An internal MCP server behind corporate SSO is unreachable from most clients, and the usual workaround is pasting a token that expires by lunchtime. Doing the browser flow once and then refreshing ahead of expiry is the whole value here — after setup there is nothing to maintain. The diagnostics matter more than they look: when an enterprise OAuth flow fails it usually fails silently, and having status, token and clear as explicit commands is what turns that into a five-minute fix.
An authentication wrapper rather than a server with its own tools. It sits in front of `mcp-remote`, performs the OAuth implicit flow against Adobe IMS or Okta, and launches the underlying connection with an Authorization bearer header already attached — so a client that cannot do enterprise SSO can still reach a server that requires it.
- One command in your client config in place of a login flow: it builds the OAuth URL, opens the browser, catches the callback on a local HTTP server, extracts the tokens, stores them, and starts the connection with the header set
- Two providers behind one switch — `AUTH_PROVIDER` selects Adobe or Okta, and only that provider's variables are required
- Token lifecycle handled without you: storage in your home directory, expiry tracking, and automatic refresh controlled by `AUTO_REFRESH` and a `REFRESH_THRESHOLD` in minutes
- An optional JWT exchange for servers that want a JWT rather than the access token, selected with `AUTH_METHOD`
- CLI subcommands for when it misbehaves: authenticate, check token status, print the current token, and clear stored tokens
- A debug mode that reports configuration validation, token expiry and validity, each step of the OAuth flow, refresh timer scheduling, network requests and stack traces
- Multiple Adobe IMS environments through `ADOBE_IMS_ENV` — production, stage or development — while Okta is targeted directly by domain
A client ID from whichever identity provider fronts your server: `ADOBE_CLIENT_ID` for Adobe, or `OKTA_CLIENT_ID` together with `OKTA_DOMAIN` for Okta. The scope defaults sensibly per provider and can be overridden with `ADOBE_SCOPE` or `OKTA_SCOPE`. The redirect URI defaults to a localhost callback and is configurable through `REDIRECT_URI`. Node.js — the documented launch is `npx mcp-remote-with-okta` with the target MCP URL as its argument, or a global npm install. The package is `mcp-remote-with-okta` (1.3.0 in package.json). It runs on macOS, Windows and Linux.
One command plus a key — npm install -g mcp-remote-with-okta, then supply credentials