MCP Server MCP

MCP Server Auth Template

By github 👁 1 views ▲ 0 votes

OAuth 2.1/OIDC resource-server reference for secure MCP authorization

Homepage Verified source GitHub

Install

oci:ghcr.io/brunovicco/mcp-server-auth-template:v0.6.2

Configuration Example

{
  "remotes": [],
  "packages": [
    {
      "registryType": "oci",
      "identifier": "ghcr.io/brunovicco/mcp-server-auth-template:v0.6.2",
      "runtimeHint": "docker",
      "transport": {
        "type": "streamable-http",
        "url": "http://127.0.0.1:8000/mcp"
      },
      "runtimeArguments": [
        {
          "type": "named",
          "name": "--read-only"
        },
        {
          "value": "/tmp:rw,noexec,nosuid,nodev,size=16m",
          "type": "named",
          "name": "--tmpfs"
        },
        {
          "value": "ALL",
          "type": "named",
          "name": "--cap-drop"
        },
        {
          "value": "no-new-privileges:true",
          "type": "named",
          "name": "--security-opt"
        },
        {
          "value": "127.0.0.1:8000:8000",
          "type": "named",
          "name": "--publish"
        }
      ],
      "environmentVariables": [
        {
          "description": "Protected-resource URL advertised by this deployment",
          "isRequired": true,
          "name": "MCP_SERVER_RESOURCE_SERVER_URL"
        },
        {
          "description": "Authorization-server adapter to use",
          "isRequired": true,
          "choices": [
            "entra",
            "generic"
          ],
          "name": "MCP_SERVER_AUTH_PROVIDER"
        },
        {
          "description": "JSON array of baseline delegated OAuth scopes",
          "default": "[\"mcp:tools:call\"]",
          "name": "MCP_SERVER_REQUIRED_SCOPES"
        },
        {
          "description": "Additional exact Host values accepted by the local container transport",
          "default": "[\"127.0.0.1:8000\"]",
          "name": "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS"
        },
        {
          "description": "Required when MCP_SERVER_AUTH_PROVIDER=entra",
          "name": "MCP_SERVER_ENTRA_TENANT_ID"
        },
        {
          "description": "Required when MCP_SERVER_AUTH_PROVIDER=entra",
          "name": "MCP_SERVER_ENTRA_AUDIENCE"
        },
        {
          "description": "Required when MCP_SERVER_AUTH_PROVIDER=entra",
          "name": "MCP_SERVER_ENTRA_APPLICATION_ID_URI"
        },
        {
          "description": "Required when MCP_SERVER_AUTH_PROVIDER=generic",
          "name": "MCP_SERVER_GENERIC_ISSUER_URL"
        },
        {
          "description": "Required when MCP_SERVER_AUTH_PROVIDER=generic",
          "name": "MCP_SERVER_GENERIC_AUDIENCE"
        },
        {
          "description": "Optional JSON array of explicitly trusted cross-origin JWKS origins",
          "default": "[]",
          "name": "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS"
        }
      ]
    }
  ]
}

mcp model-context-protocol oci