feat/authorization #149

pietrozullo · 2025-06-27T21:17:45Z

No description provided.

…tion

pietrozullo · 2025-08-04T04:18:31Z

@claude can you have a look at this PR ?

almalejko · 2025-08-04T08:40:46Z

@pietrozullo , could you please tell what is blocking the PR? It look like it's covering the MCP spec. Is the merge expected any time soon?

pietrozullo · 2025-08-04T14:39:14Z

Hey @almalejko it is quite a big PR and I did not have time to review it and make sure it is proper, to me it works. I will try to YOLO it this next few days. Do you need it ?

almalejko · 2025-08-06T09:34:38Z

@pietrozullo , thanks for the answer! Are you aware of any public mcp servers that implement dynamic cluent registration? I would test the mcp client with them

…omments

pietrozullo · 2025-08-17T20:58:58Z

@pietrozullo , thanks for the answer! Are you aware of any public mcp servers that implement dynamic cluent registration? I would test the mcp client with them

@almalejko Linear, Asana and others (this is a good list) support DCR https://github.com/jaw9c/awesome-remote-mcp-servers

@renvins did you test with them ? Did you test with github ? I know Github does not follow oauth spec properly so it might fail.

renvins · 2025-08-17T22:49:14Z

@pietrozullo , thanks for the answer! Are you aware of any public mcp servers that implement dynamic cluent registration? I would test the mcp client with them

@almalejko Linear, Asana and others (this is a good list) support DCR https://github.com/jaw9c/awesome-remote-mcp-servers

@renvins did you test with them ? Did you test with github ? I know Github does not follow oauth spec properly so it might fail.

@pietrozullo I've tested Linear and Asana, it's ok. GitHub has some issues.

pietrozullo · 2025-08-17T23:26:13Z

@renvins one other couple things that I would test here are:

backward compatibility -> old non auth http servers work well ?
auth token -> if I pass auth header in HTTP server, does it work the same ?

renvins · 2025-08-18T15:03:39Z

@renvins one other couple things that I would test here are:

backward compatibility -> old non auth http servers work well ?

auth token -> if I pass auth header in HTTP server, does it work the same ?

The old non auth https servers were fixed in the previous commit. In the next hours/tomorrow I'm going to test all the rest

- Remove auth field to reduce API verbosity - Add "auth" support for MCPClient's config - Add "oauth_provider" key to MCPClient's config to provide metadata - Fix no OAuth servers' errors

Signed-off-by: Vincenzo Reina <[email protected]>

renvins · 2025-08-19T16:06:49Z

Giving you a summary to clarify the ideas as much as possible:

I took the liberty of removing the auth field from the client for several reasons including:
- If there were servers without authentication requirements, they would be overwritten by this (a possible solution was to force servers without auth to put "auth": None, but it was really ugly)
- Less API verbosity - having both an auth field and also having it in the config for each server was confusing in my opinion,
- It's rare to find servers with identical authentication using the same data, so it's better to specify it per server rather than having problems with no-auth servers
I've also added the OAuth provider which allows inserting server metadata info to avoid discovery
Now for servers without OAuth, discovery still happens - if it finds nothing, it continues. Obviously the edge case is caught where discovery finds nothing but returns an authorization error if something went wrong
I've updated docs with new usage

I think I made the right architectural decision. Having both the field and the single setting in the config created incompatibilities with servers that didn't need auth and much more.

@pietrozullo let me know!

renvins · 2025-08-19T16:10:16Z

@pietrozullo What about the auth_token field? In our auth implementation we handle the bearer token case, so should we remove it or not?

pietrozullo · 2025-08-24T00:31:34Z

Hey @renvins could you please fix the tests and write an integration test for Authorization ?
You see the badges in the readme, those all have a corresponding test that shows that the feature is active and well working.
It'd be great to have this here as well!

renvins · 2025-08-24T07:43:07Z

Hey @pietrozullo. Of course! Then I proceed updating the bugged test, removing the old field auth_token and creating an integration test for authorization!

renvins · 2025-09-02T19:59:02Z

@pietrozullo I've manually tested all the features listed in the documentation and they work properly as expected. I updated a little mistake in one example on the doc.

The integration test is done and it tests all the auth flow (mocking only the web browser and the callback server), discovery, DCR, token and auth. I added in the test also test for custom auth and for the direct usage of the Bearer token.

