SSO

You run an MCP server that exposes development tools via the Model Context Protocol, authenticates with Azure Entra ID, and serves content through an HTTP streamable transport. This enables AI coding assistants to access organization- scoped checklists, process documentation, and other development resources securely in both local and cloud deployments.

How to use

Connect your MCP-enabled AI assistant or client to the server URL at the MCP endpoint. In local development you will use the Local Mode authentication flow, which provides browser-based Azure SSO for desktop use. In deployments, you enable Cloud Mode to validate bearer tokens issued by your identity provider. Once connected, you can retrieve checklists, pull process documents, and search processes to assist coding, reviews, and workflows.

With the available tools, you can perform actions such as retrieving a specific checklist by name, listing all checklists with their metadata, retrieving a process document, listing processes, and performing keyword searches across process content. The server uses a streamable transport to communicate with your client.

How to install

Prerequisites you need before installing: Python 3.11 or newer, the uv package manager, an Azure App Registration, and VSCode with GitHub Copilot or Claude Code.

Clone the server repository, install dependencies, and configure environment variables as follows.

# Clone the repository
git clone <repository-url>
cd sso-mcp-server

# Install dependencies
uv sync

# Configure environment
cp .env.example .env
# Edit .env with your configuration

Configuration and starting the server

Choose an authentication mode and provide the required environment variables. Local Mode uses browser-based Azure SSO for desktop use. Cloud Mode validates bearer tokens for deployments.

# Local mode start example
AUTH_MODE=local
AZURE_CLIENT_ID=your-app-registration-client-id
AZURE_TENANT_ID=your-azure-tenant-id
CHECKLIST_DIR=./checklists

uv run sso-mcp-server

# Cloud mode start example
AUTH_MODE=cloud
RESOURCE_IDENTIFIER=api://your-app-id
ALLOWED_ISSUERS=https://login.microsoftonline.com/your-tenant-id/v2.0
CHECKLIST_DIR=./checklists

uv run sso-mcp-server

Connecting clients and endpoint

The server provides an HTTP Streamable transport. Use the MCP URL http://localhost:8080/mcp in your MCP client configuration. You can set up multiple clients, including Claude Desktop, VSCode with GitHub Copilot, and other MCP-enabled tools, to access the tools exposed by the server.

Notes on deployment and environment

The server supports dual-mode authentication, is OAuth 2.1 compliant as a Resource Server in cloud mode, and uses JWKS-based token validation with caching. You can customize the checklist and process directories, port, and log level through environment variables.

Available tools

get_checklist

Retrieve a specific checklist by name (case-insensitive)

list_checklists

List all available checklists with metadata (name, description)

get_process

Retrieve a specific process document by name (case-insensitive)

list_processes

List all available process documents with metadata (name, description)

search_processes

Search processes by keyword across name, description, and content with relevance ranking