🔒 MCP Server Authentication Reference Collection
🔒 Reference MCP servers that demo how authentication works with the current Model Context Protocol spec.
What is MCP Server Authentication Reference Collection?
MCP Server Authentication Reference Collection is a repository that provides reference servers demonstrating how authentication works with the Model Context Protocol (MCP) specification.
How to use MCP Server Authentication?
To use the reference servers, clone the repository from GitHub and follow the provided examples to implement authentication scenarios based on your needs.
Key features of MCP Server Authentication?
- Demonstrates various authentication scenarios using MCP.
- Supports multiple identity providers like Entra ID and GitHub.
- Provides different server types: Remote, Local, and Dual-purpose MCP servers.
Use cases of MCP Server Authentication?
- Implementing secure authentication for applications using the Model Context Protocol.
- Testing authentication flows with different identity providers.
- Demonstrating authentication mechanisms in educational or development environments.
FAQ from MCP Server Authentication?
- Is the code production-ready?
No, the code is for demo purposes only. Always conduct a security audit for production use.
- What identity providers are supported?
Currently, Entra ID and GitHub are supported for authentication scenarios.
- Can I run the servers locally?
Yes, there are options for both local and remote server configurations.
IMPORTANT
This is now moved under one of the official Microsoft-supported GitHub organizations. Please use that repository as a point of reference.
🔒 MCP Server Authentication Reference Collection
Reference servers that demo how authentication works with the current Model Context Protocol spec.
WARNING
Code presented here is for demo purposes only. Your specific scenarios (including rules inside your enterprise, specific security controls, or other protection mechanisms) may differ from the ones that are outlined in this repository. Always conduct a security audit and threat modeling for any production and customer-facing assets that require authentication and authorization.
Scenarios
Servers above are designed for various runtime scenarios. They are tagged as follows:
- Remote MCP servers:
- Local MCP servers:
- Dual-purpose MCP servers (can run locally or remotely):
Supported identity providers
| Provider | Scenario | Server Type | Implementation | State |
|---|---|---|---|---|
| Entra ID | Confidential client, mapped to session token. |  | entra-id-cca-session |  |
| Entra ID | Public client, using WAM |  | entra-id-local-wam | |
| GitHub | GitHub application w/OAuth, mapped to session token. | | github-app-session | |
