Local MCP-Server-with-HTTPS-and-GitHub-OAuth

What is Local MCP-Server-with-HTTPS-and-GitHub-OAuth?

A secure local MCP server built with Node.js and Express that provides HTTPS encryption using self-signed certificates, GitHub OAuth authentication, and additional security measures like rate limiting and HTTP header protection. It is intended for developers who need a secure local environment for testing MCP workflows with authentication.

How to use Local MCP-Server-with-HTTPS-and-GitHub-OAuth?

Clone the repository, install dependencies (npm install), generate SSL certificates with OpenSSL, configure .env with your GitHub OAuth credentials, and start the server (node server.js). Then access https://localhost:3000 and authenticate via /auth.

Key features of Local MCP-Server-with-HTTPS-and-GitHub-OAuth

• HTTPS encryption via self-signed certificates
• GitHub OAuth authentication and session management
• Rate limiting to protect against DoS attacks
• Secure cookies with express-session and helmet
• Protected routes requiring authentication (e.g., /secure-data)

Use cases of Local MCP-Server-with-HTTPS-and-GitHub-OAuth

• Securely developing and testing MCP clients locally
• Demonstrating OAuth-based authentication for MCP servers
• Experimenting with HTTPS and security best practices in Node.js
• Building a local proof-of-concept for production-grade MCP servers

FAQ from Local MCP-Server-with-HTTPS-and-GitHub-OAuth

What are the prerequisites to run this server?

You need Node.js (v16 or later), npm, and OpenSSL installed on your system.

What should I do if I get a EADDRINUSE error on port 3000?

Stop any process using port 3000 or change the port in server.js. Use netstat -ano | findstr :3000 to find the process ID and taskkill /PID <PID> /F to terminate it.

Why does the browser show a certificate warning?

Self-signed certificates are not trusted by browsers. For production, use a trusted Certificate Authority like Let’s Encrypt.

How do I configure GitHub OAuth?

Create a GitHub OAuth App, then set CLIENT_ID, CLIENT_SECRET, REDIRECT_URI (https://localhost:3000/auth/callback), and SESSION_SECRET in a .env file.