mcpField
M
MCP with OAuth

MCP with OAuth

Local
github.com/akshay12390Media & Design0Updated 76w ago
Repository

About MCP with OAuth

A Spring sample showing how to secure an MCP server with OAuth2 under the MCP specification. It is for developers exploring token-based access, with client credentials and browser-based PKCE authorization flows.

Key features

  1. 01OAuth2-secured MCP server
  2. 02Client credentials token flow
  3. 03Browser authorization with PKCE
  4. 04Access-token issuance endpoint

Use cases

  1. 01Test token-based MCP server access
  2. 02Explore client credentials authorization
  3. 03Try browser-based PKCE authorization

MCP support

Demonstrates an OAuth2-protected MCP server. MCP clients connect using a generated access token; the sample can be tested with MCP Inspector.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "weather-oauth2-server": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/inspector"
      ]
    }
  }
}
Run commandnpx -y @modelcontextprotocol/inspector

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@modelcontextprotocol/inspector

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

MCP with OAuth

This sample demonstrates how to secure an MCP server using OAuth2, as per the MCP specification.

Getting started

Run the project with:

./mvnw spring-boot:run
Client Credentials

Obtain a token by calling the /oauth2/token endpoint:

curl -XPOST "http://localhost:8080/oauth2/token" \
  --data grant_type=client_credentials \
  --user "mcp-client:secret"
# And copy-paste the access token
# Or use JQ:
curl -XPOST "http://localhost:8080/oauth2/token" \
  --data grant_type=client_credentials \
  --user "mcp-client:secret" | jq -r ".access_token"
Auth code with browser flow (PKCE)

Obtain a auth code by first calling authorize endpoint

python3 pkce_generator.py

and then fetch access token by calling the /oauth2/token endpoint

python3 token_request.py

Using MCP inspector

Store the generated token in previous step, and then boot up the MCP inspector:

npx @modelcontextprotocol/[email protected]

In the MCP inspector, paste your token. Click connect, and voilà!

Note that the token is valid for 15 minutes

Implementation considerations

Dependencies

In Spring, OAuth2 Support for MCP server means adding:

  1. Spring Security (infrastructure for security)
  2. Spring Authorization Server (issuing tokens)
  3. Spring Security: OAuth2 Resource Server ( authentication using tokens)

Note that Spring Auth Server does not support the reactive stack, so issuing tokens only works in Servlet.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.