I've also added the badge in the README and the test in GH actions. Hope you enjoy that? What are the next steps now? Waiting for you.

pietrozullo · 2025-09-02T20:02:10Z

@renvins You are the best! I will now review and merge

Co-authored-by: Copilot <[email protected]> Signed-off-by: Pietro Zullo <[email protected]>

renvins · 2025-09-02T20:08:11Z

@pietrozullo Thank you! We should modify also the examples before merging! (it takes 5 mins). If you want do also some tests on your own!

pietrozullo · 2025-09-02T20:16:01Z

You can modify the example yes, I just tested with notion mcp and it works great.
Github still does not work because of their weird authentication endpoints, could you write a special handling case for github in the oauthcallback process ? Where instead of following rigidly the spec you try common names for the authorization server ? These common names should include the ones that github uses so that this set up also works for github.
Another option is to just check if the server name contains github and use the different authorization endpoints from github.

Something like this could work:

async def discover_oauth_metadata(self, server_url: str) -> Optional[Dict[str, Any]]:
        """
        Discover OAuth metadata from server following OAuth 2.0 Authorization Server Metadata spec
        """
        logger.info(f"🔍 [MCP Auth] Discovering OAuth metadata for: {server_url}")

        try:
            # Parse base URL
            if "://" in server_url:
                base_url = "/".join(server_url.split("/")[:3])
            else:
                base_url = f"https://{server_url}"

            # Standard OAuth discovery endpoints
            endpoints = [
                f"{base_url}/.well-known/oauth-authorization-server",
                f"{base_url}/.well-known/openid_configuration",
            ]

            # Special handling for Linear MCP
            if "linear.app" in server_url:
                endpoints.insert(0, "https://mcp.linear.app/.well-known/oauth-authorization-server")
                endpoints.insert(1, "https://mcp.linear.app/.well-known/openid_configuration")

            async with httpx.AsyncClient() as client:
                for endpoint in endpoints:
                    try:
                        logger.info(f"📤 [MCP Auth] Trying endpoint: {endpoint}")
                        response = await client.get(endpoint, headers={"Accept": "application/json"})

                        if response.status_code == 200:
                            metadata = response.json()

                            # Validate required fields
                            if metadata.get("authorization_endpoint") and metadata.get("token_endpoint"):
                                logger.info(f"✅ [MCP Auth] Valid metadata found at: {endpoint}")
                                return metadata
                            else:
                                logger.warning(f"⚠️ [MCP Auth] Invalid metadata at {endpoint}")

                    except Exception as e:
                        logger.warning(f"❌ [MCP Auth] Failed to fetch {endpoint}: {e}")
                        continue

            logger.warning(f"❌ [MCP Auth] No OAuth metadata found for {server_url}")
            return None

        except Exception as e:
            logger.error(f"❌ [MCP Auth] OAuth discovery failed: {e}")
            return None

renvins · 2025-09-02T20:22:23Z

@pietrozullo I think that instead of modifying the specs during the callback would be better to try some different discovery for GitHub. Let me know what you think and also I hope you liked my work!

pietrozullo · 2025-09-02T20:24:07Z

Yes it is okay to use different discovery for github.

renvins · 2025-09-02T20:26:46Z

Yes it is okay to use different discovery for github.

Also I've seen that for GH you also need to create an OAuth app on GitHub to get client id etc. because of theirs not support for DCR...

pietrozullo · 2025-09-02T20:46:11Z

Oh my bad, true that. Maybe at some point they did, I had this memory. Then this should be ready outside from the doc example right ?

renvins · 2025-09-02T20:52:38Z

Oh my bad, true that. Maybe at some point they did, I had this memory. Then this should be ready outside from the doc example right ?

@pietrozullo I've searched around. They don't have an endpoint for discovery. So we should make an example where user has to EXPLICITLY specify the authorization and token endpoint and they should be this: https://github.com/login/oauth/authorize https://github.com/login/oauth/access_token

Also needs to be specified the client_id that is generated from the oauth application that every user should create. If you want, instead of making users set these endpoints manually, we can hardcode them if we see GitHub in the url, preventing discovery. Let me know! And this is where auth is needed: https://api.github.com/user

renvins · 2025-09-02T20:55:43Z

@pietrozullo Another problem is that the OAuth application wants the Homepage URL and the callback URL. But since the port is not defined from start, how can we handle this...

renvins · 2025-09-03T14:05:53Z

@pietrozullo Let me know any ideas you have!

