MCP Server + Asgardeo

Asgardeo authenticates users accessing the MCP server and allows you to control tool access based on application-level and organization-level permissions defined for each user.

- Acts as OAuthServerto your MCP clients
- Acts as OAuth/OIDCClientto your Asgardeo organization

Before you start make sure you have the following prerequisites:

Then, select Traditional Web Application and complete the wizard popup by providing the following given name and the authorized redirect URL.(Ensure that the protocol remains set to OpenID Connect (OIDC).)

Note-Thehttp://localhost:8788/callbackis only used during the local testing, the callback URL from Cloudflare deployment will be added at a later stage.

Make a note of the following values from theProtocolandInfotabs of the registered application.

- client-idfrom theProtocoltab.
- client-secretfrom theProtocoltab.
- YourAsgardeo organization name

Clone the repo directly & install dependencies using the following given instructions.

# Clone the repository git clone https://github.com/sagara-gunathunga/cloudflare-mcp-asgardeo # Move to the demo project directory cd demo-mcp-server ## Install dependencies npm install

Next, create a.dev.varsfile in your project root with the following values.

# .dev.vars ASGARDEO_CLIENT_ID=<client-id from the previous step> ASGARDEO_CLIENT_SECRET=<client-secret from the previous step> ASGARDEO_BASE_URL=https://api.asgardeo.io/t/<Asgardeo organization name> ASGARDEO_SCOPE=openid profile email roles

Run the server locally to make it available athttp://localhost:8788

To test the local server, switch the Transport Type toSSEand enterhttp://localhost:8788/ssein the Inspector and hit connect. Once you follow the prompts, you’ll be able to authenticate with Asgardeo and use features such as “List Tools” in the Inspector. When you invoke the userInfo tool, you should see results similar to the example shown in the screenshot below.

For example, try asking the LLM:“Who am I?”

First, create a KV namespace in Cloudflare using the following command.

npx wrangler kv namespace create OAUTH_KV

Make sure to updatewrangler.jsoncfile with theidvalue received after running the above command.

For example, try asking the LLM:“Who am I?”

To connect Cursor with your MCP server, chooseType: "Command" and in theCommandfield, combine the command and args fields into one (e.g.npx mcp-remote https://<your-worker-name>.<your-subdomain>.workers.dev/sse).

Note that while Cursor supports HTTP+SSE servers, it doesn't support authentication, so you still need to usemcp-remote(and to use a STDIO server, not an HTTP one).

You can connect your MCP server to other MCP clients like Windsurf by opening the client's configuration file, adding the same JSON that was used for the Claude setup, and restarting the MCP client.

This MCP server usesAsgardeofor both authentication and access control.

- Allauthenticated usershave access to theuserInfotool.
- Users with themanagerrolecan access thegetDirectReporteestool. For others, this tool will not be visible.

Access the remote MCP server from Claude Desktop

Open Claude Desktop and navigate to Settings -> Developer -> Edit Config. This opens the configuration file that controls which MCP servers Claude can access.

Replace the content with the following configuration. Once you restart Claude Desktop, a browser window will open showing your OAuth login page. Complete the authentication flow to grant Claude access to your MCP server. After you grant access, the tools will become available for you to use.