mcp-remote-auth

Shared OAuth infrastructure for MCP remote servers. Extracts the common OAuth proxy pattern used by gmail-mcp-remote, gcal-mcp-remote, notion-mcp-remote, and linkedin-scheduler-remote into a reusable library.

Install

pip install mcp-remote-auth-ldraney

Usage

from mcp_remote_auth import (
    ProviderConfig, TokenStore, OAuthProxyProvider,
    configure_mcp_auth, configure_transport_security,
    register_standard_routes, register_onboarding_routes,
    build_app_with_middleware,
)

config = ProviderConfig(
    provider_name="Gmail",
    authorize_url="https://accounts.google.com/o/oauth2/auth",
    token_url="https://oauth2.googleapis.com/token",
    client_id=os.environ["OAUTH_CLIENT_ID"],
    client_secret=os.environ["OAUTH_CLIENT_SECRET"],
    base_url=os.environ["BASE_URL"],
    scopes="https://www.googleapis.com/auth/gmail.readonly",
    extra_authorize_params={"access_type": "offline", "prompt": "consent"},
    upstream_token_key="google_refresh_token",
    upstream_response_token_field="refresh_token",
)

store = TokenStore(secret=os.environ["SESSION_SECRET"])
provider = OAuthProxyProvider(store=store, config=config)

configure_mcp_auth(mcp, provider, BASE_URL)
configure_transport_security(mcp, BASE_URL, os.environ.get("ADDITIONAL_ALLOWED_HOSTS", ""))
register_standard_routes(mcp, provider, BASE_URL)
register_onboarding_routes(mcp, provider, store, config, os.environ.get("ONBOARD_SECRET", ""))

app = build_app_with_middleware(mcp, use_body_inspection=True)
uvicorn.run(app, host="0.0.0.0", port=8000)