MCP Oauth2 Aws Cognito

🚀 Example Project of Model Context Protocol Authentication Implemented with MCP + OAuth2.1 + Amazon Cognito

This is an example project that combines the Model Context Protocol (MCP) with OAuth2.1, using Amazon Cognito as the authorization server. The project demonstrates how to implement a secure authentication and authorization process based on the model context protocol in a real - world application.

🚀 Quick Start

Prerequisites

1. Environment Requirements:
   • Node.js is installed.
   • An Amazon AWS test account with permissions for the following resources:
     • Cognito user pool (for the OAuth2.1 authorization server).
     • API Gateway, Lambda, DynamoDB (for the dynamic client registration function).
     • CloudFormation (for deploying the resource stack).
2. Basic Knowledge:
   • Familiarity with the basic concepts of the Model Context Protocol (MCP).
   • Understanding of the working principle of the OAuth2.1 protocol.

Deployment Steps

1. Clone the project repository:

   git clone https://github.com/empires - security/mcp - oauth2 - aws - cognito.git
   cd mcp - oauth2 - aws - cognito
   

2. Install dependencies:

   npm run install:all
   

3. Deploy Amazon cloud resources:

   npm run deploy
   

4. Update the generated .env file:
   • Check and update the configurations in src/client/.env, src/auto - client/.env, and src/mcp - server/.env.
   • Compare with .env.example to ensure all environment variables are set correctly.

✨ Features

Project Introduction

• Technology Selection:
  • Model Context Protocol (MCP): Defines and manages the interaction rules between models.
  • OAuth2.1: Implements a secure authentication and authorization mechanism.
  • Amazon Cognito: Serves as the user identity pool, providing user authentication functionality.

Core Components

1. MCP Server:
   • Implements the secure service of the model context protocol.
   • Provides role - based access control (RBAC) functionality.
   • Supports integration with the OAuth2.1 authorization server.
2. OAuth2.1 Authorization Server:
   • Uses Amazon Cognito user pool to implement authentication and authorization functions.
   • Supports standard OAuth2.1 protocol flows, including password grant, client_credentials, etc.
3. Automated Client:
   • Has an auto - discovery function, capable of dynamically identifying and connecting to the nearest MCP server.
   • Integrates the OAuth2.1 module, supporting the automatic authorization process.
4. Manually Configured Client:
   • Provides manual configuration options, allowing users to customize the parameters of the MCP server and the OAuth2.1 authorization server.
   • Supports advanced features such as multi - factor authentication (MFA) and certificate binding.

Key Features

• Dynamic Discovery Mechanism: Clients can automatically identify and connect to the nearest MCP server.
• OAuth2.1 Integration: Supports seamless docking with Amazon Cognito's identity pool.
• Role Management: Implements fine - grained access control based on role definitions in the model context protocol.

🏗️ Project Architecture

Overall Architecture

• MCP Service Layer:
  • Provides security verification and authorization functions for the model context protocol.
  • Supports integration with the OAuth2.1 authorization server.
• OAuth2.1 Authorization Server:
  • Uses Amazon Cognito user pool to implement authentication.
  • Handles OAuth2.1 token issuance, refresh, and other processes.
• Client Layer:
  • Includes two types: automated clients and manually configured clients.
  • Automated clients have an auto - discovery function and can dynamically connect to the MCP server.
  • Manually configured clients support custom configuration, suitable for complex environments.

Key Components

1. Model Context Protocol Service (MCP - Server):
   • Provides role - based access control functionality.
   • Supports secure integration with the OAuth2.1 authorization server.
2. OAuth2.1 Module:
   • Implements the standard OAuth2.1 protocol flow.
   • Connects with Amazon Cognito user pool to provide authentication services.
3. Auto - Discovery Mechanism:
   • Clients can dynamically identify and connect to the nearest MCP server.
   • Supports load balancing and failover functions.

📦 Project Structure

Core Directories

1. mcp - server:
   • Implements the secure service of the model context protocol.
   • Provides role - based access control functionality.
2. oauth - server:
   • Uses Amazon Cognito user pool to implement the OAuth2.1 authorization server.
   • Supports standard flows such as password grant and client_credentials.
3. client:
   • Provides a manually configured client implementation.
   • Supports custom configuration of the MCP server and the OAuth2.1 authorization server.
4. auto - client:
   • An automated client module with an auto - discovery function.
   • Integrates the OAuth2.1 module, supporting the dynamic authorization process.

💻 Usage Examples

Starting Services

1. Start the MCP server:

   cd mcp - server && npm start
   

2. Start the OAuth2.1 authorization server:

   cd oauth - server && npm start
   

3. Start the manually configured client:

   cd client && npm start
   

4. Start the automated client:

   cd auto - client && npm start
   

Example Commands

1. Deploy the project:

   npm run deploy
   

2. Update environment variables:

   cp .env.example .env
   

📚 Project Authors

Development Team:

• Empire Security Lab: Focuses on the research and implementation of the Model Context Protocol and the OAuth2.1 protocol.

Contact Information:

• Email: contact@empiresecuritylab.com
• Website: https://www.empiresecuritylab.com

📄 License

This project is licensed under the MIT License.