MCP.so
Sign In

Implementing OAuth for Streamable HTTP Server & Client without P…

@asibyl

Repository

About Implementing OAuth for Streamable HTTP Server & Client without P…

MCP Streamable HTTP Server with Device Flow OAuth

#oauth#http-server#streamable

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "streamable-http-server": {
      "command": "npx",
      "args": [
        "tsx",
        "server/index_streamable.ts"
      ],
      "env": {
        "GITHUB_CLIENT_ID": "",
        "GITHUB_CLIENT_SECRET": ""
      }
    }
  }
}

Tools

No tools detected

Fetch the live tool list by running this server in a temporary sandbox using the button above.

Overview

What is Implementing OAuth for Streamable HTTP Server & Client without PKCE?

A reference implementation that adds OAuth support to the Streamable HTTP Server and Client using the device authorization grant flow (device flow) instead of browser-based redirects. It integrates with GitHub as the OAuth provider and is intended for developers who need headless OAuth authentication for MCP (Model Context Protocol) servers.

How to use Implementing OAuth for Streamable HTTP Server & Client without PKCE?

Clone the repository, install dependencies with npm install, set the GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET environment variables from a GitHub OAuth App that has "Enable Device Flow" selected, then start the server with npx tsx server/index_streamable.ts and the client with npx tsx client/client.ts.

Key features of Implementing OAuth for Streamable HTTP Server & Client without PKCE

  • Streamable HTTP Server with OAuth device flow support
  • Streamable HTTP Client with headless OAuth support
  • Replaces browser-based OAuth with device code flow
  • No PKCE required due to device flow security
  • Uses GitHub as the OAuth provider

Use cases of Implementing OAuth for Streamable HTTP Server & Client without PKCE

  • Automating MCP server OAuth without an interactive browser
  • Running OAuth flows in headless environments or CI/CD
  • Testing Streamable HTTP OAuth without the MCP Inspector

FAQ from Implementing OAuth for Streamable HTTP Server & Client without PKCE

Why is PKCE not used?

Device flow does not require PKCE because there is no redirect or client-side code handling. The user interacts directly with GitHub, and all token exchange happens server-to-server. The device code is short-lived and tied to the requesting client.

What runtime dependencies are required?

Node.js, npm, and tsx for running TypeScript files.

How do I configure the GitHub OAuth app?

Go to GitHub Developer Settings, create an OAuth App, set a callback URL (e.g., http://localhost), and enable "Device Flow". Note the Client ID and Client Secret, then set them as environment variables.

Can I use a different OAuth provider?

The README only documents configuration with GitHub. The implementation is tied to GitHub’s device flow endpoint.

Where are tokens and sessions stored?

The server stores access tokens and session tokens in its own token store (in-memory). No persistent storage is described.

Frequently asked questions

Why is PKCE not used?

Device flow does not require PKCE because there is no redirect or client-side code handling. The user interacts directly with GitHub, and all token exchange happens server-to-server. The device code is short-lived and tied to the requesting client.

What runtime dependencies are required?

Node.js, npm, and tsx for running TypeScript files.

How do I configure the GitHub OAuth app?

Go to GitHub Developer Settings, create an OAuth App, set a callback URL (e.g., `http://localhost`), and enable "Device Flow". Note the Client ID and Client Secret, then set them as environment variables.

Can I use a different OAuth provider?

The README only documents configuration with GitHub. The implementation is tied to GitHub’s device flow endpoint.

Where are tokens and sessions stored?

The server stores access tokens and session tokens in its own token store (in-memory). No persistent storage is described.

Comments

Basic information

Category

Developer Tools

Transports

stdio

Author

asibyl

More Developer Tools MCP servers

Mobbin

Mobbin

Mobbin MCP connects your AI agents to 600,000+ real product screens, so what they build starts with what already works.

Perfex CRM

themesic

Turn Perfex CRM into an AI-ready workspace. This MCP server exposes your full REST API to Claude, ChatGPT and any AI agent, so leads, invoices and tasks are one prompt away.

1

Air Pipe

airpipe

Build, validate, deploy — HTTP APIs, cron jobs, webhooks and MCP tools — from your AI client.

Routebase

Routebase

Routebase keeps your API's design, docs, contract tests, mocks and monitoring in one living OpenAPI spec so they can't drift apart. Agents work on that same source of truth, under your team's permissions.

LocalCan

LocalCan

Gives AI agents public URLs (tunnels) for localhost, live HTTP traffic inspection, snapshot publishing, and access control. Part of LocalCan, the ngrok alternative for Mac, Windows and Linux. Free plan.

82