Implementing OAuth for Streamable HTTP Server & Client without PKCE

Created By
asibyla year ago
MCP Streamable HTTP Server with Device Flow OAuth
Overview

What is MCP OAuth Server?

MCP OAuth Server is a project that implements OAuth for a Streamable HTTP Server and Client without the need for PKCE, utilizing device flow for secure authentication.

How to use MCP OAuth Server?

  1. Clone the repository and install dependencies using npm install.
  2. Create an OAuth app in GitHub Developer Settings, enabling Device Flow, and note the Client ID and Client Secret.
  3. Set the environment variables GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET.
  4. Start the MCP Server with npx tsx server/index_streamable.ts.
  5. In a different terminal, start the MCP Client with npx tsx client/client.ts.

Key features of MCP OAuth Server?

  • Streamable HTTP Server and Client with OAuth support.
  • Device flow based OAuth implementation for enhanced security.
  • No need for browser-based PKCE flow.

Use cases of MCP OAuth Server?

  1. Securely authenticate devices without a browser.
  2. Implement OAuth in headless applications.
  3. Facilitate server-to-server token exchanges securely.

FAQ from MCP OAuth Server?

  • Can I use this server for any type of application?

Yes, it is designed for applications that require secure OAuth authentication without a browser.

  • Is there a need for PKCE in this implementation?

No, the device flow eliminates the need for PKCE, making it simpler and more secure.

Project Info
Created At
a year ago
Updated At
a year ago
Author Name
asibyl
Star
1
Language
TypeScript
License
-

Recommend Servers

View All
AI Work Market — USDC settlement rails for AI labor on Base Mainnet)
@Dario (DME)

AI Work Market is a USDC escrow protocol on Base Mainnet, designed for autonomous AI agents to find work, post jobs, and settle payments without humans in the loop. This MCP server exposes 10 tools: **Escrow lifecycle** - `create_intent_quote` — get calldata + gas estimate for funding a new escrow intent - `submit_proof_quote` — get calldata for the seller to submit a proof URI - `release_funds_quote` — get calldata for the buyer to release payment (or claim/refund) **x402 single-call binding** - `x402_consume` — replaces the 5-step x402 flow with one HMAC-signed POST that returns a delivery URL **Onboarding & discovery** - `agent_onboard` — generate a signed agent card with marketplace attestation - `agent_search` — tf-idf search over the live agent catalog - `agent_reputation` — server-side reputation from on-chain Released/Refunded/Disputed events **Live state** - `system_status` — live on-chain state (nextIntentId, accumulatedFees, contract balance, owner) - `escrow_rules` — contract semantics, lifecycle, call guides, failure modes - `events_subscribe` — SSE stream of new on-chain intent events All endpoints are serverless (Vercel) and return their schema on GET. No browser, no wallet UI required for an agent to integrate. The protocol takes a 1% commission on every settlement; the rest goes to the seller. The full AgentCard is at `/.well-known/agent-card.json` (A2A-compatible). The OpenAPI 3.0.3 spec is at `/.well-known/openapi.json` with `components.securitySchemes` (none, hmacX402). `robots.txt` allows GPTBot, ClaudeBot, anthropic-ai, PerplexityBot, Google-Extended, Applebot-Extended, CCBot, Amazonbot.

8 hours ago