oidebrett/mcpauth

MCPAuth: Gateway Authentication for Secure Enterprise MCP Integrations
## MCPAuth: Gateway Authentication for Secure Enterprise MCP Integrations
McpAuth is the authentication and authorization component of the MCP Gateway Proof of Concept (PoC) described in the paper:
> Simplified and Secure MCP Gateways for Enterprise AI Integration
> Ivo Brett, CISSP, B.Eng, MSc
> View Paper (2025)
This repository is part of a broader initiative to enable secure, scalable, and compliant enterprise integration with the Model Context Protocol (MCP). See the website SelfHostedMCP.com. It provides an extensible OAuth2.1-based authentication gateway that offloads identity, authorization, and policy management from backend MCP servers—ensuring conformance with the 2025-03-26 MCP Specification.
### Purpose
McpAuth is designed to:
Decouple security logic from MCP servers
Centralize identity management using OAuth 2.1 & OIDC
Support dynamic client registration
Enforce fine-grained token scopes and policy controls
Act as a composable module in enterprise-grade Zero Trust architectures
### Background
This implementation is part of a larger PoC that validates:
A reference MCP Gateway architecture for secure deployments
Threat model mapping aligned with frameworks such as MAESTRO and Narajala & Habler
Real-world compatibility with tools like Cloudflare Tunnels, WireGuard, Traefik, and CrowdSec
The full proof of concept includes:
Two isolated MCP servers (local and cloud-based)
Secure tunneling via WireGuard and Pangolin
Centralized intrusion detection and observability
Seamless integration with Anthropic's MCP Inspector
## Features
OAuth2 authentication with PKCE via Traefik forwardAuth
Seamless integration with MCP Gateway SSE endpoints
Email whitelisting for controlled access
Docker-ready, easy to deploy
Includes a Python-based test server
## Quick Start (assuming a completely standalone working environment)
### Set Up Google OAuth
Go to the Google Cloud Console
Navigate to APIs & Services > Credentials
Click Create Credentials → OAuth client ID
Choose Web Application
Add an Authorized redirect URI — you’ll get this later when you set up Traefik, but it will look like:
https://oauth.yourdomain.com/callback
Save the Client ID and Client Secret for later use.
### Alternative: Set Up Keycloak OAuth
MCPAuth now supports Keycloak as an identity provider. This is useful for enterprise environments that want to use their existing Keycloak infrastructure.
For complete MCP + Keycloak setup instructions, see the official guide: MCP Security Authorization with Keycloak
#### Detailed Keycloak Client Configuration
##### 1. Create a Keycloak Realm
Use an existing realm (e.g., master) or create a new one
##### 2. Create and Configure the Client
Basic Settings:
Go to your realm → Clients → Create
Client ID: mcp-server (or your preferred ID)
Client Protocol: openid-connect
Access Type / Client Authentication: confidential
Save the client
Settings Tab:
Valid Redirect URIs (add ALL of these):
https://oauth.yourdomain.com/callback
http://localhost:/oauth/callback
http://localhost:/oauth/callback/debug
Explanation:
First line: Production callback for your mcpauth server