add_numbersLABSCO SUMMARY
Install this to learn the spec, not to get tools.
The tools it ships are arithmetic — they are there so you can watch a token flow end to end. What you are actually adopting is the authorization layer: discovery, audience validation, the WWW-Authenticate handling on a 401, and a dashboard that shows failed attempts. If you are writing an MCP server that needs real auth, that is the expensive part, and this is a working version of it.
What it is
A Next.js project you deploy and then replace the tools in — an OAuth 2.1 server built to the MCP Authorization Specification, plus the monitoring you would otherwise have to add yourself. It is a starting point rather than a finished server.
What you get
- A complete OAuth 2.1 server with PKCE and refresh tokens, and dynamic client registration so MCP clients can onboard themselves
- Discovery endpoints implementing RFC 8414 and RFC 9728, resource indicators from RFC 8707, and strict token audience validation
- MCP endpoints over both SSE and HTTP, each requiring a bearer token that is checked against the database, its expiry and its audience
- An analytics dashboard with real-time request metrics, tool usage tracking and security event monitoring
- Six sample tools —
add_numbers,calculate_circle_area,generate_random_number,format_text,check_prime_numberandtrigger_security_events— which exist to prove the flow and are meant to be swapped for your own - Google sign-in through NextAuth, and PostgreSQL with automated cleanup and TTL management
Requirements
Node with pnpm, a PostgreSQL database, and Prisma to generate the client and push the schema. Environment configuration is documented in the project's setup guide. It deploys to Vercel, and a live demo runs at mcp-oauth-sample.vercel.app, with the analytics dashboard restricted to an allowlist of Gmail addresses.
Setup effort
Build from source — git clone https://github.com/raxITlabs/mcp-oauth-sample.git
USE CASES
01
Adding real authentication to an MCP server you are writing
Start from a working OAuth 2.1 implementation and replace the sample tools with your own.
02
Understanding what the authorization spec actually requires
Read a version that implements the discovery endpoints and audience checks rather than the prose alone.
03
Seeing who is calling your server
The dashboard tracks tool usage and failed authentication attempts as they happen.
6 tools
Listed in project docs. Your client may show a different list.
calculate_circle_areagenerate_random_numberformat_textcheck_prime_numbertrigger_security_eventsBEFORE YOU INSTALL
What to know first
Tools you get
6 tools named in the project's documentation.
Requires
A client that can reach a remote MCP server over HTTP
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
TERMINAL
git clone https://github.com/raxITlabs/mcp-oauth-sample.git
cd mcp-oauth-sample
pnpm install
cp .env.example .env # set the variables listed in docs/setup.md
pnpm prisma generate
pnpm prisma db push
pnpm devTo use it from a client, deploy it (docs/deployment.md recommends Vercel); <YOUR_DOMAIN> in the client configuration is your deployment's domain
MCP Clients
Cursor
CURSOR · JSON
{
"mcpServers": {
"raxIT-oauth": {
"url": "<YOUR_SERVER_URL>/mcp/mcp"
}
}
}
