mcpField
M
MCP with OAuth

MCP with OAuth

Local
github.com/akshay12390Developer Tools0Updated 77w ago
Repository

About MCP with OAuth

MCP with OAuth is a Spring-based sample showing how to protect an MCP server with OAuth2 under the MCP specification. It demonstrates client credentials and browser-based authorization with PKCE, and is intended for developers exploring authenticated MCP connections.

Key features

  1. 01Issue tokens through an OAuth2 endpoint
  2. 02Demonstrate client credentials flow
  3. 03Demonstrate browser authorization with PKCE
  4. 04Connect using MCP Inspector

Use cases

  1. 01Testing OAuth2 protection for an MCP server
  2. 02Trying client credentials authentication
  3. 03Exploring browser-based PKCE authorization

MCP support

Demonstrates an OAuth2-protected MCP server and how to connect to it with an access token using MCP Inspector.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "weather-starter-webmvc-oauth2-server": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/inspector"
      ]
    }
  }
}
Run commandnpx -y @modelcontextprotocol/inspector

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@modelcontextprotocol/inspector

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

MCP with OAuth

This sample demonstrates how to secure an MCP server using OAuth2, as per the MCP specification.

Getting started

Run the project with:

./mvnw spring-boot:run
Client Credentials

Obtain a token by calling the /oauth2/token endpoint:

curl -XPOST "http://localhost:8080/oauth2/token" \
  --data grant_type=client_credentials \
  --user "mcp-client:secret"
# And copy-paste the access token
# Or use JQ:
curl -XPOST "http://localhost:8080/oauth2/token" \
  --data grant_type=client_credentials \
  --user "mcp-client:secret" | jq -r ".access_token"
Auth code with browser flow (PKCE)

Obtain a auth code by first calling authorize endpoint

python3 pkce_generator.py

and then fetch access token by calling the /oauth2/token endpoint

python3 token_request.py

Using MCP inspector

Store the generated token in previous step, and then boot up the MCP inspector:

npx @modelcontextprotocol/[email protected]

In the MCP inspector, paste your token. Click connect, and voilà!

Note that the token is valid for 15 minutes

Implementation considerations

Dependencies

In Spring, OAuth2 Support for MCP server means adding:

  1. Spring Security (infrastructure for security)
  2. Spring Authorization Server (issuing tokens)
  3. Spring Security: OAuth2 Resource Server ( authentication using tokens)

Note that Spring Auth Server does not support the reactive stack, so issuing tokens only works in Servlet.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.