mcp-auth documentation

mcp-auth is a provider-neutral authorization server and resource-server SDKs maintained by Tavric Labs. Start with the path that matches your role. The use-case guide maps supported flows to configuration, runnable examples and verification coverage.

Deploy the authorization server

Read Architecture for the OAuth flow and component boundaries, then Authorization server for configuration, identity-provider connectors and the production checklist. Use Login methods when offering multiple sign-in options.

Production needs a configured upstream identity source (one OIDC/OAuth connector or the login-method registry, including LDAP) and a public HTTPS issuer. The local-development quickstart in the repository README is for trying the server on your machine.

Protect an MCP server

The SDK guide covers Python, Go and TypeScript token validation, resource metadata, bearer challenges and token exchange. Read the security model before deciding which audiences and scopes your server accepts. Use External credentials when integrating a credential source.

Run an example

Start with the demo and Keycloak walkthrough for a complete local authorization flow. The examples index links the Python, Go and TypeScript resource servers.

Contribute and troubleshoot

Local development covers checkout, prerequisites, tests, shared verifier cases and release packaging. The Codex refresh reproduction is a focused troubleshooting scenario.

Open bugs and proposals in GitHub issues. Report suspected vulnerabilities through the security policy. Published binaries, SDK archives and checksums are available in GitHub releases.