lane-mcp-auth
OAuth 2.1 resource server and consent gate for an MCP server behind Lane — the
Python distribution of @getonlane/mcp-auth.
Docs — overview · quickstart · the gate · reference
pip install lane-mcp-auth # core
pip install 'lane-mcp-auth[fastmcp]' # + the FastMCP helpers
Your server verifies bearer tokens, publishes the discovery document clients need, and refuses every tool until the caller holds a recorded, revocable grant.
Set up with one command where the server runs. It pairs with the Lane console
and writes the credential to .env; the secret never passes through a browser:
python -m lane_mcp_auth setup https://acme.example/mcp --name="Acme shop"
Pass client_id and announce_secret and the server announces the resource it
serves on its first guarded call, so Lane binds the hostname to the credential.
from lane_mcp_auth import LaneMcpAuth
auth = LaneMcpAuth(
resource="https://acme.example/mcp",
connections=connections, # yours: this is server-side state
exchanger=exchanger,
)
The three tiers
| tier | reached by | declared |
|---|---|---|
| authenticated only | — | not registrable |
| any connected caller | completing the step-up | no scope |
| a specific authority | the step-up granting it | scope="…" |
Registration is the floor. Omitting a scope means any connected caller, never anyone: a session that has not registered has nothing anyone can revoke, so a tool answering it would be answering something nobody can withdraw.
With FastMCP
from lane_mcp_auth.fastmcp import register_step_up_tool, guarded
register_step_up_tool(mcp, auth)
@mcp.tool()
@guarded(auth, "read_orders", scope="email")
async def read_orders(ctx) -> str:
return await orders_for(ctx)
Never authorize on the token's scopes
claims.scopes is the token's own claim: empty before the step-up, stale after.
Authority lives in the connection and is reachable only through has_scope() /
effective_scopes(), because Lane decides it at exchange time and can refuse an
exchange it would previously have allowed. A signed claim cannot be withdrawn.
Parity with the TypeScript
Same invariants, same names where Python idiom allows. The TypeScript package is
the reference implementation; where the two could drift — scope filtering, the
metadata paths, the gate's decision table — see SCOPE.md for what is
implemented here and what is not yet.
Licence
MIT
1 maintainer
Release files for lane-mcp-auth 0.8.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| lane_mcp_auth-0.8.0.tar.gz | 147.0 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| lane_mcp_auth-0.8.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 170.3 kB
Release files / lane_mcp_auth-0.8.0.tar.gz
| Download URL | lane_mcp_auth-0.8.0.tar.gz |
|---|---|
| Size | 147.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0da02f4cc139b5e43ad0c3ccbb41241bf6620b83561a3614592f7c8672d6d7ae
|
|
BLAKE2b-256 checksum How to use checksums |
b44ca0b07611f1f50cd426a0a6687d54e05e7dbed95fb5f88f079fbe65d17ee6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 15, 2026.
Transparency logRelease files / lane_mcp_auth-0.8.0-py3-none-any.whl
| Download URL | lane_mcp_auth-0.8.0-py3-none-any.whl |
|---|---|
| Size | 23.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b729dd53ac57ead0105b495028c48220a6afce94a75499c2a20121f588cd65cf
|
|
BLAKE2b-256 checksum How to use checksums |
d68188592f3ba7d55a5401d23d230b2f5922e24765d0bfb5b55aaa74113c84d7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 15, 2026.
Transparency log
