OAuth 2.1授权服务器，可为任意MCP（模型上下文协议）服务器添加认证功能，无需修改代码。该网关作为OAuth授权服务器，同时使用GitHub作为身份提供者（IdP）进行用户认证。

📖 查看文档🔧安装指南🏗️架构概述

⚠️ 重要通知

这是MCP协议的参考实现和测试平台。

• 主要目的：MCP协议开发和测试的参考实现
• 实验性质：作为未来MCP协议迭代的测试平台
• 安全免责声明：虽然本实现力求安全最佳实践，但可能包含漏洞和安全漏洞
• 生产警告：未经彻底安全审查，不建议用于生产环境
• 使用自负风险：这是用于开发和测试的实验性软件

🏗️ 建筑

概述

MCP OAuth 网关是 MCP 服务器的零修改认证层。它实现了 OAuth 2。

MCP OAuth Gateway

An OAuth 2.1 Authorization Server that adds authentication to any MCP (Model Context Protocol) server without code modification. The gateway acts as an OAuth Authorization Server while using GitHub as the Identity Provider (IdP) for user authentication.

📖 View Documentation | 🔧 Installation Guide | 🏗️ Architecture Overview

⚠️ Important Notice

This is a reference implementation and test platform for the MCP protocol.

• Primary Purpose: Reference implementation for MCP protocol development and testing
• Experimental Nature: Used as a test platform for future MCP protocol iterations
• Security Disclaimer: While this implementation strives for security best practices, this implementation likely contains bugs and security vulnerabilities
• Production Warning: NOT recommended for production use without thorough security review
• Use at Your Own Risk: This is experimental software intended for development and testing

🏗️ Architecture

Overview

The MCP OAuth Gateway is a zero-modification authentication layer for MCP servers. It implements OAuth 2.1 with dynamic client registration (RFC 7591/7592) and leverages GitHub as the identity provider for user authentication. The architecture follows these core principles:

• Complete Separation of Concerns: Authentication, routing, and MCP protocol handling are strictly isolated
• No MCP Server Modifications: Official MCP servers run unmodified, wrapped only for HTTP transport
• Standards Compliance: Full OAuth 2.1, RFC 7591/7592, and MCP protocol compliance
• Production-Ready Security: HTTPS everywhere, PKCE mandatory, JWT tokens, secure session management
• Dynamic Service Discovery: Services can be enabled/disabled via configuration

System Components

┌─────────────────────────────────────────────────────────────────────────────────────┐
│                                   EXTERNAL CLIENTS                                  │
│         (Claude.ai, MCP CLI tools, IDE extensions, Custom integrations)             │
└─────────────────────────────────────────────────────────────────────────────────────┘
                                           │
                                     HTTPS │ :443
                                           ↓
┌─────────────────────────────────────────────────────────────────────────────────────┐
│                               TRAEFIK REVERSE PROXY                                 │
│                          (Layer 1: Routing & TLS Termination)                       │
├─────────────────────────────────────────────────────────────────────────────────────┤
│ • Let's Encrypt automatic HTTPS certificates for all subdomains                     │