{"repo":"babs/mcp-auth-proxy","free":true,"listed":false,"github":"https://github.com/babs/mcp-auth-proxy","clone":"git clone https://github.com/babs/mcp-auth-proxy.git","description":"OAuth 2.1 + OIDC bridge for private MCP servers. Stateless, replay-safe, audit-defensible. Bring any IdP — Keycloak to Entra.","language":"Go","stars":13,"topics":["authentication","mcp","mcp-security","oidc","oauth2-1"],"license":"Apache-2.0","category":"auth-billing-email","readme_excerpt":"mcp-auth-proxy OAuth 2.1 authorization server that fronts any OIDC IdP, so MCP clients can speak to your private MCP server without you writing a single line of auth code. --- TL;DR — deploy Substitute the angle-bracketed placeholder with your real IdP credential and pick a Redis URL that's reachable from the container (host networking, an explicit --network , or the demo stack below all work). Point your MCP client at https://mcp.example.com/mcp and the proxy walks RFC 7591 → 8414 → 6749 → 8707 → OIDC → your protected backend on its own. For a full local stack with Keycloak + Redis + a sample MCP server already wired up, see Demo stack. Requirements - OIDC IdP with discovery ( /.well-known/openid-configuration ) reachable from the proxy. Tested with Keycloak, Microsoft Entra ID; any OIDC-compliant IdP works (Auth0, Okta, Google, …). - Redis ≥ 7 (or compatible) for production. Required by default ( REDIS REQUIRED=true ) so single-use authorization codes and refresh-rotation reuse detection work across replicas. See docs/redis-production.md for sizing. - Public HTTPS terminating at an ingress that reaches the proxy's LISTEN ADDR ( :8080 by default). The IdP and the MCP clients both see PROXY BASE URL over the public network. - Go 1.26.5+ (matches go.mod ) if building from source. Container images are static ( CGO ENABLED=0 ). - Kubernetes : any conformant cluster. Sample manifests under manifests/ . Production overlay enforces the safe posture; see Deploying. --- What it does ","default_branch":null,"files":null,"tree":[],"storefront":"/r/babs","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/babs/mcp-auth-proxy/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}