- Add customizable port for callback - Remove dynamic port - Fix bug of registration before checking port

renvins · 2025-09-07T20:33:18Z

@pietrozullo Added port support and removed dynamic port. Default port will be 8080 and modified url to localhost. Added also the edge case for automatic discovery for GitHub MCP server. Now I'm going to update docs! LEEEETSGOOO

renvins · 2025-09-08T17:55:32Z

@pietrozullo Updated also docs. Waiting for your review!

pietrozullo · 2025-09-08T18:38:22Z

Hey @renvins great stuff.
I just ran the linear example, I did these steps:
1 - Cleared the cached tokens to make sure we are in clean state
2 - Ran the example - worked fine
3 - Re ran the example works fine but logging shows error

pietrozullo · 2025-09-08T18:40:53Z

Hey @renvins great stuff.
I just ran the linear example, I did these steps:
1 - Cleared the cached tokens to make sure we are in clean state
2 - Ran the example - worked fine
3 - Re ran the example works fine but logging shows error

Here logs:

(.venv) ➜  mcp-use git:(feat/authorization) python examples/simple_oauth_example.py
2025-09-08 11:36:06,474 - mcp_use.telemetry.telemetry - INFO - Anonymized telemetry enabled. Set MCP_USE_ANONYMIZED_TELEMETRY=false to disable.
2025-09-08 11:36:06,474 - mcp_use - INFO - 🚀 Initializing MCP agent and connecting to services...
2025-09-08 11:36:06,474 - mcp_use - INFO - 🔌 Found 0 existing sessions
2025-09-08 11:36:06,474 - mcp_use - INFO - 🔄 No active sessions found, creating new ones...
2025-09-08 11:36:06,474 - mcp_use - INFO - Using default callback port 8080
2025-09-08 11:36:06,602 - mcp_use - INFO - OAuth authentication required
2025-09-08 11:36:06,602 - mcp_use - INFO - Attempting Dynamic Client Registration
2025-09-08 11:36:07,004 - mcp_use - INFO - Dynamic Client Registration successful: zVYHH2pqkluWj
Opening browser for authorization: https://mcp.linear.app/authorize?response_type=code&client_id=zVYHH2pkluWj&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcallback&state=4d93v9qhZCZKzYmp7Z9XBXqE3RcJ2jffQGDw90
2025-09-08 11:36:13,846 - mcp_use - ERROR - MCP protocol error during initialization: Session terminated
2025-09-08 11:36:14,961 - mcp_use - INFO - ✅ Created 1 new sessions
2025-09-08 11:36:15,088 - mcp_use - INFO - 🛠️ Created 24 LangChain tools from client
2025-09-08 11:36:15,088 - mcp_use - INFO - 🧰 Found 24 tools across all connectors
2025-09-08 11:36:15,088 - mcp_use - INFO - 🧠 Agent ready with tools: list_comments, create_comment, list_cycles, get_document, list_documents, get_issue, list_issues, create_issue, update_issue, list_issue_statuses, get_issue_status, list_my_issues, list_issue_labels, create_issue_label, list_projects, get_project, create_project, update_project, list_project_labels, list_teams, get_team, list_users, get_user, search_documentation
2025-09-08 11:36:15,137 - mcp_use - INFO - ✨ Agent initialization complete
2025-09-08 11:36:15,137 - mcp_use - INFO - 💬 Received query: 'What are my latest linear tickets'
2025-09-08 11:36:15,137 - mcp_use - INFO - 🏁 Starting agent execution with max_steps=5
2025-09-08 11:36:15,137 - mcp_use - INFO - 👣 Step 1/5
2025-09-08 11:36:20,116 - mcp_use - INFO - 💭 Reasoning:  Invoking: `list_my_issues` with `{'limit': 5}`   
2025-09-08 11:36:20,116 - mcp_use - INFO - 🔧 Tool call: list_my_issues with input: {'limit': 5}
2025-09-08 11:36:20,116 - mcp_use - INFO - 📄 Tool result: [{"id":"8290d94e-85a5-43f3-a850-719502088cfe","identifier":"MCP-93","title":"LLM in MCPAgent Fail...
2025-09-08 11:36:20,116 - mcp_use - INFO - 👣 Step 2/5
