MCP Server Auth Template

Name: MCP Server Auth Template
Author: brunovicco

by brunoviccoversion 0.7.0i★ –iRuns on your computer

Registry nameio.github.brunovicco/mcp-server-auth-template

Install

Overview

Description from the maker (original English)

OAuth 2.1/OIDC resource-server reference for secure MCP authorization

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: Streamable HTTP
Category: Other
You need to fill in: MCP_SERVER_RESOURCE_SERVER_URL, MCP_SERVER_AUTH_PROVIDER

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: MCP_SERVER_RESOURCE_SERVER_URL, MCP_SERVER_AUTH_PROVIDER, MCP_SERVER_REQUIRED_SCOPES, MCP_SERVER_TRANSPORT_ALLOWED_HOSTS, MCP_SERVER_ENTRA_TENANT_ID, MCP_SERVER_ENTRA_AUDIENCE, MCP_SERVER_ENTRA_APPLICATION_ID_URI, MCP_SERVER_GENERIC_ISSUER_URL, MCP_SERVER_GENERIC_AUDIENCE, MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS

You need

DockerDocker installed

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "auth-template": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "MCP_SERVER_RESOURCE_SERVER_URL",
        "-e",
        "MCP_SERVER_AUTH_PROVIDER",
        "-e",
        "MCP_SERVER_REQUIRED_SCOPES",
        "-e",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS",
        "-e",
        "MCP_SERVER_ENTRA_TENANT_ID",
        "-e",
        "MCP_SERVER_ENTRA_AUDIENCE",
        "-e",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI",
        "-e",
        "MCP_SERVER_GENERIC_ISSUER_URL",
        "-e",
        "MCP_SERVER_GENERIC_AUDIENCE",
        "-e",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS",
        "ghcr.io/brunovicco/mcp-server-auth-template:v0.7.0"
      ],
      "env": {
        "MCP_SERVER_RESOURCE_SERVER_URL": "your-value",
        "MCP_SERVER_AUTH_PROVIDER": "your-value",
        "MCP_SERVER_REQUIRED_SCOPES": "your-value",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS": "your-value",
        "MCP_SERVER_ENTRA_TENANT_ID": "your-value",
        "MCP_SERVER_ENTRA_AUDIENCE": "your-value",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI": "your-value",
        "MCP_SERVER_GENERIC_ISSUER_URL": "your-value",
        "MCP_SERVER_GENERIC_AUDIENCE": "your-value",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add auth-template --env MCP_SERVER_RESOURCE_SERVER_URL=your-value --env MCP_SERVER_AUTH_PROVIDER=your-value --env MCP_SERVER_REQUIRED_SCOPES=your-value --env MCP_SERVER_TRANSPORT_ALLOWED_HOSTS=your-value --env MCP_SERVER_ENTRA_TENANT_ID=your-value --env MCP_SERVER_ENTRA_AUDIENCE=your-value --env MCP_SERVER_ENTRA_APPLICATION_ID_URI=your-value --env MCP_SERVER_GENERIC_ISSUER_URL=your-value --env MCP_SERVER_GENERIC_AUDIENCE=your-value --env MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS=your-value -- docker run -i --rm -e MCP_SERVER_RESOURCE_SERVER_URL -e MCP_SERVER_AUTH_PROVIDER -e MCP_SERVER_REQUIRED_SCOPES -e MCP_SERVER_TRANSPORT_ALLOWED_HOSTS -e MCP_SERVER_ENTRA_TENANT_ID -e MCP_SERVER_ENTRA_AUDIENCE -e MCP_SERVER_ENTRA_APPLICATION_ID_URI -e MCP_SERVER_GENERIC_ISSUER_URL -e MCP_SERVER_GENERIC_AUDIENCE -e MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS ghcr.io/brunovicco/mcp-server-auth-template:v0.7.0

