MCP Oauth Server

🚀 Implement OAuth Support for Streamable HTTP Servers and Clients (Without PKCE)

This project provides a solution for implementing OAuth support in streamable HTTP servers and clients without the need for PKCE. It enables seamless authentication and authorization for your HTTP applications.

🚀 Quick Start

Prerequisites

• Node.js and npm installed on your machine.
• A GitHub account to create an OAuth application.

Installation

1. Clone the repository and install the dependencies.

npm install

2. Go to your GitHub developer settings (under Settings), create an OAuth application. Enter "http://localhost" as the callback URL (if needed). Make sure to enable the 'Device Flow'. Note down the Client ID and Client Secret.
3. Set the GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET environment variables in your local development environment.

Usage

1. Start the MCP server.

npx tsx server/index_streamable.ts

2. Start the MCP client in another terminal.

npx tsx client/client.ts

✨ Features

Streamable HTTP Server with OAuth Support

The repository provides a streamable HTTP server with OAuth support through the device flow. This allows for seamless authentication and authorization for your server applications.

Streamable HTTP Client with OAuth Support

The repository also provides a streamable HTTP client with OAuth support, running in headless mode. This enables your client applications to authenticate and authorize with the server.

🔧 Technical Details

OAuth Support

At the time of writing, I was unable to test a streamable HTTP server with OAuth support using MCP Inspector. This led me to implement OAuth through the device flow.

In a typical browser-based authentication flow (e.g., using MCP Inspector):

1. The MCP client requests a connection with the MCP server.
2. The server authorizes the client through the GitHubAuthProvider (redirecting to GitHub); once the user authorizes the required scopes, the server's callback handler: a. Retrieves the access token from GitHub and then the user data. b. Stores the access token and a new session token in its token store. c. Generates a temporary authorization code for the client and saves it along with the newly generated session token. d. Redirects the temporary authorization code back to the client.
3. The client exchanges the temporary authorization code for a session token for subsequent requests.

In the device-based OAuth flow, we do not need PKCE because:

1. There is no need for redirection or client code handling.
2. The device code flow is inherently more secure for the following reasons:
   • The user opens a URL and enters the code directly on the GitHub page.
   • All token exchanges are server-to-server.
   • The device code itself is short-lived and can only be used by the same client (our server) that requested it.
   • Only the user code is passed from the server to the client.

However, we still do not have a browser for session storage. We may still need to implement some methods currently required by MCP's OAuthServerProvider (e.g., exchangeAuthorizationCode and challengeForAuthorizationCode).

📄 License

No license information provided in the original document.