mcp-auth

import express from 'express'; import { MCPAuth, fetchServerConfig } from 'mcp-auth'; import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; // Assuming @modelcontextprotocol/sdk is installed const initializeMcpAuth = async () => { const server = new McpServer({ name: 'my-mcp-server', version: '1.0.0' }); // Replace with your actual auth server URL, e.g., 'https://your-oidc-provider.com/realms/master' // For local testing, ensure your OIDC provider is running and accessible. const authServerUrl = process.env.AUTH_SERVER_URL ?? 'https://example.com/auth'; const mcpAuth = new MCPAuth({ server: await fetchServerConfig(authServerUrl, { type: 'oidc' }), }); const app = express(); app.use(express.json()); // Required for parsing JSON request bodies // Apply bearer token authentication middleware app.use(mcpAuth.bearerAuth('jwt', { requiredScopes: ['read', 'write'] })); // Define an MCP tool that utilizes authInfo server.tool('whoami', ({ authInfo }) => { // authInfo contains decoded token claims, e.g., authInfo.sub, authInfo.email console.log('Auth Info:', authInfo); return { content: [{ type: 'text', text: `You are ${authInfo?.sub || 'an unknown user'}` }] }; }); // Example route to serve the MCP server, assuming @modelcontextprotocol/sdk/express is used // You would typically integrate 'server' with an actual MCP Express handler. app.post('/mcp', (req, res) => { // This is a placeholder. In a real app, you'd integrate `server` via an MCP Express handler. // e.g., from '@modelcontextprotocol/sdk/express' or 'express-mcp-handler' res.status(200).json({ message: 'MCP endpoint hit, authInfo available in tools' }); }); const PORT = process.env.PORT || 3000; app.listen(PORT, () => { console.log(`MCP Auth server running on http://localhost:${PORT}`); }); }; initializeMcpAuth().catch(console.error);