JavaScript Auth Server

БесплатноНе проверен

Demonstrates MCP remote authentication boundary with OAuth 2.0, Keycloak token introspection, audience and scope validation, and protected tools.

автор: kabirrajsingh

GitHub Embed

Описание

Demonstrates MCP remote authentication boundary with OAuth 2.0, Keycloak token introspection, audience and scope validation, and protected tools.

README

This package shows the remote MCP auth boundary in JavaScript:

Express HTTP server
MCP Streamable HTTP transport at /mcp
Protected Resource Metadata
Bearer token middleware
Keycloak token introspection
audience validation
mcp:tools scope enforcement
protected add_numbers and server_status tools

Run

pnpm mcp-auth-server-js install
cp .env.example .env
pnpm mcp-auth-server-js demo:keycloak
pnpm mcp-auth-server-js start

For the demo, configure Keycloak with:

client scope: mcp:tools
MCP server confidential client: mcp-server
demo client/user for obtaining an access token
token audience: http://localhost:3000/mcp

Demo Scripts

pnpm mcp-auth-server-js demo:no-token
pnpm mcp-auth-server-js demo:metadata
pnpm mcp-auth-server-js demo:get-token
pnpm mcp-auth-server-js demo:call-tool
pnpm mcp-auth-server-js demo:bad-scope

The important point is the failure order:

no token returns 401 with WWW-Authenticate
metadata tells the client where auth lives
token introspection rejects inactive tokens
audience validation rejects tokens for another API
scope validation rejects tokens without mcp:tools

from github.com/kabirrajsingh/mcp-server-auth-js

Установка JavaScript Auth Server

У этого сервера нет опубликованного пакета — он собирается из исходников. Открой репозиторий и следуй инструкции в README.

▸ github.com/kabirrajsingh/mcp-server-auth-js

FAQ