Skip to content

v0.2.0 — MCP Auth Server Template

Choose a tag to compare

View all tags
@brunovicco brunovicco released this 09 Aug 14:09
· 18 commits to main since this release
v0.2.0
82500c0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.2.0 — MCP Auth Server Template

v0.2.0 is the first coordinated GitHub release of the MCP authentication reference pair.

Use this release with mcp-client-auth-template v0.2.0 for the tested cross-repository profile.

Highlights

  • Targets MCP 2026-07-28 on the stable MCP Python SDK 2.x line.
  • OAuth 2.1 resource-server boundary for Microsoft Entra ID and generic OIDC.
  • RFC 9728 Protected Resource Metadata and standards-shaped WWW-Authenticate challenges.
  • Request-scoped principals with delegated/application identity separation.
  • Per-tool scope enforcement and 403 insufficient_scope step-up challenges.
  • Hardened OIDC discovery and JWKS retrieval with SSRF/DNS, redirect, compression, and body-size controls.
  • Exact issuer/audience validation, JWKS algorithm/key checks, caching, and bounded refresh behavior.
  • Streamable HTTP admission controls, stateless MCP 2026-07-28, operational probes, and production startup preflight.
  • Container and Kubernetes deployment baseline with non-root/read-only hardening.
  • Security audit events with minimized fields and no bearer-token passthrough.
  • Executable Python 3.13/3.14 × MCP SDK floor/latest compatibility matrix.
  • Executable Entra/generic OIDC × production HTTPS/IPv4 loopback/IPv6 loopback matrix.
  • Versioned cross-repository compatibility contract shared with the client template.

Compatibility

  • Python: >=3.13,<3.15 (3.13 and 3.14 exercised in CI)
  • MCP Python SDK: >=2.0,<3
  • MCP SDK tested floor: 2.0.0
  • MCP protocol reference profile: 2026-07-28
  • Transport: Streamable HTTP
  • Authentication: Microsoft Entra ID and generic OIDC
  • Production transport profile: HTTPS
  • Local development/E2E profiles: explicit IPv4/IPv6 loopback HTTP only

Provider-specific live identity-provider interoperability is outside the deterministic local
compatibility contract.

Validation

The release is cut only after the repository quality gate passes on the release branch and again
on merged main. The companion client release additionally validates the pair contract and runs
the full local OAuth/MCP E2E flow against this server release.

Assets 2
Loading