MCP with OAuth
@akshay12390
About MCP with OAuth
Forked from
Config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"mcp-weather-starter-webmvc-oauth2-server": {
"command": "npx",
"args": [
"@modelcontextprotocol/[email protected]"
]
}
}
}Tools
No tools detected
Fetch the live tool list by running this server in a temporary sandbox using the button above.
Overview
What is MCP with OAuth?
A sample project demonstrating how to secure an MCP server using OAuth2, following the MCP specification’s authorization section. It is built with Spring Boot and Spring Security.
How to use MCP with OAuth?
Run the server with ./mvnw spring-boot:run. Obtain an access token by calling POST /oauth2/token with grant_type=client_credentials and the client ID/secret oidc-client:secret. Then paste the token into the MCP Inspector (v0.6.0) to connect.
Key features of MCP with OAuth
- OAuth2 client credentials flow for token issuance
- Token validation via Spring Security OAuth2 Resource Server
- Token expiration set to 5 minutes
- Works only in the servlet stack (no reactive support for token issuance)
Use cases of MCP with OAuth
- Securing an MCP server with standard OAuth2 tokens
- Testing MCP Inspector connectivity with token‑authenticated endpoints
- Demonstrating Spring Authorization Server integration with MCP
FAQ from MCP with OAuth
How do I obtain an access token?
Send a POST request to http://localhost:8080/oauth2/token with grant_type=client_credentials and use Basic auth with credentials oidc-client:secret.
What are the required dependencies?
Spring Security for infrastructure, Spring Authorization Server for issuing tokens, and Spring Security OAuth2 Resource Server for authenticating tokens.
How long is the token valid?
The token is valid for only 5 minutes.
Does this work with reactive (WebFlux) applications?
No, Spring Authorization Server does not support the reactive stack for issuing tokens. Token issuance works only in the Servlet environment.
Frequently asked questions
How do I obtain an access token?
Send a POST request to `http://localhost:8080/oauth2/token` with `grant_type=client_credentials` and use Basic auth with credentials `oidc-client:secret`.
What are the required dependencies?
Spring Security for infrastructure, Spring Authorization Server for issuing tokens, and Spring Security OAuth2 Resource Server for authenticating tokens.
How long is the token valid?
The token is valid for only 5 minutes.
Does this work with reactive (WebFlux) applications?
No, Spring Authorization Server does not support the reactive stack for issuing tokens. Token issuance works only in the Servlet environment.
Basic information
More Developer Tools MCP servers
Skycloak
Manage your Skycloak-hosted Keycloak: clusters, realms, apps, SSO and users, from any MCP client.
BetterBugs
BetterBugsThe BetterBugs MCP (Model Context Protocol) enables you to load BetterBugs bug reports (via report links) directly to your preferred AI Agents and developer environments with MCP Client capabilities (such as Cursor, VS C
Agent Conductor
icohangar-opsAgent conductor — AGENTS.md contract parser, SKILL.md registry, CHP decision engine over MCP
Raccha AI
Shree MandadiMCP-first toolbox for agents: namespaced key-value storage, a FIFO queue, auth, and a handful of stateless utility tools (JWT decode, hashing, cert inspection, CIDR math). Free while in early access. This repository is a
ZeroBeacon — 1000-Tool Collision-Proof Commerce Router
DavidFox998ZeroBeacon.ai — Collision-proof commerce router for AI agents. 1000 MCP tools: commerce, trust, billing, sovereign ID + everyday tools. LIVE.
Comments