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "auth-template": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "MCP_SERVER_RESOURCE_SERVER_URL",
        "-e",
        "MCP_SERVER_AUTH_PROVIDER",
        "-e",
        "MCP_SERVER_REQUIRED_SCOPES",
        "-e",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS",
        "-e",
        "MCP_SERVER_ENTRA_TENANT_ID",
        "-e",
        "MCP_SERVER_ENTRA_AUDIENCE",
        "-e",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI",
        "-e",
        "MCP_SERVER_GENERIC_ISSUER_URL",
        "-e",
        "MCP_SERVER_GENERIC_AUDIENCE",
        "-e",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS",
        "ghcr.io/brunovicco/mcp-server-auth-template:v0.7.0"
      ],
      "env": {
        "MCP_SERVER_RESOURCE_SERVER_URL": "your-value",
        "MCP_SERVER_AUTH_PROVIDER": "your-value",
        "MCP_SERVER_REQUIRED_SCOPES": "your-value",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS": "your-value",
        "MCP_SERVER_ENTRA_TENANT_ID": "your-value",
        "MCP_SERVER_ENTRA_AUDIENCE": "your-value",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI": "your-value",
        "MCP_SERVER_GENERIC_ISSUER_URL": "your-value",
        "MCP_SERVER_GENERIC_AUDIENCE": "your-value",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "auth-template": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "MCP_SERVER_RESOURCE_SERVER_URL",
        "-e",
        "MCP_SERVER_AUTH_PROVIDER",
        "-e",
        "MCP_SERVER_REQUIRED_SCOPES",
        "-e",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS",
        "-e",
        "MCP_SERVER_ENTRA_TENANT_ID",
        "-e",
        "MCP_SERVER_ENTRA_AUDIENCE",
        "-e",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI",
        "-e",
        "MCP_SERVER_GENERIC_ISSUER_URL",
        "-e",
        "MCP_SERVER_GENERIC_AUDIENCE",
        "-e",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS",
        "ghcr.io/brunovicco/mcp-server-auth-template:v0.7.0"
      ],
      "env": {
        "MCP_SERVER_RESOURCE_SERVER_URL": "your-value",
        "MCP_SERVER_AUTH_PROVIDER": "your-value",
        "MCP_SERVER_REQUIRED_SCOPES": "your-value",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS": "your-value",
        "MCP_SERVER_ENTRA_TENANT_ID": "your-value",
        "MCP_SERVER_ENTRA_AUDIENCE": "your-value",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI": "your-value",
        "MCP_SERVER_GENERIC_ISSUER_URL": "your-value",
        "MCP_SERVER_GENERIC_AUDIENCE": "your-value",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

MCP_SERVER_RESOURCE_SERVER_URL required env
Protected-resource URL advertised by this deployment
MCP_SERVER_AUTH_PROVIDER required env
Authorization-server adapter to use
MCP_SERVER_REQUIRED_SCOPES env
JSON array of baseline delegated OAuth scopes
MCP_SERVER_TRANSPORT_ALLOWED_HOSTS env
Additional exact Host values accepted by the local container transport
MCP_SERVER_ENTRA_TENANT_ID env
Required when MCP_SERVER_AUTH_PROVIDER=entra
MCP_SERVER_ENTRA_AUDIENCE env
Required when MCP_SERVER_AUTH_PROVIDER=entra
MCP_SERVER_ENTRA_APPLICATION_ID_URI env
Required when MCP_SERVER_AUTH_PROVIDER=entra
MCP_SERVER_GENERIC_ISSUER_URL env
Required when MCP_SERVER_AUTH_PROVIDER=generic
MCP_SERVER_GENERIC_AUDIENCE env
Required when MCP_SERVER_AUTH_PROVIDER=generic
MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS env
Optional JSON array of explicitly trusted cross-origin JWKS origins

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account brunovicco, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 32691 servers in this category
Published to the registry more recently than 47% of the other 32691 servers in this category
Basic checks equal to or better than 100% of the other 32691 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is MCP Server Auth Template safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: MCP_SERVER_RESOURCE_SERVER_URL, MCP_SERVER_AUTH_PROVIDER

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.7.0) reached the registry last month.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Docker on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Dialyne

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago

Install

Dialyne

by dialyne

Real phone calls in France for AI agents: dial +33 numbers, menus, hold, AI disclosure.

Runs in the cloudUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

mcp-server-auth-template

*Leia em português*

A production-oriented OAuth 2.1 resource-server reference for remote MCP: Microsoft Entra ID and

generic OIDC, exact token/resource validation, fail-closed authorization, progressive scope

challenges, stateless MCP 2026-07-28, and metadata-only OpenTelemetry evidence.

Use this repository when the hard part is not "how do I expose an MCP tool?" but how do I expose it without weakening identity, authorization, transport, and observability boundaries. The server pairs with mcp-client-auth-template for an executable end-to-end reference using synthetic identities and no production credentials.

