JavaScript MCP Auth Server

This package shows the remote MCP auth boundary in JavaScript:

• Express HTTP server

• MCP Streamable HTTP transport at /mcp

• Protected Resource Metadata

• Bearer token middleware

• Keycloak token introspection

• audience validation

• mcp:tools scope enforcement

• protected add_numbers and server_status tools

Run

pnpm mcp-auth-server-js install
cp .env.example .env
pnpm mcp-auth-server-js demo:keycloak
pnpm mcp-auth-server-js start

For the demo, configure Keycloak with:

• client scope: mcp:tools

• MCP server confidential client: mcp-server

• demo client/user for obtaining an access token

• token audience: http://localhost:3000/mcp

Related MCP server: identity-aware-mcp-server

Demo Scripts

pnpm mcp-auth-server-js demo:no-token
pnpm mcp-auth-server-js demo:metadata
pnpm mcp-auth-server-js demo:get-token
pnpm mcp-auth-server-js demo:call-tool
pnpm mcp-auth-server-js demo:bad-scope

The important point is the failure order:

1. no token returns 401 with WWW-Authenticate

2. metadata tells the client where auth lives

3. token introspection rejects inactive tokens

4. audience validation rejects tokens for another API

5. scope validation rejects tokens without mcp:tools