MCP Auth Proxy, developed by Sigbit, is a specialized server tool for the mcp platform, built predominantly with Go. It functions as an OAuth 2.1/OIDC gateway, designed to add an authentication layer to existing Model Context Protocol (MCP) servers without requiring any modifications to their code. This free tool provides pre-compiled binaries for various operating systems and architectures, including Darwin, Linux, and Windows, making it accessible for diverse deployments. It addresses the need for secure, federated authentication in self-hosted or independently managed MCP environments.

What does MCP Auth Proxy connect to?

MCP Auth Proxy connects to Model Context Protocol (MCP) servers, acting as an authentication proxy. It is specifically categorized as an OAuth 2.1/OIDC gateway for MCP servers, designed to sit in front of existing deployments. This setup allows it to enhance the security and authentication capabilities of backend MCP servers without requiring any internal code changes, making it a non-intrusive solution for integrating advanced authentication into current MCP infrastructure.

Core features and tools

MCP Auth Proxy exposes proxy endpoints and standard OAuth/OIDC endpoints for authentication flows. It converts stdio traffic to the "/mcp" endpoint and handles OAuth discovery endpoints like ".well-known/oauth-authorization-server" and ".well-known/oauth-protected-resource". It supports stdio, SSE, and HTTP transports. Compatible AI clients include Claude, Claude Code, ChatGPT, GitHub Copilot, Cursor, and MCP Inspector, allowing central authentication for various client types.

Who is it for?

MCP Auth Proxy is intended for users needing to add OAuth/OIDC or password-only authentication to one or a few MCP servers. It is particularly suitable for self-hosted or independently managed MCP deployments where catalog integration and aggregation are not a requirement. It secures any MCP server with OAuth 2.1 without needing code changes. Skip this if you require catalog integration and aggregation capabilities for your MCP deployments.

How to get started

Access is granted through a standard OAuth authorization flow, federating authentication to any OIDC-compliant Identity Provider. Authentication also supports optional password authentication via command-line arguments and environment variables like MCP_UPSTREAM_URL.

Use cases

• Securing an existing local MCP server for remote access by acting as an authentication layer and converting stdio traffic.
• Centralizing authentication for various AI clients connecting to an MCP server, enforcing a consistent authentication mechanism across them.
• Integrating an MCP server with enterprise identity providers (e.g., Azure AD, Okta) to add enterprise-grade authentication, including user matching and attribute-based authorization.

MCP Auth Proxy offers a focused solution for adding OAuth 2.1/OIDC authentication to MCP servers without modifying server code. Its support for multiple transports and various IdPs makes it a versatile authentication gateway for self-hosted deployments. It enables securing existing MCP servers for remote access and centralizing authentication for diverse AI clients.