Secured MCP Server with Spring AI

A demonstration of securing a Model Context Protocol (MCP) server using Spring Authorization Server and GitHub OAuth2. Users authenticate with GitHub, receive a JWT token, and use it to call secured MCP tools.

Based on the article by Daniel Garnier-Moiroux: https://spring.io/blog/2025/09/30/spring-ai-mcp-server-security

Architecture

┌─────────────┐
│   GitHub    │ (Identity Provider)
└──────┬──────┘
       │
       ▼
┌────────────────────────┐
│  Authorization Server  │ (Port 9000)
│  - GitHub OAuth Login  │
│  - Issues JWT tokens   │
└──────┬─────────────────┘
       │
       ▼
┌─────────────┐  Authorization: Bearer    ┌──────────────┐
│ MCP Client  │──────────────────────────────► │  MCP Server  │ (Port 8080)
└─────────────┘                                │  - 2 Tools   │
                                               └──────────────┘

Project Structure

mcps/
├── pom.xml                                   # Parent POM
├── mvnw                                      # Maven wrapper
│
├── authorization-server/                     # Port 9000
│   └── src/main/java/dev/danvega/authserver/
│       ├── AuthServerApplication.java        # Main application
│       ├── SecurityConfig.java               # OAuth2 + GitHub login
│       └── application.yml                   # Configuration
│
└── mcp-server/                               # Port 8080
    └── src/main/java/dev/danvega/mcps/
        ├── Application.java                  # Main application
        ├── McpServerSecurityConfig.java      # JWT validation
        └── McpToolsService.java              # MCP tools (echo, getCurrentUser)

Quick Start

1. Prerequisites

• Java 21+
• Maven 3.6+
• GitHub account

2. Create a GitHub OAuth App

1. Go to GitHub Developer Settings
2. Create a New OAuth App:
   • Application name: MCP Authorization Server
   • Homepage URL: http://localhost:9000
   • Callback URL: http://localhost:9000/login/oauth2/code/github
3. Save the Client ID and Client Secret

3. Set Environment Variables

export GITHUB_CLIENT_ID="your-github-client-id"
export GITHUB_CLIENT_SECRET="your-github-client-secret"

4. Build and Run

# Build both modules
./mvnw clean install

# Terminal 1: Start Authorization Server (must start first!)
./mvnw spring-boot:run -pl authorization-server

# Terminal 2: Start MCP Server
./mvnw spring-boot:run -pl mcp-server

The authorization server runs on port 9000, MCP server on port 8080.

Testing with MCP Inspector

The MCP Inspector tool provides an easy way to test the complete OAuth2 flow and interact with your secured MCP server.

Available MCP Tools