemetry.md): Telemetry integration for ConduitMCP.

## Mix Tasks

- [mix bench](Mix.Tasks.Bench.md): Runs ConduitMCP benchmarks.