MCP Access OAuth

This MCP server provides remote Model Context Protocol support with built-in Access OAuth, enabling secure, authenticated connections from MCP clients to your own server running on Cloudflare Workers and exposing tools via a remote interface.

How to use

You will connect MCP clients to your remote server using the Access OAuth flow. Once connected, authenticated users can access basic tools like add, while more restricted tools such as generateImage are limited to designated users. The server serves as an OAuth server to MCP clients and also acts as an OAuth client to the Access provider.

How to install

Prerequisites you need before installing this MCP server: Node.js and npm, and Wrangler (the Cloudflare Workers tooling). Ensure you have a Cloudflare account to deploy the server under your own domain.

Step-by-step setup for production deployment and local development is described below.

Production deployment steps include creating an Access for SaaS OIDC app, collecting credentials, and deploying with Wrangler. You will configure secrets and a KV namespace, then deploy the server to your workers.dev domain.

# 1) Install dependencies
npm install

# 2) For production, set up Access for SaaS OIDC app and secrets (example commands)
wrangler secret put ACCESS_CLIENT_ID
wrangler secret put ACCESS_CLIENT_SECRET
wrangler secret put ACCESS_TOKEN_URL
wrangler secret put ACCESS_AUTHORIZATION_URL
wrangler secret put ACCESS_JWKS_URL
wrangler secret put COOKIE_ENCRYPTION_KEY

# 3) Create a KV namespace for OAuth state
wrangler kv:namespace create "OAUTH_KV"
# Update Wrangler config with the KV namespace ID as instructed by your setup

# 4) Deploy to Cloudflare Workers
wrangler deploy

# 5) Test using Inspector to connect to the remote server
npx @modelcontextprotocol/inspector@latest

# 6) Access the server during testing
# Enter the SSE URL in Inspector:
# https://mcp-access-oauth.<your-subdomain>.workers.dev/sse

Additional configuration and management

Access control for tools is managed through Access. By default, authenticated Access users can access basic tools like add. The generateImage tool is restricted to specific users listed in the ALLOWED_EMAILS configuration.

// Add user emails for image generation access
const ALLOWED_EMAILS = new Set(["employee1@mycompany.com", "teammate1@mycompany.com"]);

Access the remote MCP server from Claude Desktop

To use Claude Desktop with your remote MCP server, open Settings -> Developer -> Edit Config and replace the content with the configuration shown. After restarting Claude Desktop, complete the OAuth login to grant access to your MCP server.

{
  "mcpServers": {
    "math": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://mcp-access-oauth.<your-subdomain>.workers.dev/sse"
      ]
    }
  }
}

For local development

If you want to iterate locally, configure the following and run the server in development mode.

# Local homepage and callback URLs
Homepage URL: http://localhost:8788
Authorization callback URL: http://localhost:8788/callback

# Credentials
# Note your Client ID and generate a Client secret

# Create a local env file
# .dev.vars at project root with:
ACCESS_CLIENT_ID=<your client id>
ACCESS_CLIENT_SECRET=<your client secret>
ACCESS_TOKEN_URL=<your Access for SaaS token url>
ACCESS_AUTHORIZATION_URL=<your Access for SaaS authorization url>
ACCESS_JWKS_URL=<your Access for SaaS JWKS url>
COOKIE_ENCRYPTION_KEY=COOKIE_ENCRYPTION_KEY

Develop & test locally

Run the server in development mode to test locally, so you can verify the OAuth flow and tool availability.

wrangler dev

# To test the local server with the Inspector, enter
# http://localhost:8788/sse

Using MCP clients

When using MCP clients like Claude Desktop or Cursor, you may encounter authentication-related messages as remote MCP support evolves. You can verify a connected MCP server by checking the Tools availability indicator in the client interface.

Available tools

add

A basic tool that performs arithmetic addition or similar simple operations as part of the available toolset.

generateImage

A tool restricted to specific users listed in ALLOWED_EMAILS that generates images based on provided prompts.