Implementing OAuth for Streamable HTTP Server & Client without PKCE
About
MCP Streamable HTTP Server with Device Flow OAuth
Details
- Author
- asibyl
- GitHub stars
- 1
- Downloads
- 640
- Categories
- Developer Tools
Jump to
- Streamable HTTP Server with OAuth device flow support
- Streamable HTTP Client with headless OAuth support
- Replaces browser-based OAuth with device code flow
- No PKCE required due to device flow security
- Uses GitHub as the OAuth provider
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Implementing OAuth for Streamable HTTP Server & Client without PKCECommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Clone the repository, install dependencies with npm install, set the GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET environment variables from a GitHub OAuth App that has "Enable Device Flow" selected, then start the server with npx tsx server/index_streamable.ts and the client with npx tsx client/client.ts.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"implementing oauth for streamable http server & client without pkce": {
"streamable-http-server": {
"command": "npx",
"args": [
"tsx",
"server/index_streamable.ts"
],
"env": {
"GITHUB_CLIENT_ID": "",
"GITHUB_CLIENT_SECRET": ""
}
}
}
}
}McpServers
{
"streamable-http-server": {
"command": "npx",
"args": [
"tsx",
"server/index_streamable.ts"
],
"env": {
"GITHUB_CLIENT_ID": "",
"GITHUB_CLIENT_SECRET": ""
}
}
}Implementing OAuth for Streamable HTTP Server & Client without PKCE
Overview
This repo provides:
1. A Streamable HTTP Server with with support OAuth (via device flow)
2. A Streamable HTTP Client with support for OAuth (in headless mode)
OAuth Support
At the time of writing this, I wasn't able to use the MCP Inspector to test a Streamable HTTP Server with OAuth. This set me down the path of implementing OAuth through device flow.
In a typical browser-based flow (say using the MCP Inspector):
1. MCP Client requests connection to MCP server.
2. Server authorizes clients through a GitHub AuthProvider (redirect to GitHub); once user authorizes the scope, Server's callback handler:
a. Retrieves access token from GitHub, then retrieves user data
b. Stores access token + new session token in its token store
c. Generates temp auth code for client, saves it with newly generated session token
d. Redirects back to client with temp auth code
3. Client exchanges temp auth code for session token, uses for subsequent requests
I wanted to replace this browser flow based OAuth flow with device flow based OAuth. This would work as follows:
In device flow based OAuth, we don't need PKCE because:
1. There's no redirect or client-side code handling.
2. The device code flow is inherently more secure because:
- User opens the URL and enters code on GitHub's page directly
- All token exchange happens server-to-server
- The device code itself is short-lived and can only be used by the same client that requested it (our server)
- Only the user code is passed down from the server to the client
However, we also don't have the browser for session storage. We may still need to implement certain methods of that the MCP's OAuthServerProvider currently requires (e.g. exchangeAuthorizationCode and challengeForAuthorizationCode).
How to use
1. Clone this repository. Install the dependencies.
npm install
2. Go to your Developer Settings on GitHub (under Settings) and create an OAuth app. Enter "http://localhost for callback URL if needed. Be sure to select 'Enable Device Flow'. Note the Client ID and Client Secret.
3. Set the GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET environment variables in your local dev environment.
4. Start the MCP Server.
npx tsx server/index_streamable.ts
5. In a different terminal, start the MCP Client.
npx tsx client/client.ts
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
