🌊 HTTP + SSE MCP Server w/ OAuth

What is 🌊 HTTP + SSE MCP Server w/ OAuth?

This repository provides a reference implementation for creating a remote MCP server that supports both Streamable HTTP and SSE transports, authorized with OAuth based on the MCP specification. It is intended for developers who want to deploy a production-ready, OAuth-protected MCP server and need a working reference to fork and customize.

How to use 🌊 HTTP + SSE MCP Server w/ OAuth?

You fork the repo, replace the example MCP server with your own logic, and configure OAuth credentials in a .env file (copy .env.template). Run the stateless server with bun run src/app.stateless.ts or the stateful server with bun run src/app.stateful.ts. To connect from MCP hosts like Cursor or Claude Desktop, use bunx mcp-remote --transport http-first https://your-domain.com/mcp. For direct integration with a JS/TS agent, use the StreamableHTTPClientTransport class with an Authorization header.

Key features of 🌊 HTTP + SSE MCP Server w/ OAuth

• Reference implementation for OAuth-authorized remote MCP server
• Supports both Streamable HTTP and SSE transports
• Stateless (serverless-ready) and stateful server variants
• Proxies OAuth to upstream servers supporting Dynamic Client Registration (RFC7591)
• Issues its own access tokens to protect upstream credentials
• Written in TypeScript; uses Bun as the recommended runtime

Use cases of 🌊 HTTP + SSE MCP Server w/ OAuth

• Deploying a production MCP server with OAuth-based access control
• Using Streamable HTTP transport with MCP hosts via the mcp-remote bridge
• Integrating MCP with a managed OAuth provider such as Auth0
• Building a custom MCP server that follows the latest specification
• Creating a test bed for OAuth flows in MCP client and server development

FAQ from 🌊 HTTP + SSE MCP Server w/ OAuth

What is the difference between the stateless and stateful servers?

The stateless server (src/app.stateless.ts) only supports Streamable HTTP and is suitable for serverless deployment. The stateful server (src/app.stateful.ts) supports both SSE and Streamable HTTP but maintains in-memory state, so it is not suitable for serverless or trivial horizontal scaling.

Does this server implement its own OAuth authorization server?

No. It proxies OAuth to an upstream server that supports Dynamic Client Registration (RFC7591). You must bring your own OAuth authorization server (e.g., Auth0). Google and GitHub are not directly supported because they lack dynamic client registration.

Why does the server issue its own tokens instead of forwarding upstream tokens?

Forwarding the upstream access token to the MCP client would expose it to potential abuse. The server issues its own token so that only the server can use the upstream token, protecting against leaks or misuse by a malicious client.

What are the runtime dependencies?

Bun is the recommended runtime and package manager. Limited compatibility testing has been done with npm + tsc. The Python MCP SDK does not yet support Streamable HTTP transport or OAuth building blocks.

How can I connect from a Python application?

Python MCP SDK currently lacks support for Streamable HTTP and OAuth. You can either use the mcp-remote npm package to bridge to STDIO, or connect directly from a TypeScript/JavaScript agent using the