Oauth

This project demonstrates FastMCP server with Bearer token authentication mounted on FastAPI, including OAuth 2.1 endpoints for dynamic client registration and metadata discovery.

MCP Server Setup

Requirements

• Python 3.8+
• See requirements.txt for all dependencies

Installation

pip install -r requirements.txt

Env

cp .env.example .env

Create an OAuth application with any OAuth provider. (I've used Clerk as an example.)
Obtain the client_id and client_secret from your provider.
Update your .env file with the appropriate environment variables:

CLERK_ISSUER=<issuer_url>
CLERK_AUDIENCE=<clerk_client_id>
CLERK_CLIENT_SECRET=<clerk_client_secret>
BASE_URL=http://localhost:8000

Running the Server

python server.py

eg.

python server.py --transport sse --host 0.0.0.0 --port 8000 --log-level info

Command Line Options

python server.py --help

• --transport: Transport type (sse or http, default: sse)
• --host: Host address (default: 127.0.0.1)
• --port: Port number (default: 8000)
• --log-level: Logging level (default: info)

Testing the Server

Method 1: MCP Inspector

The MCP Inspector provides a web-based interface to test MCP servers with OAuth authentication.

1. Configure the server URL: Enter http://localhost:8000/mcp/sse in the MCP Inspector

2. Initiate OAuth flow: Click the "Quick OAuth Flow" button to start authentication

3. Complete authentication: Follow the OAuth steps and grant the necessary permissions

Method 2: FastMCP Python Client

Use the FastMCP Client for programmatic access with OAuth authentication.

1. Update the client configuration: Modify the server URL in client.py to match your server endpoint
2. Run the client:

   python client.py
   

Method 3: Claude Integration

Integrate the MCP server directly with Claude for AI assistant access.

1. Navigate to settings: Go to Settings → Integrations → Add Integration
2. Configure the server: Input the server configuration details
3. Establish connection: Click "Connect" to enable the integration

Server Endpoints

Core Endpoints

• MCP Server: http://127.0.0.1:8000/mcp - Main MCP endpoint
• Health Check: http://127.0.0.1:8000/mcp/health - Server health status
• API Documentation: http://127.0.0.1:8000/docs - FastAPI auto-generated docs

OAuth 2.1 Endpoints

• Authorization Server Metadata: http://127.0.0.1:8000/.well-known/oauth-authorization-server
• OpenID Connect Discovery: http://127.0.0.1:8000/.well-known/openid-configuration
• Protected Resource Metadata: http://127.0.0.1:8000/.well-known/oauth-protected-resource
• Dynamic Client Registration: POST http://127.0.0.1:8000/register

Development Endpoints

• Development Token: http://127.0.0.1:8000/dev/token - Generate test tokens

Environment Variables

You can configure the server using environment variables:

• ISSUER: JWT issuer (default: https://dev.example.com)
• AUDIENCE: JWT audience (default: my-mcp-server)
• CLIENT_SECRET: OAuth client secret (default: auto-generated UUID)
• BASE_URL: Base URL for the server (default: http://127.0.0.1:8000)

Example MCP Tools

• hello(name: str) -> str: Returns a greeting message
• add_numbers(a: int, b: int) -> int: Adds two numbers together

Both tools require valid authentication.

OAuth 2.1 Compliance

This server implements key OAuth 2.1 endpoints:

• Authorization Server Metadata Discovery
• Dynamic Client Registration (RFC 7591)
• Protected Resource Metadata (RFC 8705)

Note: This is a development/demonstration server. For production use, integrate with a proper OAuth 2.1 Authorization Server or Identity Provider.

Features

• FastMCP server mounted on FastAPI
• Bearer token (JWT) authentication using RSA public key validation
• OAuth 2.1 Authorization Server metadata endpoints
• Dynamic client registration endpoint
• OpenID Connect discovery endpoint
• CORS middleware for cross-origin requests
• Structured logging with loguru
• Development token generation endpoint
• Health check endpoint
• Multiple MCP tools (hello, add_numbers)

References

• FastMCP Bearer Auth Documentation
• fastmcp GitHub
• OAuth 2.1 Specification
• RFC 7591 - OAuth 2.0 Dynamic Client Registration