PluginBench
MCP Server
Active
MIT

MCP Server Auth Template MCP Server

io.github.brunovicco/mcp-server-auth-template

RepositoryRegistry

What is the MCP Server Auth Template MCP server?

OAuth 2.1/OIDC resource-server reference for secure MCP authorization

How to install MCP Server Auth Template

Copy-paste configuration for popular MCP clients.

transport: stdio
Config generated by PluginBench — verify against the source before use.
Environment / auth
  • MCP_SERVER_RESOURCE_SERVER_URL
    required

    Protected-resource URL advertised by this deployment

  • MCP_SERVER_AUTH_PROVIDER
    required

    Authorization-server adapter to use

  • MCP_SERVER_REQUIRED_SCOPES

    JSON array of baseline delegated OAuth scopes

  • MCP_SERVER_TRANSPORT_ALLOWED_HOSTS

    Additional exact Host values accepted by the local container transport

  • MCP_SERVER_ENTRA_TENANT_ID

    Required when MCP_SERVER_AUTH_PROVIDER=entra

  • MCP_SERVER_ENTRA_AUDIENCE

    Required when MCP_SERVER_AUTH_PROVIDER=entra

  • MCP_SERVER_ENTRA_APPLICATION_ID_URI

    Required when MCP_SERVER_AUTH_PROVIDER=entra

  • MCP_SERVER_GENERIC_ISSUER_URL

    Required when MCP_SERVER_AUTH_PROVIDER=generic

  • MCP_SERVER_GENERIC_AUDIENCE

    Required when MCP_SERVER_AUTH_PROVIDER=generic

  • MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS

    Optional JSON array of explicitly trusted cross-origin JWKS origins

Claude Desktop
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "mcp-server-auth-template": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/brunovicco/mcp-server-auth-template:v0.6.2",
        "--read-only",
        "--tmpfs",
        "/tmp:rw,noexec,nosuid,nodev,size=16m",
        "--cap-drop",
        "ALL",
        "--security-opt",
        "no-new-privileges:true",
        "--publish",
        "127.0.0.1:8000:8000"
      ],
      "env": {
        "MCP_SERVER_RESOURCE_SERVER_URL": "<YOUR_MCP_SERVER_RESOURCE_SERVER_URL>",
        "MCP_SERVER_AUTH_PROVIDER": "<YOUR_MCP_SERVER_AUTH_PROVIDER>",
        "MCP_SERVER_REQUIRED_SCOPES": "<YOUR_MCP_SERVER_REQUIRED_SCOPES>",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS": "<YOUR_MCP_SERVER_TRANSPORT_ALLOWED_HOSTS>",
        "MCP_SERVER_ENTRA_TENANT_ID": "<YOUR_MCP_SERVER_ENTRA_TENANT_ID>",
        "MCP_SERVER_ENTRA_AUDIENCE": "<YOUR_MCP_SERVER_ENTRA_AUDIENCE>",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI": "<YOUR_MCP_SERVER_ENTRA_APPLICATION_ID_URI>",
        "MCP_SERVER_GENERIC_ISSUER_URL": "<YOUR_MCP_SERVER_GENERIC_ISSUER_URL>",
        "MCP_SERVER_GENERIC_AUDIENCE": "<YOUR_MCP_SERVER_GENERIC_AUDIENCE>",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS": "<YOUR_MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS>"
      }
    }
  }
}
Cursor
~/.cursor/mcp.json
{
  "mcpServers": {
    "mcp-server-auth-template": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/brunovicco/mcp-server-auth-template:v0.6.2",
        "--read-only",
        "--tmpfs",
        "/tmp:rw,noexec,nosuid,nodev,size=16m",
        "--cap-drop",
        "ALL",
        "--security-opt",
        "no-new-privileges:true",
        "--publish",
        "127.0.0.1:8000:8000"
      ],
      "env": {
        "MCP_SERVER_RESOURCE_SERVER_URL": "<YOUR_MCP_SERVER_RESOURCE_SERVER_URL>",
        "MCP_SERVER_AUTH_PROVIDER": "<YOUR_MCP_SERVER_AUTH_PROVIDER>",
        "MCP_SERVER_REQUIRED_SCOPES": "<YOUR_MCP_SERVER_REQUIRED_SCOPES>",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS": "<YOUR_MCP_SERVER_TRANSPORT_ALLOWED_HOSTS>",
        "MCP_SERVER_ENTRA_TENANT_ID": "<YOUR_MCP_SERVER_ENTRA_TENANT_ID>",
        "MCP_SERVER_ENTRA_AUDIENCE": "<YOUR_MCP_SERVER_ENTRA_AUDIENCE>",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI": "<YOUR_MCP_SERVER_ENTRA_APPLICATION_ID_URI>",
        "MCP_SERVER_GENERIC_ISSUER_URL": "<YOUR_MCP_SERVER_GENERIC_ISSUER_URL>",
        "MCP_SERVER_GENERIC_AUDIENCE": "<YOUR_MCP_SERVER_GENERIC_AUDIENCE>",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS": "<YOUR_MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS>"
