Skip to content

mcp-authflow

OAuth 2.0 Authorization Server framework for MCP servers: issue and manage tokens that protect MCP tool access, and pair with mcp-authflow-resource for the matching resource server.

What's in the box

  • Token storage with PostgreSQL and in-memory backends
  • RFC 6749 standardized OAuth error responses
  • Sliding-window rate limiting for token endpoints (in-process or Redis)
  • Input validation for client IDs and scopes
  • RFC 7591 Dynamic Client Registration handler with a pluggable client registry
  • RFC 7523 private_key_jwt client authentication with an algorithm allowlist and replay protection
  • RFC 7636 PKCE verification (S256 + plain, with an opt-in S256-only policy) and input validation
  • RFC 8628 Device Authorization Grant — sans-IO polling state machine and code generators
  • CORS helpers with origin allowlisting
  • Async-first design, built on Starlette

Install

pip install mcp-authflow

# With PostgreSQL token storage (production)
pip install mcp-authflow[postgres]

Where to go next

  • :material-rocket-launch: Quickstart

    Build a working token + introspection endpoint in ~50 lines.

  • :material-sitemap: Architecture

    How the auth server and resource server fit together.

  • :material-cog: Configuration

    Environment variables and storage backends.

  • :material-api: API Reference

    Module-by-module reference, generated from docstrings.

Start with the Quickstart if you just want to mint and introspect tokens; the Architecture page covers the auth-server / resource-server split in depth.

How it fits with mcp-authflow-resource

mcp-authflow issues tokens; mcp-authflow-resource validates them. They communicate via RFC 7662 token introspection. Either package works on its own. Point mcp-authflow-resource at an existing OAuth provider, or run mcp-authflow behind a hand-rolled resource server.

License

MIT