🌊 HTTP + SSE MCP Server w/ OAuth

Name: 🌊 HTTP + SSE MCP Server w/ OAuth
Author: NapthaAI

@NapthaAI

About 🌊 HTTP + SSE MCP Server w/ OAuth

Remote MCP server (SEE + Streamable HTTP) implementing the MCP spec's authorization extension. Use directly from your agents, or from Cursor / Claude with mcp-remote

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "http-oauth-mcp-server": {
      "command": "bun",
      "args": [
        "run",
        "src/app.stateless.ts"
      ]
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is 🌊 HTTP + SSE MCP Server w/ OAuth?

This repository provides a reference implementation for creating a remote MCP server that supports both Streamable HTTP and SSE transports, authorized with OAuth based on the MCP specification. It is intended for developers who want to deploy a production-ready, OAuth-protected MCP server and need a working reference to fork and customize.

How to use 🌊 HTTP + SSE MCP Server w/ OAuth?

You fork the repo, replace the example MCP server with your own logic, and configure OAuth credentials in a .env file (copy .env.template). Run the stateless server with bun run src/app.stateless.ts or the stateful server with bun run src/app.stateful.ts. To connect from MCP hosts like Cursor or Claude Desktop, use bunx mcp-remote --transport http-first https://your-domain.com/mcp. For direct integration with a JS/TS agent, use the StreamableHTTPClientTransport class with an Authorization header.

Key features of 🌊 HTTP + SSE MCP Server w/ OAuth

Reference implementation for OAuth-authorized remote MCP server
Supports both Streamable HTTP and SSE transports
Stateless (serverless-ready) and stateful server variants
Proxies OAuth to upstream servers supporting Dynamic Client Registration (RFC7591)
Issues its own access tokens to protect upstream credentials
Written in TypeScript; uses Bun as the recommended runtime

Use cases of 🌊 HTTP + SSE MCP Server w/ OAuth

Deploying a production MCP server with OAuth-based access control
Using Streamable HTTP transport with MCP hosts via the mcp-remote bridge
Integrating MCP with a managed OAuth provider such as Auth0
Building a custom MCP server that follows the latest specification
Creating a test bed for OAuth flows in MCP client and server development

FAQ from 🌊 HTTP + SSE MCP Server w/ OAuth

What is the difference between the stateless and stateful servers?

The stateless server (src/app.stateless.ts) only supports Streamable HTTP and is suitable for serverless deployment. The stateful server (src/app.stateful.ts) supports both SSE and Streamable HTTP but maintains in-memory state, so it is not suitable for serverless or trivial horizontal scaling.

Does this server implement its own OAuth authorization server?

No. It proxies OAuth to an upstream server that supports Dynamic Client Registration (RFC7591). You must bring your own OAuth authorization server (e.g., Auth0). Google and GitHub are not directly supported because they lack dynamic client registration.

Why does the server issue its own tokens instead of forwarding upstream tokens?

Forwarding the upstream access token to the MCP client would expose it to potential abuse. The server issues its own token so that only the server can use the upstream token, protecting against leaks or misuse by a malicious client.

What are the runtime dependencies?

Bun is the recommended runtime and package manager. Limited compatibility testing has been done with npm + tsc. The Python MCP SDK does not yet support Streamable HTTP transport or OAuth building blocks.

How can I connect from a Python application?

Python MCP SDK currently lacks support for Streamable HTTP and OAuth. You can either use the mcp-remote npm package to bridge to STDIO, or connect directly from a TypeScript/JavaScript agent using the