Support for Oauth

[Janhouse]

I wanted to test metamcp with claude.ai (web version) but they use oauth to authenticate third party mcp servers, which metamcp doesn't support so it is not possible to use it.

Is it in the roadmap?

[zhjch05]

I see it has some discussion as second point in #70 but I never prioritized it too much, I see your use case, makes sense. Will take a look on how to implement.

[Janhouse]

Seems like better auth has a plugin to make it possible. I am not sure how easy it would be to integrate it per-endpoint (in ideals scenario), but the current api-key approach also doesn't allow setting per-endpoint api-keys https://www.better-auth.com/docs/plugins/mcp

[zhjch05]

Thanks for the pointer. Yeah per endpoint needs more tweaks, and will let both api key auth and oauth work.

[zhjch05]

The better auth plugin only works with high level mcp servers, quite limited and I have allow the lower level customizations. So I believe I have to implement OAuth on my own, will take quite some time to ship, but started looking into it.

[zhjch05]

For early adopters who want to try out OAuth (beta) you can use this branch or test docker image https://github.com/metatool-ai/metamcp/tree/2.4-oauth

docker pull ghcr.io/metatool-ai/metamcp:test

This is OAuth part 1.

• Frontend can connect to OAuth MCP (SSE, Streamable HTTP)
• Make sure if you use API key, API key must be correct and enabled, otherwise it will cause infinite retries in OAuth if client keeps retrying, resulting a 429 rate limit.
• You need to enable OAuth for endpoint, then it will work (tested with mcp-remote, MCP inspector, and in-house MetaMCP connection)

Let me know if you face any issues or bugs.

Part 2 I will validate OAuth in sub mcp, if some of them expired then MetaMCP Oauth should also fail to redirect to a page that help connect expired OAuths in sub mcps.

[dnoggle]

I'm very interested in this, but I want to make sure I understand what this feature in beta is. Is it OAuth for metamcp so I can use clients like Claude Web to connect to metamcp or is it for metamcp connecting to MCP servers via OAuth? I'm interested in both, but want to clarify.

[zhjch05]

Both. MetaMCP can add OAuth MCP servers, and MetaMCP endpoint can use OAuth instead of API key (or both).

But with this part 1 version, OAuth MCP servers added in MetaMCP only cache the oauth session, and it only refreshes when you access it in the frontend of MetaMCP. And plan for part 2 is to let MetaMCP endpoint's OAuth detect expired frontend OAuth sessions and refresh them or redirect to their page to re-OAuth.

[Janhouse]

It kind of seems to work but there are issues. Tested with Claude, it does work, but then as soon as I prompt the same from the mobile app (they also just added the mcp support in mobile app, make sure it is up to date), it sends the calls but they don't work. And then sending the prompt from browser again there is an error:
Failed to call tool XXXX MCP error -32603: Unknown tool: XXXX

I guess that the parallel sessions break it somehow.

[Janhouse]

And after some waiting and retrying I get this: Failed to call tool XXXX: Error: WebSocket error: {"isTrusted":true}

[zhjch05]

Didn't test claude.ai, they banned my us phone number lol. Will try to figure out another online platform that supports OAuth MCP and test. Thanks for sharing the error messages.

[haoling]

I also want to safely use MCP servers that don't support OAuth from both Claude Desktop and Claude web, so I'm very grateful for zhjch05's efforts.

I confirmed the behavior with the test version docker image:

Private Endpoint with OAuth enabled (User A creates, adds via Claude Desktop custom connector):

• When User A is logged into metamcp: Successfully connected and tools were called normally
• When User B is logged into metamcp: Connection failed
• When logged out of metamcp: Login screen appeared; connection succeeded when User A logged in, connection failed when User B logged in

Public Endpoint with OAuth enabled (User A creates, adds via Claude Desktop custom connector):

• When User A is logged into metamcp: Successfully connected and tools were called normally
• When User B is logged into metamcp: Successfully connected and tools were called normally

[zhjch05]

I didn't find out any good and real MCP clients with OAuth like claude.ai but I reproduced one issue that is initially the first time oauth works, but when the oauth token expired and the refresh seems to have some bugs. Will try to fix then push this version.

[zhjch05]

Fixed that bug. Testing in v2.4.4-test or test flag. (https://github.com/metatool-ai/metamcp/pkgs/container/metamcp/475481560?tag=v2.4.4-test)