Support for OAuth Authenticated Remote Servers

[navinpai]

A popular way to authenticate remote MCP servers has been using oAuth, which is also part of the MCP protocol. A sample MCP Server that do this is Linear MCP Server

How does mcpadapt handle (or plan to adapt) these oAuth-authenticated MCP servers, both in standalone as well as when working in a library like langchain/crewai?

[grll]

Hey @navinpai we currently don't have a plan around this I would need to take some time and wrap my head around it. Or feel free to propose something if you feel like it. This is indeed an interesting feature that could be added.

[joejoe2]

Is there any example in mcp python sdk repo ?

[navinpai]

Is there any example in mcp python sdk repo ?

https://github.com/modelcontextprotocol/python-sdk/tree/main/examples/servers/simple-auth

[grll]

thanks for sharing the example it's very interesting!

The issue I see is that from my understanding, it looks specific to that use case of github oauth I am not sure how well does it generalize to other providers.
Also there are a lot of oauth implementations out there / libraries I am not sure it should be on MCPadapt to reimplement the OAuth protocol internally probably we should use something existing to bring auth support.

What do you think?

[grll]

For example this could be promising: https://github.com/authlib/authlib

[grll]

I have been reading quite a lot today at both example in the official sdk. And overall documentation of the protocol for authentication support.

I think we could implement something closer to the client-auth example instead of the server example linked above. The issue I see at the moment is that in the oauth flow, the MCP client needs to prompt the user to go to the auth provider url, fill in a login / consent form. We would need to somehow coordinate with the various framework integration to make that seamless in their framework.

Maybe the default behavior without any framework integration could be to print the url in the console and ask the user to go to the link and we could make the program wait until the callback is called or timeout.

[joejoe2]

modelcontextprotocol/python-sdk#751 Maybe we can investigate this first ?

[grll]

modelcontextprotocol/python-sdk#751 Maybe we can investigate this first ?

Yes this is exactly what I was looking at

[amithkk]

Assuming this is still of interest? If so, I'd like to pick it up.

[grll]

Assuming this is still of interest? If so, I'd like to pick it up.

Hey for sure! Happy to review your implementation plan if you need

[amithkk]

I was thinking of an implementation very close to modelcontextprotocol/python-sdk#751 , but with unified handling for API Keys, Bearer Tokens and MCPAdapt managed OAuth.

So essentially, it'd boil down to

• Exposing the OAuthClientProvider with some "sane defaults" for the redirect, callback handler (OAuthHandler) and the token store that use local browser auth
  • Consumers of MCPAdapt can chose to use the bundled implementations for experimenting or for local use cases, or implement their own OAuthHandler and TokenStore that integrates with the secret stores and authentication mechanisms of the app that they are building
• Having an equivalent APIKeyAuthProvider and BearerAuthProvider to maintain similar semantics for the other sorts of auth. If the consumer wants to implement OAuth on their own (in case they have a nonstandard implementation not covered by the MCP Spec), they can do so using the BearerAuthProvider.

PR With Docs, Tests and and Examples coming in a bit 😄