MCP Simple Auth0

MCP Auth0身份验证

这个存储库是 简单身份验证 MCP Python SDK中的示例。

与使用自托管授权服务器的原始示例不同，此版本使用Auth0作为授权服务器。

______________________________________________________________________

步骤1:设置Auth0

1. 注册地址： 身份验证0.
2. 启用 动态客户端注册.
3. 将连接提升到域级别.\

动态客户端是第三方应用程序，需要动态连接。\ 首先，获得a 管理令牌.

1. 将MCP服务器注册为 Auth0中的API，因此它可以用作有效 audience/resource 在生成的JWT中。\

URL必须完全匹配。， http://localhost:8042/).

______________________________________________________________________

步骤2：启动资源服务器（MCP服务器）

# Start the Resource Server on port 8042, connected to the Auth0 Authorization Server
# Replace https://xxxxxxxxx.us.auth0.com/ with your Auth0 domain
uv run mcp-simple-auth0-rs --port=8042 --auth-server=https://xxxxxxxxx.us.auth0.com/ --transport=streamable-http

______________________________________________________________________

步骤3：使用Claude Desktop进行测试

// Add the MCP server to your `claude_desktop_config.json`
// Auth0 requires the `audience` parameter in the /authorize GET request to return a JWT instead of a JWE.
// See: https://auth0.com/docs/secure/tokens/access-tokens/get-access-tokens#control-access-token-audience
// We use `pnpm dlx` to run a specific git commit of a modified `mcp-remote` version,
// which includes the `audience` query parameter to ensure a JWT is returned.
// or you can clone the repo 
// `git clone https://github.com/CefBoud/mcp-remote.git && cd mcp-remote && npm i && npm run build && npm link" 
// then use `mcp-remote` command without pnpm.
"auth0-mcp": {
  "command": "pnpm",
  "args": [
    "dlx",
    "github:CefBoud/mcp-remote#8226c8b08cf281b782ccc0967f4664ec087f7269",
    "http://localhost:8042/mcp",
    "--resource",
    "http://localhost:8042/"
  ]
}

备注：Auth0需要 audience 参数在 /authorize GET请求发出JWT而不是JWE。 这 mcp-remote 上面的版本包含此行为。

当您启动Claude Desktop时，会打开一个浏览器选项卡，提示您进行授权：

alt text

授予访问权限后，您将被重定向到由启动的localhost服务器 mcp-remote 要将授权码兑换为令牌：

alt text

您可以通过以下方式检查保存的令牌和挑战：

ls -lat ~/.mcp-auth/*/

______________________________________________________________________

运作原理

RFC 9728发现

客户端→ 资源服务器：

curl http://localhost:8042/.well-known/oauth-protected-resource

{
  "resource": "http://localhost:8042/",
  "authorization_servers": [
    "https://xxxxxxxxx.us.auth0.com/"
  ],
  "scopes_supported": [],
  "bearer_methods_supported": [
    "header"
  ]
}

客户端→ 授权服务器：

curl https://xxxxxxxxx.us.auth0.com/.well-known/oauth-authorization-server

{
  "issuer": "https://xxxxxxxxx.us.auth0.com/",
  "authorization_endpoint": "https://xxxxxxxxx.us.auth0.com/authorize",
  "token_endpoint": "https://xxxxxxxxx.us.auth0.com/oauth/token",
  "device_authorization_endpoint": "https://xxxxxxxxx.us.auth0.com/oauth/device/code",
  "userinfo_endpoint": "https://xxxxxxxxx.us.auth0.com/userinfo",
  "mfa_challenge_endpoint": "https://xxxxxxxxx.us.auth0.com/mfa/challenge",
  "jwks_uri": "https://xxxxxxxxx.us.auth0.com/.well-known/jwks.json",
  "registration_endpoint": "https://xxxxxxxxx.us.auth0.com/oidc/register",
  "revocation_endpoint": "https://xxxxxxxxx.us.auth0.com/oauth/revoke"
  // ...
}

客户端动态注册应用程序（根据 RFC 7591)，然后继续进行常规OAuth流程。