mcp-server-auth-poc
Verified Safeby ashera96
Overview
An MCP server demonstrating dual authentication (API Key and OAuth 2.0 Client Credentials) for tool invocation in a stateless mode.
Installation
npm startEnvironment Variables
- PORT
- USE_HTTPS
Security Notes
Critical: Hardcoded secrets (API key, JWT secret, OAuth client ID/secret) are present in `src/index.ts`. The OAuth2 token store is in-memory and non-persistent. Broad CORS (`app.use(cors())`) is enabled. These are explicitly noted as POC limitations in the README, requiring significant hardening for production (e.g., using environment variables, persistent storage, and restricted CORS). No 'eval' or malicious patterns were found. The `./generate-certs.sh` script creates self-signed certificates suitable only for development.
Similar Servers
jetski
Jetski is an open-source platform providing analytics, authentication, and simplified client setup for Model Context Protocol (MCP) servers by acting as a proxy.
example-remote-server
A reference server demonstrating all Model Context Protocol (MCP) features and OAuth 2.0 authentication patterns.
mcp-server-playground
A playground and reference implementation for a Model Context Protocol (MCP) server, featuring streamable HTTP transport, OAuth proxy for third-party authorization servers like Auth0, and stateful session management.
mcp-s-oauth
Universal OAuth middleware for MCP (Model Context Protocol) servers, enabling authentication with various OAuth providers.