2025-09-08 11:36:29,525 - mcp_use - INFO - ✅ Agent finished at step 2
2025-09-08 11:36:29,525 - mcp_use - INFO - 🎉 Agent execution complete in 23.05090618133545 seconds
Here are your latest Linear tickets:
REDACTED
Let me know if you need more information on any of these tickets!
(.venv) ➜  mcp-use git:(feat/authorization) python examples/simple_oauth_example.py
2025-09-08 11:36:32,864 - mcp_use.telemetry.telemetry - INFO - Anonymized telemetry enabled. Set MCP_USE_ANONYMIZED_TELEMETRY=false to disable.
2025-09-08 11:36:32,865 - mcp_use - INFO - 🚀 Initializing MCP agent and connecting to services...
2025-09-08 11:36:32,865 - mcp_use - INFO - 🔌 Found 0 existing sessions
2025-09-08 11:36:32,865 - mcp_use - INFO - 🔄 No active sessions found, creating new ones...
2025-09-08 11:36:32,865 - mcp_use - INFO - Using default callback port 8080
2025-09-08 11:36:32,991 - mcp_use - ERROR - MCP protocol error during initialization: Session terminated
2025-09-08 11:36:34,175 - mcp_use - INFO - ✅ Created 1 new sessions
2025-09-08 11:36:34,287 - mcp_use - INFO - 🛠️ Created 24 LangChain tools from client
2025-09-08 11:36:34,287 - mcp_use - INFO - 🧰 Found 24 tools across all connectors
2025-09-08 11:36:34,287 - mcp_use - INFO - 🧠 Agent ready with tools: list_comments, create_comment, list_cycles, get_document, list_documents, get_issue, list_issues, create_issue, update_issue, list_issue_statuses, get_issue_status, list_my_issues, list_issue_labels, create_issue_label, list_projects, get_project, create_project, update_project, list_project_labels, list_teams, get_team, list_users, get_user, search_documentation
2025-09-08 11:36:34,333 - mcp_use - INFO - ✨ Agent initialization complete
2025-09-08 11:36:34,333 - mcp_use - INFO - 💬 Received query: 'What are my latest linear tickets'
2025-09-08 11:36:34,333 - mcp_use - INFO - 🏁 Starting agent execution with max_steps=5
2025-09-08 11:36:34,333 - mcp_use - INFO - 👣 Step 1/5
2025-09-08 11:36:43,463 - mcp_use - INFO - 💭 Reasoning:  Invoking: `list_my_issues` with `{'limit': 5}`   
2025-09-08 11:36:43,463 - mcp_use - INFO - 🔧 Tool call: list_my_issues with input: {'limit': 5}
2025-09-08 11:36:43,463 - mcp_use - INFO - 📄 Tool result: [{"id":"8290d94e-85a5-43f3-a850-719502088cfe","identifier":"MCP-93","title":"LLM in MCPAgent Fail...
2025-09-08 11:36:43,464 - mcp_use - INFO - 👣 Step 2/5
2025-09-08 11:36:53,405 - mcp_use - INFO - ✅ Agent finished at step 2
2025-09-08 11:36:53,405 - mcp_use - INFO - 🎉 Agent execution complete in 20.540530920028687 seconds
Here are your latest Linear tickets:
REDACTED
Let me know if you need more information on any of these tickets!
(.venv) ➜  mcp-use git:(feat/authorization)

As you see in both succesfull runs the logs return an error in the MCP protocol initialization:

2025-09-08 11:36:32,865 - mcp_use - INFO - Using default callback port 8080
2025-09-08 11:36:32,991 - mcp_use - ERROR - MCP protocol error during initialization: Session terminated

…tion

pietrozullo · 2025-09-08T19:10:24Z

Issue found, and flagged

renvins · 2025-09-09T12:22:09Z

@pietrozullo for me is finished definitely. If you want have a look also at the tests. By the way check also integration tests if you mean to.

pietrozullo added 5 commits June 24, 2025 17:40

Auth 1.0

46c7773

Defualt to DCR

81636cf

Merge branch 'main' of github.com:mcp-use/mcp-use into feat/authoriza…

6a0f59a

…tion

Fix client list server names

43aadec

Merge branch 'main' of github.com:mcp-use/mcp-use into feat/authoriza…

9a1c1a4

…tion

pietrozullo requested a review from Copilot August 4, 2025 04:19

This comment was marked as outdated.

