Skip to main content
Glama
Sign In
JavaScript MCP Auth Server

JavaScript MCP Auth Server

by kabirrajsingh
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

JavaScript MCP Auth Server

This package shows the remote MCP auth boundary in JavaScript:

  • Express HTTP server

  • MCP Streamable HTTP transport at /mcp

  • Protected Resource Metadata

  • Bearer token middleware

  • Keycloak token introspection

  • audience validation

  • mcp:tools scope enforcement

  • protected add_numbers and server_status tools

Run

pnpm mcp-auth-server-js install
cp .env.example .env
pnpm mcp-auth-server-js demo:keycloak
pnpm mcp-auth-server-js start

For the demo, configure Keycloak with:

  • client scope: mcp:tools

  • MCP server confidential client: mcp-server

  • demo client/user for obtaining an access token

  • token audience: http://localhost:3000/mcp

Related MCP server: mcp-keycloak

Demo Scripts

pnpm mcp-auth-server-js demo:no-token
pnpm mcp-auth-server-js demo:metadata
pnpm mcp-auth-server-js demo:get-token
pnpm mcp-auth-server-js demo:call-tool
pnpm mcp-auth-server-js demo:bad-scope

The important point is the failure order:

  1. no token returns 401 with WWW-Authenticate

  2. metadata tells the client where auth lives

  3. token introspection rejects inactive tokens

  4. audience validation rejects tokens for another API

  5. scope validation rejects tokens without mcp:tools

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    This server cannot be deployed

    Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • identity-aware-mcp-server

      pravin-khandke
      F
      license
      Not graded
      quality
      D
      maintenance
      A production-ready MCP server that authenticates agents via OAuth 2.1 Bearer tokens, validates JWTs with JWKS, enforces tool-level scopes and roles, and logs the full delegation chain.
      -

    • mcp-keycloak

      ndigrazia
      F
      license
      Not graded
      quality
      D
      maintenance
      Enables secure MCP tool calls (add and multiply numbers) by validating OAuth2 tokens via Keycloak token introspection.
      -

    • mcp-gateway

      R0Wi
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables clients to access multiple backend MCP servers through a single endpoint, with OAuth 2.1 authorization, namespaced tools, and secure credential management.
      2
      MIT

    • mcp-oidc-proxy

      Pappa
      F
      license
      B
      quality
      B
      maintenance
      Enables MCP clients to authenticate through OIDC and call protected tools while rejecting unauthenticated requests.
      26
      -