MCP OAuth Server

This MCP server uses an OAuth 2.0 authorization-code flow with PKCE.

Available Endpoints:

Authorization Endpoint

GET /authorize

Parameters:

response_type - Must be "code"
client_id - Dynamically registered client identifier
redirect_uri - Exact registered redirect URI
scope - Optional supported scopes
state - Recommended client transaction state
code_challenge - PKCE S256 challenge
code_challenge_method - Must be "S256"

Token Endpoint

POST /token

Parameters:

grant_type - "authorization_code" or "refresh_token"
code - One-time authorization code
client_id - Client identifier
client_secret - Required only for confidential clients
redirect_uri - Redirect URI used in authorization request
code_verifier - PKCE verifier for authorization-code exchange
refresh_token - Rotating token for refresh grants

MCP streamablehttp Endpoints

/mcp - Streamablehttp connection endpoint (requires OAuth token)

OAuth Flow:

The MCP client discovers metadata and dynamically registers.
The client starts authorization with an S256 PKCE challenge.
The resource owner authenticates and approves the bound transaction.
The server returns a short-lived, one-time authorization code.
The client exchanges the code and PKCE verifier for expiring tokens.
The client sends the bearer access token to the MCP endpoint.