What this repository proves

The paired executable path validates real resource-server behavior rather than configuration claims:

✅ RFC 9728 Protected Resource Metadata is published by the resource server
✅ RFC 8707 resource binding becomes an exact JWT audience boundary
✅ issuer, signature, expiry, algorithm/key compatibility and caller type fail closed
✅ delegated scopes and Entra application roles remain distinct authorization concepts
✅ 403 insufficient_scope is returned before dispatch for progressive authorization
✅ wrong-audience tokens are rejected with 401, with an explicit token-resource policy that does not depend on MCP SDK defaults
✅ tools/list is filtered per principal and carries only bounded private cache hints
✅ protected tools stay hidden from anonymous catalog discovery
✅ MCP 2026-07-28 stays stateless and does not mint Mcp-Session-Id
✅ generic OIDC and Microsoft Entra ID share one application boundary without provider leakage
✅ W3C trace context reaches the server while OAuth/MCP sensitive values stay out of telemetry
✅ release artifacts, container evidence, SBOMs and provenance are validated by executable gates

For a requirement-by-requirement view of the paired OAuth/MCP behavior, including explicit evidence gaps and discussion topics for the MCP Authorization Interest Group / Tool Scopes Working Group, see the Authorization Implementer Report.

Architecture

flowchart LR

Client["MCP client"] -->|"OAuth 2.1 / OIDC"| AS["Authorization server Entra ID or generic OIDC"] Client -->|"MCP 2026-07-28 resource-bound bearer"| Admission["Transport admission"] Admission --> AuthN["Token verification"] AuthN --> AuthZ["Tool authorization"] AuthZ --> Tools["MCP tools"] Server["This resource server"] --- Admission

Server -->|"OIDC discovery + cached JWKS"| AS Server -.->|"W3C trace context + OTLP"| Collector["OpenTelemetry Collector"] Collector --> Tempo["Tempo"] Tempo --> Grafana["Grafana"]

The authorization server owns login, consent, client registration and token issuance. This repository owns the protected resource: transport admission, metadata publication, access-token verification, request-scoped principal construction, tool authorization and dispatch.

For layer boundaries and the detailed authorization sequence, see Architecture.

5-minute verification

The companion client owns the executable cross-repository reference flow. With both repositories cloned as siblings, verify this server directly from source:

cd ../mcp-client-auth-template

./scripts/run_reference_demo.sh \ --server-root ../mcp-server-auth-template

The flow starts the real server from this checkout plus a deterministic local OIDC provider and proves CIMD-first Authorization Code + PKCE, authenticated whoami, bounded scope step-up, wrong-audience rejection and stateless MCP behavior.

For the observable published-image proof:

cd ../mcp-client-auth-template

./scripts/run_observability_demo.sh --keep

The observable flow verifies one distributed trace across client and server, positive Collector receipt, Tempo retrieval, Grafana provisioning and telemetry privacy assertions.

See Verification guide for the exact evidence boundary.

Visual proof

The terminal proof below is captured from the source-level paired reference flow:

The trace screenshots are captured from a successful observable run and focus on mcp-server-auth-template spans:

Authentication profiles

Profile	Intended use	Key behavior
Entra delegated	Interactive enterprise users	Validates `scp`, tenant/application identifiers, issuer, audience and subject
Entra application	Provider-specific app-only deployments	Requires explicit `idtyp=app`; keeps `roles` separate from delegated scopes
Generic OIDC delegated	Standards-based interactive clients	Validates issuer/audience/signature/expiry and OAuth scopes
Generic OIDC client credentials	Unattended services in the deterministic pair profile	Accepts pre-registered machine tokens and progressive OAuth scopes

Set MCP_SERVER_AUTH_PROVIDER=entra or generic to switch adapters. The example whoami tool returns the verified caller identity; health requires the additional mcp:tools:health scope and demonstrates a pre-dispatch 403 insufficient_scope challenge.

Quick start

Prerequisites: Python 3.13 or 3.14 and uv.

git clone https://github.com/brunovicco/mcp-server-auth-template.git

cd mcp-server-auth-template cp .env.example .env uv sync --frozen --all-groups uv run uvicorn mcp_server_auth_template.entrypoints.mcp_server:create_app --factory --reload

Configure either the Entra or generic-OIDC block in .env, then point an MCP client at http://localhost:8000/mcp.

