mcp-oauth

The library demonstrates a high degree of security consciousness, implementing PKCE enforcement (S256 only), refresh token rotation, token encryption at rest (AES-256-GCM), comprehensive redirect URI validation with SSRF protection, per-domain rate limiting for CIMD fetches, and audit logging. It applies secure-by-default configurations and explicitly warns about insecure practices (e.g., using environment variables for secrets in production, enabling insecure HTTP, allowing plain PKCE). Strict validation is performed on URLs, scopes, and various inputs to prevent common attack vectors like XSS, SSRF, and injection. JWKS endpoints are also protected against SSRF. Overall, the architecture and code show a strong focus on security best practices.