mcp · oauth · oidc · self-host

MCP Auth Index

Remote MCP servers are OAuth Resource Servers. Clients discover an Authorization Server, run OAuth 2.1 (+ PKCE), then call tools with a Bearer token.

AAAX is a lean self-host OIDC AS on Spring Boot — issuer, JWKS, PKCE, confidential clients, Identity Event Bus. Put it behind your MCP HTTP surface.

Pattern

MCP Client
  │  401 + resource_metadata (PRM)
  │  authorization_servers: [ AAAX issuer ]
  ▼
AAAX (OIDC AS)     PKCE / client credentials
  │  access token
  ▼
MCP RS / gateway   validate JWT via AAAX JWKS
  │
  ▼
tools

Honest scope

• Ships: OIDC discovery, JWKS, auth code + PKCE, admin clients, events.
• Not yet: first-class MCP PRM host, MCP gateway, CIMD productization.

Upstream reading

• MCP Authorization specification
• MCP authorization tutorial
• Auth0 — MCP as resource server
• Parecki — OAuth for MCP

Keywords: mcp oauth · mcp oidc · mcp authorization server · rfc9728 · spring boot mcp auth · self-host idp for agents