MCP Server Reference Implementation
About
Reference mcp server implementation of draft mcp oauth spec https://modelcontextprotocol.io/specification/draft/basic/authorization#2-3-authorization-server-discovery
Explore
- Implements draft Authorization spec for MCP.
- Supports two authentication providers: Cognito and Keycloak.
- Validates scope mcp:access and <resource-id>/mcp:access.
- Includes a companion Postman collection for testing.
- Provides environment variable overrides for local development.
There are two separate auth provider options:
1. Cognito
2. Keycloak (self-hosted)
We validate the scope: mcp:access, with <resource-id>/mcp:access. For example, https://mcp-server.com/mcp:access
1. Build and start the server:
npm i
npm run build
npm run start
2. The MCP server will start on port 1335.
3. In another terminal, create the ngrok tunnel to the MCP server:
ngrok http --domain=<get-a-custom-domain-from-ngrok(free)-and-place-here> 1335
4. Configure this resource server in the Domains tab of your AWS Cognito dashboard
This is a reference MCP Server implementation of the draft Authorization spec updates using the official typescript sdk.
This repo can be used with this Postman collection
Authentication Providers
There are two separate auth provider options:
1. Cognito
2. Keycloak (self-hosted)
We validate the scope: mcp:access, with <resource-id>/mcp:access. For example, https://mcp-server.com/mcp:access
Important Note
Keep in mind that OAuth 2.1 doesn't allow http protocol, so you will want to use ngrok with a static url (available for free from ngrok) to properly test this out.
If you want to use localhost without ngrok because you don't care, you can override the PORT and PROTOCOL env variables for the authorization and resource servers by setting them in .envs (check config folder if you're confused)
Setup with ngrok
1. Build and start the server:
npm i
npm run build
npm run start
2. The MCP server will start on port 1335.
3. In another terminal, create the ngrok tunnel to the MCP server:
ngrok http --domain=<get-a-custom-domain-from-ngrok(free)-and-place-here> 1335
4. Configure this resource server in the Domains tab of your AWS Cognito dashboard
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
