getmcpauth

import express from "express"; import { mcpAuth } from "getmcpauth"; const app = express(); app.use( "/mcp", mcpAuth({ registrationSecret: process.env.MCPAUTH_SECRET }) ); // Unauthenticated or invalid requests never reach this handler. app.post("/mcp", handleMcpRequest);

MCP clients (Claude, ChatGPT, custom agent frameworks) then discover your auth setup automatically via/.well-known/oauth-authorization-server— no manual client configuration needed.

// app/api/mcp/route.ts import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; import { createMcpAuthHandler } from "getmcpauth"; const handler = createMcpAuthHandler({ registrationSecret: process.env.MCPAUTH_SECRET!, buildServer: () => { const server = new McpServer({ name: "my-server", version: "1.0.0" }); server.registerTool(/ ... /); return server; }, }); export { handler as GET, handler as POST, handler as DELETE };

- mcpAuth(options)— Express middleware. Successful token verifications are cached in-process (default 30s) so a chatty agent conversation doesn't trigger a network round trip on every tool call.
- createMcpAuthHandler(options)— the Next.js/Fetch-API equivalent above, returning a(request: Request) => Promise<Response>handler. Same caching behavior asmcpAuth().
- McpAuthTokenVerifier— implements the official SDK'sOAuthTokenVerifierinterface directly, for lower-level use.
- mintToken(options)— for MCP servers embedded in a product that already has its own users: your backend, which already knows who its logged-in user is, mints a token server-to-server without routing that user through mcpauth's own login.
- protectedResourceMetadata(options)/mcpAuthResourceMetadataHandler(options)— RFC 9728 resource-metadata helpers.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Enterprise-grade authentication with secure credential management, multi-protocol support, and real-time threat detection.

An MCP server for Keycloak administration, offering over 30 tools to manage users, realms, clients, roles, and more from AI assistants.

An OAuth 2.1 proxy for MCP servers that enables single sign-on with Google, domain validation, and per-user tokens.

A sample MCP server that uses Asgardeo for client authentication and connection.

ZeroID Agent Identity is a paid hosted remote MCP for ZeroID. It exposes Streamable HTTP tool calls, bearer-token access, public server-card metadata, usage logs, and receipt-oriented JSON f

A read-only MCP server that allows LLMs to query live PingOne data. Requires a separate CData JDBC Driver for PingOne.

Interact with Descope's Management APIs to search and retrieve project information.

Administer Keycloak users and realms using a Model Context Protocol server.

A RESTful API to programmatically interact with the Opal Security platform.