1. Conduid
  2. Security
  3. Js
MCP server · Security

Js

by · github.com/mcp-auth/js

🔐 Plug-and-play auth for Node.js MCP servers.

Unclaimed MIT other
InstallView source
59Fair

Scored 5 hours ago · breakdown

About Js

Js is an MCP server published by mcp-auth in the Security category: 🔐 Plug-and-play auth for Node.js MCP servers.

The repository has 50 stars and 3 forks, with the last commit 24 days ago. Recent commit activity is the strongest signal that reported issues will get attention.

Install

From source
git clone https://github.com/mcp-auth/js

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Tools (5)

create-todoCreate a new todo

Parameters not published.

delete-todoDelete a todo by id

Parameters not published.

get-todosList all todos

Parameters not published.

purge-notesDelete every note

Parameters not published.

whoamiGet the current user

Parameters not published.

Ask AI

✦

Ask AI about Js

Powered by Claude

Ask about Js — answers draw on its README.

Security checks

Static checks derived from the repository 22 days ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • ✓License declaredUsable under a stated license.
  • ✓Tests presentA test suite exists in the repository.
  • ✓Dependencies pinnedA lockfile pins dependency versions.
  • ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

Releases

v1.0.0-beta.1v1.0.0-beta.1 · 14 Sep 2026Breaking: 1.0 is a rewrite for MCP TypeScript SDK v2 (`@modelcontextprotocol/server`). It drops MCP SDK v1 support and all Express APIs, and is ESM-only (Node.js >= 20.19). Still on MCP SDK v1 (`@modelcontextprotocol/sdk`)? Stay on…
v0.2.0v0.2.0 · 21 Jan 2026What's Changed fix: cache remote JWK Set instances to reduce redundant JWKS requests by @xiaoyijun in https://github.com/mcp-auth/js/pull/43 fix(mcp-auth): remove console.error for expected auth failures by @xiaoyijun in…
v0.2.0-beta.1v0.2.0-beta.1 · 11 Aug 2025What's Changed feat: add todo manager sample by @xiaoyijun in https://github.com/mcp-auth/js/pull/32 feat: support protected resource metadata for mcp server by @xiaoyijun in https://github.com/mcp-auth/js/pull/33 fix: use…
v0.1.1v0.1.1 · 22 May 2025What's Changed refactor: fall back to default grant types for config validation by @gao-sun in https://github.com/mcp-auth/js/pull/29 refactor: loose client id requirement and accept `azp` by @gao-sun in…
v0.1.0v0.1.0 · 9 May 2025The first release of MCP Auth Node.js SDK. Please see https://mcp-auth.dev for more details.

README

MCP Auth Node.js SDK

GitHub branch check runs codecov NPM version npm bundle size License

The MCP spec requires OAuth 2.1 and other RFCs for auth. Instead of spending weeks on them, use MCP Auth to connect to a trusted provider with a few lines of code.

mcp-auth targets the latest MCP specification and the MCP TypeScript SDK v2, implementing the spec's authorization requirements — RFC 9728 Protected Resource Metadata and RFC 8707 audience-bound token validation — for any OAuth 2.0 / OpenID Connect provider.

Get started

Is my provider supported?

Check out the MCP-compatible providers to see which providers are supported. It also includes a tool for real-time checking of provider compatibility.

Installation

npm install mcp-auth

Or use your package manager of choice, such as pnpm or yarn.

Still on MCP SDK v1 (@modelcontextprotocol/sdk)? Stay on the 0.2 line — npm install mcp-auth@0.2 — and see the v0.2.0 code and samples.

See the documentation for the full guide.

Join the discussion

Join the MCP Auth org discussion to ask questions or share your feedback.

README fetched from the repository 22 days ago. The original is authoritative.

Questions

About Js

How do I install Js?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Js safe to use with an AI agent?

Its trust score is 59 out of 100 (fair). It passes 5 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Js still maintained?

Yes — the latest release is v1.0.0-beta.1 (14 Sep 2026), and the last commit was 24 days ago. The repository has 50 stars.