Hapi MCP Server

Simple Bearer authentication scheme plugin for hapi, accepts token by Header, Cookie or Query parameter. That is what the hapi mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.

The short version

[Release Notes] @hapi/hapi, joi, and @hapi/boom are all now peer dependencies to allow maximum flexibility. A reference to joi is now required as opposed to the older @hapi/joi.

The tools it exposes

The server publishes 8 tools. What each one is for:

• validate — (required) a token validation function with the signature [async] function(request, token, h) where:
• request — is the hapi request object of the request which is being authenticated
• token — the auth token received from the client
• isValid — true if token is valid, otherwise false
• credentials — a credentials object passed back to the application in request.auth.credentials. Note that due to underlying Hapi expectations, this value must be
• artifacts — optional authentication related data that is not part of the user's credential
• options — (optional)
• response — {"statusCode":401,"error":"Unauthorized","message":"Missing authentication"}

Getting it running

Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client.

How it compares

Among the planning and project tracking options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Hapi's toolset — validate, request, token and 5 more — is a fair guide to whether it matches your workflow. It is maintained by johnbrett; worth a glance at recent repository activity before you build anything load-bearing on it.

This entry was verified against Hapi's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.

Things to watch

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.