여기서 가치를 찾으셨다면, 주연을 고려해 주세요.

개요

• MCP 서버용 드롭인 OAuth 2.1/OIDC 게이트웨이 — 앞에 두면 코드 변경 없음.
• 당신의 IdP, 선택하세요: Google, GitHub 또는 OIDC 제공자 — 예: Okta, Auth0, Azure AD, Keycloak — 그리고 선택적 비밀번호.
• 유연한 사용자 매칭: 사용자 권한을 위한 정확한 매칭 및 글롭 패턴 지원 (예: *@company.com)
• 로컬 MCP 서버를 안전하게 게시하기: 모든 stdio, SSE, HTTP 전송을 지원합니다. stdio의 경우 트래픽은 /mcp로 변환됩니다. SSE/HTTP는 있는 그대로 프록시됩니다. 물론 인증이 필요합니다.
• 주요 MCP 클라이언트 전반에 걸쳐 검증됨: Claude, Claude Code, ChatGPT, GitHub Copilot, Cursor 등 — 프록시는 클라이언트별 특이점들을 부드럽게 만들어 일관된 인증에 기여합니다.

---

📖 자세한 사용법, 구성 및 예제는 문서를 참조하세요

퀵스타트

도메인 결속 및 80/443은 외부에서 접근 가능해야 합니다.

릴리스 페이지에서 바이너리 다운로드.

Stdio 트랜스포트를 사용한다면

그게 전부입니다! 이제 HTTP 엔드포인트가 https://{your-domain}/mcp에서 사용 가능합니다.

• stdio (명령어가 지정된 경우): MCP 엔드포인트는 https://{your-domain}/mcp.

MCP Auth Proxy

If you found value here, please consider starring.

Overview

• Drop-in OAuth 2.1/OIDC gateway for MCP servers — put it in front, no code changes.
• Your IdP, your choice: Google, GitHub, or any OIDC provider — e.g. Okta, Auth0, Azure AD, Keycloak — plus optional password.
• Flexible user matching: Support exact matching and glob patterns for user authorization (e.g., *@company.com)
• Publish local MCP servers safely: Supports all stdio, SSE, and HTTP transports. For stdio, traffic is converted to /mcp. For SSE/HTTP, it’s proxied as-is. Of course, with authentication.
• Verified across major MCP clients: Claude, Claude Code, ChatGPT, GitHub Copilot, Cursor, etc. — the proxy smooths client-specific quirks for consistent auth.

---

📖 For detailed usage, configuration, and examples, see the Documentation

Quickstart

Domain binding & 80/443 must be accessible from outside.

Download binary from release page.

If you use stdio transport

./mcp-auth-proxy \
  --external-url https://{your-domain} \
  --tls-accept-tos \
  --password changeme \
  -- npx -y @modelcontextprotocol/server-filesystem ./

That’s it! Your HTTP endpoint is now available at https://{your-domain}/mcp.

• stdio (when a command is specified): MCP endpoint is https://{your-domain}/mcp.
• SSE/HTTP (when a URL is specified): MCP endpoint uses the backend’s original path (no conversion).

Already have certificates? Pass --tls-cert-file and --tls-key-file instead of --tls-accept-tos.

Why not MCP Gateway?

mcp-auth-proxy: A lightweight proxy that adds authentication to any MCP server (optional stdio→HTTP(S) conversion)
MCP Gateway: A hub to orchestrate multiple MCP servers (aggregation, catalog integration)

When to choose mcp-auth-proxy

• You just need to add auth to one or a few MCPs (enforce OAuth/OIDC/password-only)
• Catalog integration and aggregation aren’t needed (e.g., self-hosted or independently managed MCP deployments)

When to choose MCP Gateway

• You need to manage multiple MCPs centrally (aggregation, policies/permissions, auditing, centralized logging)
• You want catalog integration and aggregation

Note: They are not mutually exclusive. You can put mcp-auth-proxy in front of a Gateway’s public endpoint to enforce authentication if the Gateway itself doesn’t handle it.

TL;DR: Orchestrate many → Gateway / Expose safely & quickly → mcp-auth-proxy

Verified MCP Client