MMCPMarkets
OM

oidebrett/mcpauth

开发工具

本页由 AI 翻译，技术细节请以原文为准。 查看原文

32 stars 4 forks 质量 67 趋势 15NOASSERTION
Repository Install

用于外部认证和授权的MCP网关

概览

MCPAuth MCPAuth：用于安全企业MCP集成的网关认证 是论文中描述的概念验证（PoC）中的认证和授权组件： 企业AI集成的简化且安全MCP网关 查看论文（2025） 该仓库是更广泛倡议的一部分，旨在支持。详见网站 SelfHostedMCP.com。它提供了一个可扩展的基于OAuth2.1的认证网关，将身份、授权和策略管理从后端MCP服务器卸载出来，确保符合2025-03-26 MCP规范。 McpAuth 设计为：- 从MCP服务器使用 OAuth 2。

概述（AI 翻译）

MCPAuth MCPAuth：用于安全企业MCP集成的网关认证

MCPAuth：安全企业MCP集成的网关认证

McpAuth 是论文中描述的 MCP 网关概念验证（PoC）的认证和授权组件：

企业AI集成的简化且安全的MCP网关 Ivo Brett，CISSP，工程学士，理学硕士 View 论文（2025年）

该仓库是更广泛倡议的一部分，旨在实现安全、可扩展且合规的企业集成与模型上下文协议（MCP）。详见网站 SelfHostedMCP.com。它提供了一个可扩展的基于OAuth2.1的认证网关，将身份、授权和策略管理从后端MCP服务器卸载出来，确保符合2025-03-26 MCP规范。

目的

McpAuth 的设计目的是：

  • 将安全逻辑与MCP服务器解耦
  • **使用 OAuth 2.1 和 OIDC 集中管理身份管理
  • 支持动态客户端注册
  • 执行细粒度令牌范围和策略控制
  • 作为企业级零信任架构中的可组合模块

背景

本页由 AI 翻译，技术细节请以原文为准。

README

以下为原文 README 节选，完整内容请查看原文。

MCPAuth: Gateway Authentication for Secure Enterprise MCP Integrations

McpAuth is the authentication and authorization component of the MCP Gateway Proof of Concept (PoC) described in the paper:

Simplified and Secure MCP Gateways for Enterprise AI Integration
Ivo Brett, CISSP, B.Eng, MSc
View Paper (2025)

This repository is part of a broader initiative to enable secure, scalable, and compliant enterprise integration with the Model Context Protocol (MCP). See the website SelfHostedMCP.com. It provides an extensible OAuth2.1-based authentication gateway that offloads identity, authorization, and policy management from backend MCP servers—ensuring conformance with the 2025-03-26 MCP Specification.

Purpose

McpAuth is designed to:

  • Decouple security logic from MCP servers
  • Centralize identity management using OAuth 2.1 & OIDC
  • Support dynamic client registration
  • Enforce fine-grained token scopes and policy controls
  • Act as a composable module in enterprise-grade Zero Trust architectures

Background

This implementation is part of a larger PoC that validates:

  • A reference MCP Gateway architecture for secure deployments
  • Threat model mapping aligned with frameworks such as MAESTRO and Narajala & Habler
  • Real-world compatibility with tools like Cloudflare Tunnels, WireGuard, Traefik, and CrowdSec

The full proof of concept includes:

  • Two isolated MCP servers (local and cloud-based)
  • Secure tunneling via WireGuard and Pangolin
  • Centralized intrusion detection and observability
  • Seamless integration with Anthropic’s MCP Inspector

Features

  • OAuth2 authentication with PKCE via Traefik forwardAuth
  • Seamless integration with MCP Gateway SSE endpoints
  • Email whitelisting for controlled access
  • Docker-ready, easy to deploy
  • Includes a Python-based test server

Quick Start (assuming a completely standalone working environment)

Set Up Google OAuth

Go to the Google Cloud Console Navigate to APIs & Services > Credentials Click Create Credentials → OAuth client ID Choose Web Application Add an Authorized redirect URI — you’ll get this later when you set up Traefik, but it will look like: https://oauth.yourdomain.com/callback

在 GitHub 查看完整 README

安装

docker run -p 127.0.0.1:9080:8080 \
新手？先看 mcpskill.org 教程 →

配置

{ "mcpServers": { "protected-server": { "url": "https://your-mcp-server.com" } } }