mcp-authOAuth 2.1 authorization for MCP

A provider-neutral authorization broker and resource-server SDKs for Python, Go and TypeScript.

OAuth 2.1 with PKCE

Authorization Code flow with mandatory PKCE S256, refresh-token rotation and dynamic client registration.

Authorization server

Bring any OIDC or OAuth 2.0 identity source, or offer several sign-in options including LDAP.

Validate tokens, publish resource metadata and issue bearer challenges from Python, Go or TypeScript.

Auth client SDKs

Audience and scope enforcement stays at the resource server; your tools never see which IdP signed the user in.

Security model

Connect or exchange credentials for downstream APIs while keeping the MCP token boundary explicit.

External credentials

A full local flow with Keycloak, plus Python, Go and TypeScript resource servers verified by shared cases.

Run the demo