mcpField
I
Implementing OAuth for Streamable HTTP Server & Client without PKCE

Implementing OAuth for Streamable HTTP Server & Client without PKCE

Local
github.com/asibylDeveloper Tools1Updated 79w ago
Repository

About Implementing OAuth for Streamable HTTP Server & Client without PKCE

A demo repository implementing a Streamable HTTP MCP server and headless client with GitHub Device Flow OAuth, intended for developers exploring OAuth without PKCE.

Key features

  1. 01Streamable HTTP server
  2. 02GitHub Device Flow OAuth
  3. 03Headless OAuth client
  4. 04Session and token handling

Use cases

  1. 01Testing device-flow authorization for an MCP server
  2. 02Exploring headless OAuth client connections

MCP support

The project includes a Streamable HTTP MCP server and a headless client that connects to it using Device Flow OAuth.

#oauth#http-server#streamable

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "mcp_oauth_server": {
      "command": "npx",
      "args": [
        "-y",
        "tsx"
      ],
      "env": {
        "GITHUB_CLIENT_ID": "<GITHUB_CLIENT_ID>",
        "GITHUB_CLIENT_SECRET": "<GITHUB_CLIENT_SECRET>"
      }
    }
  }
}
Run commandnpx -y tsx
Environment variables to set
GITHUB_CLIENT_ID
GITHUB_CLIENT_SECRETSecret

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmtsx

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

Implementing OAuth for Streamable HTTP Server & Client without PKCE

Overview

This repo provides:

  1. A Streamable HTTP Server with with support OAuth (via device flow)
  2. A Streamable HTTP Client with support for OAuth (in headless mode)

OAuth Support

At the time of writing this, I wasn't able to use the MCP Inspector to test a Streamable HTTP Server with OAuth. This set me down the path of implementing OAuth through device flow.

In a typical browser-based flow (say using the MCP Inspector):

  1. MCP Client requests connection to MCP server.
  2. Server authorizes clients through a GitHub AuthProvider (redirect to GitHub); once user authorizes the scope, Server's callback handler: a. Retrieves access token from GitHub, then retrieves user data b. Stores access token + new session token in its token store c. Generates temp auth code for client, saves it with newly generated session token d. Redirects back to client with temp auth code
  3. Client exchanges temp auth code for session token, uses for subsequent requests

I wanted to replace this browser flow based OAuth flow with device flow based OAuth. This would work as follows:

image

In device flow based OAuth, we don't need PKCE because:

  1. There's no redirect or client-side code handling.
  2. The device code flow is inherently more secure because:
    • User opens the URL and enters code on GitHub's page directly
    • All token exchange happens server-to-server
    • The device code itself is short-lived and can only be used by the same client that requested it (our server)
    • Only the user code is passed down from the server to the client

However, we also don't have the browser for session storage. We may still need to implement certain methods of that the MCP's OAuthServerProvider currently requires (e.g. exchangeAuthorizationCode and challengeForAuthorizationCode).

How to use

  1. Clone this repository. Install the dependencies.
npm install

  1. Go to your Developer Settings on GitHub (under Settings) and create an OAuth app. Enter "http://localhost for callback URL if needed. Be sure to select 'Enable Device Flow'. Note the Client ID and Client Secret.

  2. Set the GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET environment variables in your local dev environment.

  3. Start the MCP Server.

npx tsx server/index_streamable.ts
  1. In a different terminal, start the MCP Client.
npx tsx client/client.ts

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.