MCP + OAuth2.1 + AWS Cognito Example

What is MCP + OAuth2.1 + AWS Cognito Example?

This project demonstrates how to secure a Model Context Protocol (MCP) server using OAuth 2.1 authorization flows, implemented with Node.js and Express.js. It uses AWS Cognito as an example backing authorization server but is designed to be provider-agnostic, following the MCP Authorization Specification (version 2025-11-25).

How to use MCP + OAuth2.1 + AWS Cognito Example?

Clone the repository, install dependencies with npm run install:all, deploy AWS resources using npm run deploy, and start all services with npm run dev. Then visit http://localhost:3000 for the pre-registered client flow, http://localhost:3002 for the Dynamic Client Registration (DCR) flow, or http://localhost:3003 for the Client ID Metadata Document (CIMD) flow. Review generated .env files before running.

Key features of MCP + OAuth2.1 + AWS Cognito Example?

• Provider-agnostic OAuth 2.1 implementation (example uses AWS Cognito)
• Authorization Code flow with PKCE and RFC 8707 Resource Indicators
• Dynamic Client Registration (DCR) with API Gateway and Lambda
• Client ID Metadata Documents (CIMD) support via an authorization proxy
• Protected Resource Metadata (PRM) document discovery
• Three client implementations: static, auto-discovery (DCR), and metadata (CIMD)

Use cases of MCP + OAuth2.1 + AWS Cognito Example?

• Secure an MCP server with standard OAuth 2.1 flows and token validation
• Integrate any OAuth 2.1 compliant authorization server (e.g., Okta, Auth0)
• Automatically register clients without manual configuration via DCR
• Enable zero-config client registration using CIMD with URL‑based client IDs
• Test and compare OAuth 2.1 client registration methods in a development environment