Endpoint	Purpose	Authentication
`/mcp`	MCP Streamable HTTP	Bearer token
`/.well-known/oauth-protected-resource`	Authorization-server discovery metadata	Public
`/livez`	Process liveness	Public, minimal response
`/readyz`	MCP lifespan readiness	Public, minimal response

For production-style execution:

uv run python -m mcp_server_auth_template.entrypoints.serve

See Production operations before exposing the service outside loopback.

Official MCP Registry

The server is published in the Official MCP Registry as:

io.github.brunovicco/mcp-server-auth-template@0.7.0

server.json describes the public GHCR image as an OCI package using the real streamable-http transport; it does not claim a hosted remotes endpoint. Publication is gated by the secure release pipeline and a dedicated Registry workflow that validates the immutable image, ownership metadata, and persisted Registry responses before publication.

See Official MCP Registry and the Authorization Implementer Report.

Security properties

The implementation is deliberately fail closed:

exact issuer and audience validation, bounded clock checks, algorithm/key compatibility and cached JWKS refresh;
an explicit validate_token_resource=False policy: provider audiences (Entra API client ID, api:// identifiers) are enforced by the token verifier, never by SDK URL string equality (ADR-0027);
principal-dependent discovery results are never shareable across authorization contexts (ADR-0028);
hardened discovery/JWKS egress against unsafe schemes, redirects, compression, oversized bodies, private/reserved destinations, mixed DNS answers and DNS rebinding;
Host, Origin, header, envelope, body-size and concurrency admission before authentication and tool dispatch;
delegated and application identities remain distinct; extension negotiation never grants authorization by itself;
bearer tokens and decoded claims remain request-local and are never logged or persisted;
tracing excludes credentials, arbitrary headers and URLs, MCP arguments/results, bodies, baggage and exception text.

This is a transparent reference implementation, not a security certification. Read Privacy and data handling and the architecture decisions under docs/adr/ before adapting the boundary.

MCP `2026-07-28`

Baseline: MCP specification 2026-07-28 and MCP Python SDK >=2.2,<3.

The paired templates exercise the modern stateless profile as executable behavior:

server/discover and per-request _meta carry protocol version, client identity and capabilities without the legacy initialize / initialized handshake;
modern requests use MCP-Protocol-Version, Mcp-Method and Mcp-Name;
responses do not mint Mcp-Session-Id;
Protected Resource Metadata drives authorization-server discovery;
RFC 8707 resource binds the access token audience exactly;
server/discover and tools/list carry SEP-2549 cache hints (ttlMs=30000, cacheScope=private);
runtime 403 insufficient_scope preserves prior grants and permits only one bounded replay of the undispatched operation;
machine-to-machine access is opt-in through io.modelcontextprotocol/oauth-client-credentials.

See Compatibility and the companion client's cross-repository E2E evidence.

Observability

a2a-otel-kit continues W3C trace context at the MCP ASGI boundary. Export remains network-silent unless A2A_OTEL_ENABLED=true and a complete OTLP traces endpoint are configured. Spans are metadata-only and sit inside hardened HTTP admission but outside authentication and tool dispatch.

See LLM and application observability.

Engineering evidence

deterministic quality gate covering lint, format, strict Mypy, architecture, tests/coverage, Bandit, dependency audit, supply-chain controls, governance and vendored contract validation;
SHA-pinned GitHub Actions with read-only permissions by default and isolated release authorities;
CycloneDX source/runtime inventories, complete vulnerability evidence and fail-closed exception policy;
allowlisted byte-reproducible Python release artifacts with SHA-256 manifests and GitHub build provenance;
policy-approved GHCR publication with immutable digest, provenance and SBOM attestations;
Python 3.13/3.14 against MCP SDK 2.2.0 and latest compatible 2.x, with MCP SDK deprecation warnings promoted to test failures so MCP 3 breakage surfaces early;
offline JWT fixtures using local keys and synthetic identities;
ADRs documenting security, protocol, operations, compatibility, observability and supply-chain decisions.

Demo vs production

Reference evidence	Production adoption
Synthetic local OIDC in companion demo	Enterprise authorization server with reviewed registration and consent

| Loopback/local reference networking | TLS-protected servic

Only the beginning is shown; read the rest in the repo

MCP Server Auth Template

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Dialyne

README from the maker

mcp-server-auth-template

What this repository proves

Architecture

5-minute verification

Visual proof

Authentication profiles

Quick start

Official MCP Registry

Security properties

MCP 2026-07-28

Observability

Engineering evidence

Demo vs production

MCP `2026-07-28`