eai-oauth-proxy

Local client for apps behind oauth2-proxy. The credential is the _oauth2_proxy session cookie. The default browser signs you in; this process reads that cookie and sends it as Cookie.

Install

uv tool install eai-oauth-proxy

Login

eai-oauth-proxy login https://testymctestface.staging.extensile.store/

Writes ~/.config/eai-oauth-proxy/staging.extensile.store.cookie (mode 0600). An existing browser session for that site is saved immediately. Re-running replaces the file.

mcp-proxy and OAuthProxyHTTP open the browser themselves when the cookie is missing or rejected, then retry once.

OAuthProxyCookieManager

Opens the default browser and stores the cookie.

from eai_oauth_proxy import OAuthProxyCookieManager

manager = OAuthProxyCookieManager()
path = manager.login("https://testymctestface.staging.extensile.store/")
value = manager.cookie_for("https://testymctestface.staging.extensile.store/api/v1/users/me")

login returns the file path. cookie_for reads the stored value for that host. path_for returns the file path when one exists.

OAuthProxyHTTP

Calls an oauth2-proxy API with the stored cookie. Paths are app paths.

from eai_oauth_proxy import OAuthProxyHTTP

with OAuthProxyHTTP("https://testymctestface.staging.extensile.store") as api:
    response = api.get("/api/v1/users/me")
    response.raise_for_status()
    print(response.json())

request, get, post, put, patch, and delete return an httpx.Response. Pass a manager to share one cookie directory.

OAuthProxyMCPBridge

Forwards MCP stdio to a Streamable HTTP server. stdout is MCP traffic; logs go to stderr.

from eai_oauth_proxy import OAuthProxyMCPBridge

OAuthProxyMCPBridge("https://testymctestface.staging.extensile.store/mcp").run()

The CLI does the same thing:

eai-oauth-proxy mcp-proxy https://testymctestface.staging.extensile.store/mcp

MCP client

{
  "mcpServers": {
    "testy-mctestface": {
      "command": "eai-oauth-proxy",
      "args": ["mcp-proxy", "https://testymctestface.staging.extensile.store/mcp"]
    }
  }
}