1. Conduid
  2. Security
  3. Oauth2.1 Server
MCP server · Security

Oauth2.1 Server

by · github.com/QuantGeekDev/mcp-oauth2.1-server

Reference mcp server implementation of draft mcp oauth spec https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-authorization-server-discovery

Unclaimed last commit a year ago mcp-hostmcpmcp-serversmcp-toolsmcp-serversecuritymodelcontextprotocol
InstallView source
46Fair

Scored 5 months ago · breakdown

About Oauth2.1 Server

Oauth2.1 Server is an MCP server published by QuantGeekDev in the Security category: reference mcp server implementation of draft mcp oauth spec https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-authorization-server-discovery.

The repository has 9 stars and 3 forks, with the last commit a year ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

From source
git clone https://github.com/QuantGeekDev/mcp-oauth2.1-server

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Oauth2.1 Server

Powered by Claude · Grounded in docs

I know everything about Oauth2.1 Server. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 4 hours ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • !License declaredNo license file. Legally you have no right to use it in a product.
  • !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
  • ✓Dependencies pinnedA lockfile pins dependency versions.
  • ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

MCP Server Reference Implementation

This is a reference MCP Server implementation of the draft Authorization spec updates using the official typescript sdk.

This repo can be used with this Postman collection

Authentication Providers

There are two separate auth provider options:

  1. Cognito
  2. Keycloak (self-hosted)

We validate the scope: mcp:access, with <resource-id>/mcp:access. For example, https://mcp-server.com/mcp:access

Important Note

Keep in mind that OAuth 2.1 doesn't allow http protocol, so you will want to use ngrok with a static url (available for free from ngrok) to properly test this out.

If you want to use localhost without ngrok because you don't care, you can override the PORT and PROTOCOL env variables for the authorization and resource servers by setting them in .envs (check config folder if you're confused)

Setup with ngrok

  1. Build and start the server:

    npm i
npm run build
npm run start

  2. The MCP server will start on port 1335.

  3. In another terminal, create the ngrok tunnel to the MCP server:

    ngrok http --domain=<get-a-custom-domain-from-ngrok(free)-and-place-here> 1335

  4. Configure this resource server in the Domains tab of your AWS Cognito dashboard

README fetched from the repository 4 hours ago. The original is authoritative.

Questions

About Oauth2.1 Server

How do I install Oauth2.1 Server?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Oauth2.1 Server safe to use with an AI agent?

Its trust score is 46 out of 100 (fair). It passes 3 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Oauth2.1 Server still maintained?

The last commit was a year ago and 1 open issues. That's long enough that you should check whether the maintainer is responding to issues before depending on it.