      }
    }
  }
}
Windsurf
~/.codeium/windsurf/mcp_config.json
{
  "mcpServers": {
    "mcp-server-auth-template": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/brunovicco/mcp-server-auth-template:v0.6.2",
        "--read-only",
        "--tmpfs",
        "/tmp:rw,noexec,nosuid,nodev,size=16m",
        "--cap-drop",
        "ALL",
        "--security-opt",
        "no-new-privileges:true",
        "--publish",
        "127.0.0.1:8000:8000"
      ],
      "env": {
        "MCP_SERVER_RESOURCE_SERVER_URL": "<YOUR_MCP_SERVER_RESOURCE_SERVER_URL>",
        "MCP_SERVER_AUTH_PROVIDER": "<YOUR_MCP_SERVER_AUTH_PROVIDER>",
        "MCP_SERVER_REQUIRED_SCOPES": "<YOUR_MCP_SERVER_REQUIRED_SCOPES>",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS": "<YOUR_MCP_SERVER_TRANSPORT_ALLOWED_HOSTS>",
        "MCP_SERVER_ENTRA_TENANT_ID": "<YOUR_MCP_SERVER_ENTRA_TENANT_ID>",
        "MCP_SERVER_ENTRA_AUDIENCE": "<YOUR_MCP_SERVER_ENTRA_AUDIENCE>",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI": "<YOUR_MCP_SERVER_ENTRA_APPLICATION_ID_URI>",
        "MCP_SERVER_GENERIC_ISSUER_URL": "<YOUR_MCP_SERVER_GENERIC_ISSUER_URL>",
        "MCP_SERVER_GENERIC_AUDIENCE": "<YOUR_MCP_SERVER_GENERIC_AUDIENCE>",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS": "<YOUR_MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS>"
      }
    }
  }
}
VS Code
.vscode/mcp.json
{
  "servers": {
    "mcp-server-auth-template": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/brunovicco/mcp-server-auth-template:v0.6.2",
        "--read-only",
        "--tmpfs",
        "/tmp:rw,noexec,nosuid,nodev,size=16m",
        "--cap-drop",
        "ALL",
        "--security-opt",
        "no-new-privileges:true",
        "--publish",
        "127.0.0.1:8000:8000"
      ],
      "env": {
        "MCP_SERVER_RESOURCE_SERVER_URL": "<YOUR_MCP_SERVER_RESOURCE_SERVER_URL>",
        "MCP_SERVER_AUTH_PROVIDER": "<YOUR_MCP_SERVER_AUTH_PROVIDER>",
        "MCP_SERVER_REQUIRED_SCOPES": "<YOUR_MCP_SERVER_REQUIRED_SCOPES>",
        "MCP_SERVER_TRANSPORT_ALLOWED_HOSTS": "<YOUR_MCP_SERVER_TRANSPORT_ALLOWED_HOSTS>",
        "MCP_SERVER_ENTRA_TENANT_ID": "<YOUR_MCP_SERVER_ENTRA_TENANT_ID>",
        "MCP_SERVER_ENTRA_AUDIENCE": "<YOUR_MCP_SERVER_ENTRA_AUDIENCE>",
        "MCP_SERVER_ENTRA_APPLICATION_ID_URI": "<YOUR_MCP_SERVER_ENTRA_APPLICATION_ID_URI>",
        "MCP_SERVER_GENERIC_ISSUER_URL": "<YOUR_MCP_SERVER_GENERIC_ISSUER_URL>",
        "MCP_SERVER_GENERIC_AUDIENCE": "<YOUR_MCP_SERVER_GENERIC_AUDIENCE>",
        "MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS": "<YOUR_MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS>"
      }
    }
  }
}
Claude Code
claude mcp add mcp-server-auth-template --env MCP_SERVER_RESOURCE_SERVER_URL=<YOUR_MCP_SERVER_RESOURCE_SERVER_URL> --env MCP_SERVER_AUTH_PROVIDER=<YOUR_MCP_SERVER_AUTH_PROVIDER> --env MCP_SERVER_REQUIRED_SCOPES=<YOUR_MCP_SERVER_REQUIRED_SCOPES> --env MCP_SERVER_TRANSPORT_ALLOWED_HOSTS=<YOUR_MCP_SERVER_TRANSPORT_ALLOWED_HOSTS> --env MCP_SERVER_ENTRA_TENANT_ID=<YOUR_MCP_SERVER_ENTRA_TENANT_ID> --env MCP_SERVER_ENTRA_AUDIENCE=<YOUR_MCP_SERVER_ENTRA_AUDIENCE> --env MCP_SERVER_ENTRA_APPLICATION_ID_URI=<YOUR_MCP_SERVER_ENTRA_APPLICATION_ID_URI> --env MCP_SERVER_GENERIC_ISSUER_URL=<YOUR_MCP_SERVER_GENERIC_ISSUER_URL> --env MCP_SERVER_GENERIC_AUDIENCE=<YOUR_MCP_SERVER_GENERIC_AUDIENCE> --env MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS=<YOUR_MCP_SERVER_GENERIC_JWKS_ALLOWED_ORIGINS> -- docker run -i --rm ghcr.io/brunovicco/mcp-server-auth-template:v0.6.2 --read-only --tmpfs /tmp:rw,noexec,nosuid,nodev,size=16m --cap-drop ALL --security-opt no-new-privileges:true --publish 127.0.0.1:8000:8000

Related MCP servers

io.github.brunovicco/openfinance-br-mcp

Maintained

Secure Open Finance Brasil MCP server with typed tools and a credential-free mock mode

0
Python
MIT
View repository →