Skip to content

janwilmake/universal-mcp-oauth

Repository files navigation

Warning

Please note: This repo consists of many smaller modules that can be used independently

Be advised: While some are stable and of high-quality, others are in active development and may still be buggy.

What is this?

This library lets your users login with any arbitrary MCP server trhough discovery, dynamic registration, authentication, authorization, and credential management.

Goals

  1. Specify required implementation for MCP-compatible Dynamic client registration that follows best practices of MCP Authorization and Security

  2. With that, Create a generic package that can easily be added to any Cloudflare Worker to allow the user to login to any website that supports this protocol.

Example usecases include:

  • A MCP client where the user can add an MCP by URL that then redirects the user to login (if needed).
  • A URL-based context editor that allows any URL, but if URL hosts allow for login, instruct user to login
  • Any other client where you want to support thousands of integrations without any maintenance.

Discuss

About CORS

The MCP Spec doesn't say anything about CORS implementation. Because of this, some MCP servers won't allow all origins, limiting browser implementations from functioning. Implementations like Claude.ai require frontend-based discoverability, but it's unclear if the registration should also be able to be done from browser-based clients. In the HTML Client example, I assume the well known files as well as DCR are able to be performed through the browser. Some servers won't allow for this, and it's not clear if this is intended. For a backend-based implementation (that does not encounter this problem) check Cloudflare Worker Client

For more info, see https://letmeprompt.com/specs-well-known-9nx2ll0

Used Context

Any implementation should leverage rfc8414 and rfc7591 to:

  1. Find info about if and how to oauth
  2. Register a client to get a client_id (and maybe secret)

Specs:

Prompts:

About

Universal MCP IdP (Identity Provider) - Support Thousands of Integrations, Zero Maintenance

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published