FastMCP MCP server with Keycloak OAuth

Uses the FastMCP Remote Oauth provider to run the MCP Server as a OAuth Resource Server.

Keycloak

Run Keycloak for the OAuth Authorization Server.

podman run -d \
  --name keycloak-http \
  -p 8090:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
  -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
  quay.io/keycloak/keycloak:latest start-dev

Use this script to setup a realm, client, scopes, scope mapper and some users in Keycloak. See Integrating with Model Context Protocol (MCP) about Resource Indictors.

MCP Server

uv sync

uv run fastmcp run main.py:mcp --transport http --host 0.0.0.0 --port 3000 --log-level DEBUG

MCP Client

MCP Inspector supports OAuth, but it's browser based which makes it very tricky to use with OAuth.

https://github.com/djoreilly/mcp-oauth-client is CLI based. You can login as mcp-user/user123 which gets scope mcp:tools:read or mcp-admin/admin123 which gets scopes mcp:tools:read and mcp:tools:write.

CLIENT_ID=mcp-test-client CLIENT_SECRET=something-not-blank go run main.go --server-url http://localhost:3000/mcp

Connecting to MCP server...
Please open the following URL in your browser: http://localhost:8090/realms/mcp-realm/protocol/openid-connect/auth?client_id=mcp-test-client&code_challenge=A9NRqQuNCYIwKVFCLaey97RwryLBMiyxAzovp8bzlrw&code_challenge_method=S256&redirect_uri
=http%3A%2F%2Flocalhost%3A3142&resource=http%3A%2F%2Flocalhost%3A3000%2Fmcp&response_type=code&scope=mcp%3Atools%3Aread+mcp%3Atools%3Awrite&state=KQSPA4FMDZOVXH4DKJT6EN32D2
Connected to MCP server

Interactive MCP Client
Commands:
  list - List available tools
  call <tool_name> [args] - Call a tool
  quit - Exit the client

mcp>