Which integrations are available for this server?

Integrates with Auth0 for OIDC-based authentication, role-based access control (sales-rep vs sales-manager), and on-behalf-of token exchange to delegate user identity to a downstream CRM API.

How do I use Auth0 MCP Server Demo — CRM?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Auth0 MCP Server Demo — CRM show me my contacts" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Auth0 MCP Server Demo — CRM

by sohnithakkar

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

Auth0 MCP Server Demo — CRM

A demo showing how to secure an MCP server with Auth0 using:

FastMCP Auth0Provider — OIDC proxy so any MCP client (Claude Desktop, MCP Inspector) gets a standard browser-based OAuth login without manual token handling
Role-Based Access Control — sales-rep (read-only) vs sales-manager (full access)
On-Behalf-Of Token Exchange — MCP server exchanges the user's token for a CRM API-scoped token, proving the agent acts with delegated user identity

MCP Client → FastMCP (OIDC proxy) → Auth0 Universal Login
                  ↓
         JWT validated, permissions checked
                  ↓
         OBO exchange → CRM API token
                  ↓
         Tool result + delegation proof

Architecture

Package	Port	Stack	Purpose
`packages/mcp-server`	3010	Python + FastMCP	MCP server with Auth0 OAuth proxy + OBO
`packages/crm-api`	3011	Node.js + Express	Mock CRM REST API (downstream service)

Related MCP server: identity-aware-mcp-server

Auth Flow

MCP client connects to http://localhost:3010/mcp
FastMCP redirects to Auth0 Universal Login
User authenticates — FastMCP validates the token and extracts permissions
On each tool call, the MCP server performs RFC 8693 Token Exchange to get a CRM-scoped token
Every tool response includes a delegation block proving who the agent is acting as

Demo Roles

Role	Permissions	Can Do
`sales-rep`	`crm:read`	List/view contacts and deals
`sales-manager`	`crm:read` + `crm:write`	Full CRUD

Prerequisites

Node.js 20+
Python 3.11+
An Auth0 tenant
AWS CLI (for CIMD hosting on S3/CloudFront)

Setup

1. Install dependencies

npm install
pip3 install -r packages/mcp-server/requirements.txt

2. Host the CIMD document

The CIMD document proves domain ownership when registering the MCP server with Auth0:

npm run deploy:cimd    # provisions S3 + CloudFront + Route53 at mcp.authgatekeeper.com

3. Configure Auth0

# Get a Management API token from:
# Auth0 Dashboard → Applications → APIs → Auth0 Management API → API Explorer

AUTH0_MANAGEMENT_TOKEN=<token> npm run setup:auth0

Copy the printed values into your root .env.

4. Configure OBO token exchange

# After creating the Custom API client in Auth0:
AUTH0_MANAGEMENT_TOKEN=<token> npx tsx scripts/setup-obo.ts

5. Start

npm run dev

Testing

MCP Inspector

npx @modelcontextprotocol/inspector

Connect to http://localhost:3010/mcp — FastMCP handles the Auth0 login automatically.

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "crm": {
      "command": "npx",
      "args": ["mcp-remote", "http://localhost:3010/mcp"]
    }
  }
}

Available Tools

Tool	Permission	Description
`whoami`	any	Show identity + full delegation chain
`list_contacts`	`crm:read`	List contacts, filter by status
`get_contact`	`crm:read`	Get contact by ID
`create_contact`	`crm:write`	Create a new contact
`list_deals`	`crm:read`	List deals, filter by stage or contact
`get_deal`	`crm:read`	Get deal by ID
`create_deal`	`crm:write`	Create a new deal

Test Users

Email	Password	Role
`sarah.rep@demo.com`	`DemoPass1!`	sales-rep (`crm:read`)
`mike.manager@demo.com`	`DemoPass1!`	sales-manager (`crm:read` + `crm:write`)

Scripts

Script	Purpose
`npm run setup:auth0`	Provision Auth0 tenant (APIs, apps, roles, users)
`npm run deploy:cimd`	Deploy CIMD document to S3/CloudFront
`npm run update:cimd`	Re-upload CIMD document after changes
`npx tsx scripts/setup-obo.ts`	Configure OBO token exchange client
`npx tsx scripts/fix-permissions.ts`	Re-assign role permissions (run after audience change)

Project Structure

mcp-server-auth/
├── packages/
│   ├── mcp-server/
│   │   ├── server.py          # FastMCP server — tools + Auth0 OIDC proxy + OBO
│   │   └── requirements.txt
│   └── crm-api/
│       └── src/
│           ├── index.ts       # Express API with JWT validation
│           └── data.ts        # In-memory contacts and deals
├── scripts/
│   ├── setup.ts               # Auth0 tenant provisioning
│   ├── setup-obo.ts           # OBO client configuration
│   ├── fix-permissions.ts     # Role permission repair utility
│   └── deploy-cimd.sh         # AWS S3/CloudFront/Route53 deployment
└── .env.example

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

MANDATE Credential Broker B
io.github.projetnanocorp
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Security
111
StytchOAuth
dev.stytch.mcp
The Stytch MCP server is a reference implementation that demonstrates remote MCP server authentication and authorization using Stytch Connected Apps. It provides OAuth 2.1-compliant authorization (including PKCE), Dynamic Client Registration, and validates Stytch-issued access tokens to enable AI agents to securely interact with external services through permissioned access, supporting scopes like openid, email, profile, and manage:project_data.
Security Autonomous Agents App Automation
2
cortex-gatewayOAuth
io.github.wellknownmcp
Self-hosted federated MCP gateway: one OAuth 2.1 MCP server in front of N apps, user-level scopes.
Security Developer Tools
212
Sensact
io.github.sensact-agents
An authenticated remote MCP server for user-owned devices and one-shot capability invocation.
OS Automation App Automation
2

Related MCP Servers

enterprise-auth-mcp-server
Security Developer Tools
AiAgentKarl
A
license
A
quality
D
maintenance
MCP server for enterprise authentication and authorization — JWT validation, OIDC token inspection, OAuth 2.0 introspection, and role-based access control for AI agents.
Updated 5 months ago (2026-04-06 08:37 UTC)
8
MIT
identity-aware-mcp-server
Security Developer Tools
pravin-khandke
F
license
Not graded
quality
D
maintenance
A production-ready MCP server that authenticates agents via OAuth 2.1 Bearer tokens, validates JWTs with JWKS, enforces tool-level scopes and roles, and logs the full delegation chain.
Updated 3 months ago (2026-06-14 03:10 UTC)
-
mcp_auth_server
Security API Testing
dawa
F
license
Not graded
quality
D
maintenance
A proof-of-concept MCP server implementing OAuth 2.1 authorization with CIMD client registration and PKCE, demonstrating protected resource access and step-up authentication.
Updated 3 months ago (2026-06-19 15:28 UTC)
-
Auth0 OIDC MCP Server
Security Cloud Platforms
KevinJoback
F
license
Not graded
quality
C
maintenance
This MCP server requires user authentication via Auth0 and then enables calling protected APIs (e.g., a Todos API) on behalf of the user.
Updated 3 months ago (2026-06-26 20:19 UTC)
-

Auth0 MCP Server Demo — CRM

Architecture

Auth Flow

Demo Roles

Prerequisites

Setup

1. Install dependencies

2. Host the CIMD document

3. Configure Auth0

4. Configure OBO token exchange

5. Start

Testing

MCP Inspector

Claude Desktop

Available Tools

Test Users

Scripts

Project Structure

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

enterprise-auth-mcp-server

identity-aware-mcp-server

mcp_auth_server

Auth0 OIDC MCP Server