Skip to content

Conversation

AnuradhaKaruppiah
Copy link
Contributor

@AnuradhaKaruppiah AnuradhaKaruppiah commented Sep 3, 2025

Description

MCP Auth support is a three party arch that involves a handshake between the MCP client, the MCP Server and an external AuthServer.

This PR brings auth support for streamable-http MCP clients via:

  1. The existing oauth2_auth_code_flow in NAT. This requires the AuthServer and OauthCliient information to be configured on the MCP client.
  2. A new mcp_oauth2 provider which allows the MCP client to dynamically discover the the AuthServer (from the MCP Server) and register the client information dynamically before delegation authentication to the existing NAT oauth2_auth_code_flow.

This PR focuses on the MCP client side implementation with the MCP server using a stub token verifier to validate the e2e protected MCP flow. The MCP Server changes to enable TokenVerification with Auth Server Introspection are in a separate PR.

Other changes:

  1. Schema translation code has been moved to an utils file

Doc:
MCP documentation is in progress and will be re-written when all relevant PRs are merged

By Submitting this PR I confirm:

  • I am familiar with the Contributing Guidelines.
  • We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
    • Any contribution which contains commits that are not Signed-Off will not be accepted.
  • When the PR is ready for review, new or existing tests cover these changes.
  • When the PR is ready for review, the documentation is up to date with these changes.

@AnuradhaKaruppiah AnuradhaKaruppiah self-assigned this Sep 3, 2025
@AnuradhaKaruppiah AnuradhaKaruppiah added skip-ci Optionally Skip CI for this PR DO NOT MERGE PR should not be merged; see PR for details labels Sep 3, 2025
Copy link

coderabbitai bot commented Sep 3, 2025

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Signed-off-by: Anuradha Karuppiah <[email protected]>
Signed-off-by: Anuradha Karuppiah <[email protected]>
Signed-off-by: Anuradha Karuppiah <[email protected]>
Signed-off-by: Anuradha Karuppiah <[email protected]>
Signed-off-by: Anuradha Karuppiah <[email protected]>
Signed-off-by: Anuradha Karuppiah <[email protected]>
Signed-off-by: Anuradha Karuppiah <[email protected]>
Signed-off-by: Anuradha Karuppiah <[email protected]>
Requires jumping thru many hoops

Signed-off-by: Anuradha Karuppiah <[email protected]>
@AnuradhaKaruppiah AnuradhaKaruppiah changed the title [DONT MERGE] Experimental changes for MCP Auth Enable MCP auth for NAT MCP clients Sep 11, 2025
Prep for creating the provider

Signed-off-by: Anuradha Karuppiah <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
DO NOT MERGE PR should not be merged; see PR for details skip-ci Optionally Skip CI for this PR
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant