mcp-weather-oauth2-server
If you are the rightful owner of mcp-weather-oauth2-server and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.
This document provides a guide on securing an MCP server using OAuth2, following the MCP specification.
MCP with OAuth
This sample demonstrates how to secure an MCP server using OAuth2, as per the MCP specification.
Getting started
Run the project with:
./mvnw spring-boot:run
Client Credentials
Obtain a token by calling the /oauth2/token endpoint:
curl -XPOST "http://localhost:8080/oauth2/token" \
--data grant_type=client_credentials \
--user "mcp-client:secret"
# And copy-paste the access token
# Or use JQ:
curl -XPOST "http://localhost:8080/oauth2/token" \
--data grant_type=client_credentials \
--user "mcp-client:secret" | jq -r ".access_token"
Auth code with browser flow (PKCE)
Obtain a auth code by first calling authorize endpoint
python3 pkce_generator.py
and then fetch access token by calling the /oauth2/token endpoint
python3 token_request.py
Using MCP inspector
Store the generated token in previous step, and then boot up the MCP inspector:
npx @modelcontextprotocol/inspector@0.6.0
In the MCP inspector, paste your token. Click connect, and voilà!
Note that the token is valid for 15 minutes
Implementation considerations
Dependencies
In Spring, OAuth2 Support for MCP server means adding:
- Spring Security (infrastructure for security)
- Spring Authorization Server (issuing tokens)
- Spring Security: OAuth2 Resource Server ( authentication using tokens)
Note that Spring Auth Server does not support the reactive stack, so issuing tokens only works in Servlet.