Sign in to view

Fix oauth problems with no oauth servers, enhance documentation and c…

68d6efe

…omments

renvins requested a review from Copilot August 17, 2025 17:05

renvins added the enhancement New feature or request label Aug 17, 2025

This comment was marked as outdated.

Sign in to view

renvins added 4 commits August 19, 2025 16:26

Add OAuth metadata provider and specific fixes

22ff64a

- Remove auth field to reduce API verbosity - Add "auth" support for MCPClient's config - Add "oauth_provider" key to MCPClient's config to provide metadata - Fix no OAuth servers' errors

Merge branch 'main' into feat/authorization

afa6b41

Signed-off-by: Vincenzo Reina <[email protected]>

Relocate authentication doc

a113545

Fix ruff formatting as usual

0cf8769

renvins added 3 commits August 24, 2025 13:12

Fix http connectors tests with oauth support

25004f7

Fix test_config unit tests

329c39c

Final fix for tests

76ca960

pietrozullo and others added 2 commits September 2, 2025 13:05

Apply suggestions from code review

e35c3f9

Co-authored-by: Copilot <[email protected]> Signed-off-by: Pietro Zullo <[email protected]>

Update mcp_use/auth/oauth.py

ff5b0e4

Co-authored-by: Copilot <[email protected]> Signed-off-by: Pietro Zullo <[email protected]>

renvins added 2 commits September 7, 2025 19:20

Add custom callback port feature

2e20dca

- Add customizable port for callback - Remove dynamic port - Fix bug of registration before checking port

Add GitHub MCP support

0531c34

Update docs

2c32f26

pietrozullo added 2 commits September 8, 2025 11:54

Merge branch 'main' of github.com:mcp-use/mcp-use into feat/authoriza…

a54e40b

…tion

chore: highlight hack

e6867b3

pietrozullo and others added 4 commits September 8, 2025 12:13

chore: change wording in docs

acd7934

Add authlib on project dependencies

cb1ed57

Remove useless example

a8a5c7f

Fix formatting as usual

f8328b1

pietrozullo merged commit 1b6d77f into main Sep 11, 2025
16 checks passed

pietrozullo deleted the feat/authorization branch September 11, 2025 23:01

feat/authorization #149

feat/authorization #149

Uh oh!

Conversation

pietrozullo commented Jun 27, 2025

Uh oh!

pietrozullo commented Aug 4, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

almalejko commented Aug 4, 2025

Uh oh!

pietrozullo commented Aug 4, 2025

Uh oh!

almalejko commented Aug 6, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

pietrozullo commented Aug 17, 2025

Uh oh!

renvins commented Aug 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pietrozullo commented Aug 17, 2025

Uh oh!

renvins commented Aug 18, 2025

Uh oh!

renvins commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renvins commented Aug 19, 2025

Uh oh!

pietrozullo commented Aug 24, 2025

Uh oh!

renvins commented Aug 24, 2025

Uh oh!

renvins commented Sep 2, 2025

Uh oh!

pietrozullo commented Sep 2, 2025

Uh oh!

renvins commented Sep 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pietrozullo commented Sep 2, 2025

Uh oh!

renvins commented Sep 2, 2025

Uh oh!

pietrozullo commented Sep 2, 2025

Uh oh!

renvins commented Sep 2, 2025

Uh oh!

pietrozullo commented Sep 2, 2025

Uh oh!

renvins commented Sep 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renvins commented Sep 2, 2025

Uh oh!

renvins commented Sep 3, 2025

Uh oh!

renvins commented Sep 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renvins commented Sep 8, 2025

Uh oh!

pietrozullo commented Sep 8, 2025

Uh oh!

pietrozullo commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pietrozullo commented Sep 8, 2025

Uh oh!

renvins commented Sep 9, 2025

Uh oh!

Uh oh!

Uh oh!

renvins commented Aug 17, 2025 •

edited

Loading

renvins commented Aug 19, 2025 •

edited

Loading

renvins commented Sep 2, 2025 •

edited

Loading

renvins commented Sep 2, 2025 •

edited

Loading

renvins commented Sep 7, 2025 •

edited

Loading

pietrozullo commented Sep 8, 2025 •

edited

Loading