oauth-mcp-proxy
Verified Safeby tuannvm
Overview
Provides server-side OAuth 2.1 authentication for Go Model Context Protocol (MCP) servers, supporting both mark3labs/mcp-go and official go-sdk.
Installation
cd examples/official/simple && go run main.goEnvironment Variables
- OKTA_DOMAIN
- OKTA_AUDIENCE
- SERVER_URL
- PORT
- MCP_HOST
- MCP_PORT
- HTTPS_CERT_FILE
- HTTPS_KEY_FILE
- OAUTH_PROVIDER
- OAUTH_MODE
- OIDC_ISSUER
- OIDC_AUDIENCE
- OIDC_CLIENT_ID
- OIDC_CLIENT_SECRET
- OAUTH_REDIRECT_URIS
- JWT_SECRET
- AZURE_TENANT_ID
- AZURE_CLIENT_ID
- AZURE_CLIENT_SECRET
- GOOGLE_CLIENT_ID
- GOOGLE_CLIENT_SECRET
Security Notes
The library demonstrates strong security practices: comprehensive redirect URI validation, HMAC-signed state parameters to prevent tampering/CSRF, PKCE support for public clients, strict audience validation, and proper handling of secrets via environment variables. It enforces HTTPS for non-localhost environments and logs sensitive token information only as SHA-256 hashes. The OIDC provider initialization and validation also correctly verify TLS certificates. A fallback insecure JWT_SECRET is present if random generation fails and no secret is provided, but it's accompanied by strong warnings.
Similar Servers
guidance-for-deploying-model-context-protocol-servers-on-aws
Deploy secure, OAuth 2.0 authenticated Model Context Protocol (MCP) servers on AWS using CDK.
sagemcp
A scalable platform for hosting Multi-tenant Model Context Protocol (MCP) servers with multi-tenant support, OAuth integration, and connector plugins for various services.
mcp-server-playground
A Model Context Protocol (MCP) server that acts as an OAuth proxy for 3rd party authorization servers like Auth0, provides stateful session management, and exposes various tools for system time, streaming, project keyword searching, and AWS services (S3, ECS, CloudWatch Logs, Bedrock).
mcp-s-oauth
Universal OAuth middleware for MCP (Model Context Protocol) servers, enabling authentication with various OAuth providers.