Show HN: Self-Hosted OAuth Authentication Library for MCP Servers

3 seanobannon 0 6/26/2025, 4:31:11 PM github.com ↗

Hey HN,

The latest MCP spec (https://modelcontextprotocol.io/specification/2025-06-18/bas...) requires MCP Servers implement OAuth for authenticating users and authorizing access to tools and resources. I spent way too long wiring up OAuth to build a ChatGPT connector and decided to wrap the pain into a library: @mcpauth/auth.

What it is:

- Self-hosted OAuth server, built for Model-Context-Protocol

- Single authenticateUser() hook, so you plug in whatever session logic you already have (NextAuth, Auth.js, plain cookies, JWT, you name it)

- Adapters: Next.js and Express; stores: Drizzle or Prisma

- ISC licensed, no calls home

Quick start is ~5 min: npm i @mcpauth/auth, add two route handlers, set three env vars.

Live demo: https://mcpauth-nextjs.vercel.app/

If you’re building an MCP server or any internal AI tool that needs proper OAuth, I’d love feedback — especially on edge cases or new functionality.

Repo: https://github.com/mcpauth/mcpauth

Show HN: Chisel – Profile GPU Kernels Without a GPU (Nvidia and AMD) (github.com)

Salesforce CEO Says 30% of Internal Work Is Being Handled by AI (bloomberg.com)

A.I. Is Homogenizing Our Thoughts (newyorker.com)

Lalo Schifrin, Film Composer Who Wrote 'Mission: Impossible' Theme, Dies at 93 (variety.com)

Coloring.app – Custom AI Coloring Pages and Books (coloring.app)

Simulating a neural operating system with Gemini 2.5 Flash-Lite (developers.googleblog.com)

Can a Brain Be Preserved and Uploaded? Neuroscience Reveals 40% Chance It Could (iflscience.com)

I started writing the hono.js of Golang (github.com)

BIS: Stablecoins Fail Key Tests of Real Money (cointelegraph.com)

Show HN: Built a Food Scanner for Longevity (getbiohack.app)

Understanding the sport viewership experience using functional IR spectroscopy (nature.com)

Built something to help with panic attacks – what am I missing? (abler.health)

Britain shuns $34B Morocco-UK subsea power project (reuters.com)

Bluefishjs: Composing Diagrams in with Declarative Relations (dl.acm.org)

Stryker is a new generation mobile pentest application (github.com)

RFK Jr's new vaccine panel votes against preservative in flu shots in shock move (theguardian.com)

Carrot Cache: High-Performance, SSD-Friendly Caching Library for Java (medium.com)

Genomics coordinate systems (docs.rs)

Everything We Just Learned About the Ordnance Penetrator Strikes on Iran (twz.com)

Mammal evolution of upright posture was no cake walk (cosmosmagazine.com)

The Bitter Lesson (finbarr.ca)

Night train startup 'Nox' promises private cabins and reasonable prices (euronews.com)

Diabolus ex Machina – ChatGPT as literary critic (amandaguinzburg.substack.com)

Sesame – Natural voice companion preview (app.sesame.com)

Show HN: Gemini Bookmarks – Bookmark and tag responses in Gemini conversations (github.com)

Critical AI Summer Reading: Empires, Cons and Everlasting False Promises (neuralab.net)

The End of SaaS?

Programming skills that AIs cannot have and how you learn them (youtube.com)

CIA Insectothopter (cia.gov)

Kea 3.0, our first LTS version (isc.org)

John Carmack (Keen Technologies): Research Directions (youtube.com)

Vpype: A CLI for Plotter Art (github.com)

Out-of-Band, Part 1: The new gen of IP KVMs and how to find them (runzero.com)

Ask HN: Employers of HN – Would you hire a career changer without experience?

Robots That Learn – OpenAI (openai.com)

'Made in the USA' reference disappears from Trump phone listing (bbc.co.uk)

Midjourney Storytelling Lab (mj-storytelling.github.io)

Deploying Pull Requests: A Complete AWS Stack for Every PR (metaduck.com)

Uber in Talks with Its Founder, Travis Kalanick, to Fund Self-Driving Car Deal (nytimes.com)

The life-changing artificial pancreas (cam.ac.uk)

Adding a trash can to Linux with trash-CLI (ittavern.com)

Starcloud says 1 launch, $8M but ISS tech says 17 launches, $850M+ (angadh.com)

DeepSeek's next-gen model delayed by Nvidia H20 restrictions (tomshardware.com)

Researchers develop a battery cathode material that does it all (arstechnica.com)

Matrix v1.15 Release (matrix.org)

Cartridges: Lightweight long context representations via self-study (arxiv.org)

Why Postgres needs better connection security defaults (neon.com)

Book authors made the wrong arguments in Meta AI training case, judge says (arstechnica.com)

Harry Potter and the Cuaron Slam (ribbonfarm.com)

Ask HN: Has anyone manage to implement OAuth on an MCP server?

Show HN: Self-Hosted OAuth Authentication Library for MCP Servers

Comments (0)