Skip to main content
Glama
kabirrajsingh

JavaScript MCP Auth Server

by kabirrajsingh
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

JavaScript MCP Auth Server

This package shows the remote MCP auth boundary in JavaScript:

  • Express HTTP server

  • MCP Streamable HTTP transport at /mcp

  • Protected Resource Metadata

  • Bearer token middleware

  • Keycloak token introspection

  • audience validation

  • mcp:tools scope enforcement

  • protected add_numbers and server_status tools

Run

pnpm mcp-auth-server-js install
cp .env.example .env
pnpm mcp-auth-server-js demo:keycloak
pnpm mcp-auth-server-js start

For the demo, configure Keycloak with:

  • client scope: mcp:tools

  • MCP server confidential client: mcp-server

  • demo client/user for obtaining an access token

  • token audience: http://localhost:3000/mcp

Related MCP server: MCP OAuth Test

Demo Scripts

pnpm mcp-auth-server-js demo:no-token
pnpm mcp-auth-server-js demo:metadata
pnpm mcp-auth-server-js demo:get-token
pnpm mcp-auth-server-js demo:call-tool
pnpm mcp-auth-server-js demo:bad-scope

The important point is the failure order:

  1. no token returns 401 with WWW-Authenticate

  2. metadata tells the client where auth lives

  3. token introspection rejects inactive tokens

  4. audience validation rejects tokens for another API

  5. scope validation rejects tokens without mcp:tools

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • identity-aware-mcp-server

    pravin-khandke
    F
    license
    Not graded
    quality
    D
    maintenance
    A production-ready MCP server that authenticates agents via OAuth 2.1 Bearer tokens, validates JWTs with JWKS, enforces tool-level scopes and roles, and logs the full delegation chain.
    -

  • MCP OAuth Test

    emave
    F
    license
    Not graded
    quality
    B
    maintenance
    Multi-tenant MCP server with OAuth 2.1 authorization, enabling tenant-scoped tool access and audit logging.
    -

  • mcp-keycloak

    ndigrazia
    F
    license
    Not graded
    quality
    C
    maintenance
    Enables secure MCP tool calls (add and multiply numbers) by validating OAuth2 tokens via Keycloak token introspection.
    -

  • mcp-use Scalekit MCP Auth

    scalekit-developers
    A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server demonstrating OAuth 2.1 authentication with Scalekit, enabling per-user identity in MCP tools through JWT verification.
    MIT