eai-oauth-proxy

Local client for apps behind oauth2-proxy. The credential is the _oauth2_proxy session cookie. The default browser signs you in; this process reads that cookie and sends it as Cookie.

Install

uv tool install eai-oauth-proxy

Login

eai-oauth-proxy login https://testymctestface.staging.extensile.store/

Writes ~/.config/eai-oauth-proxy/staging.extensile.store.cookie (mode 0600). An existing browser session for that site is saved immediately. Re-running replaces the file.

mcp-proxy and OAuthProxyHTTP open the browser themselves when the cookie is missing or rejected, then retry once.

OAuthProxyCookieManager

Opens the default browser and stores the cookie.

from eai_oauth_proxy import OAuthProxyCookieManager

manager = OAuthProxyCookieManager()
path = manager.login("https://testymctestface.staging.extensile.store/")
value = manager.cookie_for("https://testymctestface.staging.extensile.store/api/v1/users/me")

login returns the file path. cookie_for reads the stored value for that host. path_for returns the file path when one exists.

OAuthProxyHTTP

Calls an oauth2-proxy API with the stored cookie. Paths are app paths.

from eai_oauth_proxy import OAuthProxyHTTP

with OAuthProxyHTTP("https://testymctestface.staging.extensile.store") as api:
    response = api.get("/api/v1/users/me")
    response.raise_for_status()
    print(response.json())

request, get, post, put, patch, and delete return an httpx.Response. Pass a manager to share one cookie directory.

CookieTransport / AsyncCookieTransport

For a caller that needs its own Authorization header alongside the session cookie (an API token that isn't the user's oauth2-proxy identity), build the httpx.Client/httpx.AsyncClient directly with eai_oauth_proxy.transport.CookieTransport / eai_oauth_proxy.async_transport.AsyncCookieTransport and pass preserve_headers:

from eai_oauth_proxy import OAuthProxyCookieManager
from eai_oauth_proxy.transport import CookieTransport

manager = OAuthProxyCookieManager()
client = httpx.Client(
    transport=CookieTransport(
        config_dir=manager.config_dir,
        login=manager.login,
        preserve_headers=frozenset({"authorization"}),
    ),
    headers={"Authorization": "Bearer <token>"},
)

Without preserve_headers, Authorization, Proxy-Authorization, and any caller-supplied Cookie are stripped before the request is sent (only the stored session cookie is attached), matching OAuthProxyHTTP's behavior. AsyncCookieTransport is the same protocol for httpx.AsyncClient; it runs the blocking browser-login step in a worker thread so it doesn't stall the event loop.

OAuthProxyMCPBridge

Forwards MCP stdio to a Streamable HTTP server. stdout is MCP traffic; logs go to stderr.

from eai_oauth_proxy import OAuthProxyMCPBridge

OAuthProxyMCPBridge("https://testymctestface.staging.extensile.store/mcp").run()

The CLI does the same thing:

eai-oauth-proxy mcp-proxy https://testymctestface.staging.extensile.store/mcp

MCP client

{
  "mcpServers": {
    "testy-mctestface": {
      "command": "eai-oauth-proxy",
      "args": ["mcp-proxy", "https://testymctestface.staging.extensile.store/mcp"]
    }
  }
}