From 93d84489fc0537ab2e51d4210cdfce27b45da443 Mon Sep 17 00:00:00 2001 From: Jeremiah Lowin <153965+jlowin@users.noreply.github.com> Date: Tue, 3 Jun 2025 09:11:50 -0400 Subject: [PATCH] Update auth docs --- README.md | 13 +++++++- docs/clients/auth/bearer.mdx | 2 +- docs/clients/auth/oauth.mdx | 6 ++-- docs/docs.json | 4 +-- docs/servers/auth/bearer.mdx | 8 +++-- docs/servers/composition.mdx | 2 +- docs/servers/fastmcp.mdx | 30 ++----------------- src/fastmcp/client/auth/oauth.py | 3 -- .../server/auth/providers/in_memory.py | 7 +---- tests/server/test_auth_integration.py | 2 +- 10 files changed, 29 insertions(+), 48 deletions(-) diff --git a/README.md b/README.md index d2e5ee1a7..c2552c910 100644 --- a/README.md +++ b/README.md @@ -74,6 +74,7 @@ There are two ways to access the LLM-friendly documentation: - [Proxy Servers](#proxy-servers) - [Composing MCP Servers](#composing-mcp-servers) - [OpenAPI \& FastAPI Generation](#openapi--fastapi-generation) + - [Authentication \& Security](#authentication--security) - [Running Your Server](#running-your-server) - [Contributing](#contributing) - [Prerequisites](#prerequisites) @@ -127,7 +128,7 @@ These are the building blocks for creating MCP servers and clients with FastMCP. ### The `FastMCP` Server -The central object representing your MCP application. It holds your tools, resources, and prompts, manages connections, and can be configured with settings like [authentication providers](https://gofastmcp.com/servers/fastmcp#authentication). +The central object representing your MCP application. It holds your tools, resources, and prompts, manages connections, and can be configured with settings like authentication. ```python from fastmcp import FastMCP @@ -300,6 +301,16 @@ Automatically generate FastMCP servers from existing OpenAPI specifications (`Fa Learn more: [**OpenAPI Integration**](https://gofastmcp.com/patterns/openapi) | [**FastAPI Integration**](https://gofastmcp.com/patterns/fastapi). +### Authentication & Security + +FastMCP provides built-in authentication support to secure both your MCP servers and clients in production environments. Protect your server endpoints from unauthorized access and authenticate your clients against secured MCP servers using industry-standard protocols. + +- **Server Protection**: Secure your FastMCP server endpoints with configurable authentication providers +- **Client Authentication**: Connect to authenticated MCP servers with automatic credential management +- **Production Ready**: Support for common authentication patterns used in enterprise environments + +Learn more in the **Authentication Documentation** for [servers](https://gofastmcp.com/servers/auth) and [clients](https://gofastmcp.com/clients/auth). + ## Running Your Server The main way to run a FastMCP server is by calling the `run()` method on your server instance: diff --git a/docs/clients/auth/bearer.mdx b/docs/clients/auth/bearer.mdx index 4ad8103fb..ee8b66606 100644 --- a/docs/clients/auth/bearer.mdx +++ b/docs/clients/auth/bearer.mdx @@ -1,7 +1,7 @@ --- title: Bearer Token Authentication sidebarTitle: Bearer Auth -description: Authenticate your FastMCP client using pre-existing OAuth 2.0 Bearer tokens. +description: Authenticate your FastMCP client with a Bearer token. icon: key --- diff --git a/docs/clients/auth/oauth.mdx b/docs/clients/auth/oauth.mdx index e1973edce..36549237d 100644 --- a/docs/clients/auth/oauth.mdx +++ b/docs/clients/auth/oauth.mdx @@ -1,7 +1,7 @@ --- title: OAuth Authentication sidebarTitle: OAuth -description: Authenticate your FastMCP client with servers using the OAuth 2.0 Authorization Code Grant, including user interaction via a web browser. +description: Authenticate your FastMCP client via OAuth 2.1. icon: window --- @@ -13,7 +13,7 @@ import { VersionBadge } from "/snippets/version-badge.mdx" OAuth authentication is only relevant for HTTP-based transports and requires user interaction via a web browser. -When your FastMCP client needs to access an MCP server protected by OAuth 2.0, and the process requires user interaction (like logging in and granting consent), you should use the Authorization Code Flow. FastMCP provides the `fastmcp.client.auth.OAuth` helper to simplify this entire process. +When your FastMCP client needs to access an MCP server protected by OAuth 2.1, and the process requires user interaction (like logging in and granting consent), you should use the Authorization Code Flow. FastMCP provides the `fastmcp.client.auth.OAuth` helper to simplify this entire process. This flow is common for user-facing applications where the application acts on behalf of the user. @@ -35,7 +35,7 @@ async with Client("https://fastmcp.cloud/mcp", auth="oauth") as client: ### `OAuth` Helper -To fully configure the OAuth flow, use the `OAuth` helper and pass it to the `auth` parameter of the `Client` or transport instance. `OAuth` manages the complexities of the OAuth 2.0 Authorization Code Grant with PKCE (Proof Key for Code Exchange) for enhanced security, and implements the full `httpx.Auth` interface. +To fully configure the OAuth flow, use the `OAuth` helper and pass it to the `auth` parameter of the `Client` or transport instance. `OAuth` manages the complexities of the OAuth 2.1 Authorization Code Grant with PKCE (Proof Key for Code Exchange) for enhanced security, and implements the full `httpx.Auth` interface. ```python {2, 4, 6} from fastmcp import Client diff --git a/docs/docs.json b/docs/docs.json index 58e2aef19..fa5933534 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -93,8 +93,8 @@ "group": "Authentication", "icon": "user-shield", "pages": [ - "clients/auth/bearer", - "clients/auth/oauth" + "clients/auth/oauth", + "clients/auth/bearer" ] }, "clients/advanced-features" diff --git a/docs/servers/auth/bearer.mdx b/docs/servers/auth/bearer.mdx index 712c55518..c695c10e6 100644 --- a/docs/servers/auth/bearer.mdx +++ b/docs/servers/auth/bearer.mdx @@ -12,6 +12,10 @@ import { VersionBadge } from "/snippets/version-badge.mdx" Authentication and authorization are only relevant for HTTP-based transports. + +The [MCP specification](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization) requires servers to implement full OAuth 2.1 authorization flows with dynamic client registration, server metadata discovery, and complete token endpoints. FastMCP's Bearer Token authentication provides a simpler, more practical alternative by directly validating pre-issued JWT tokens—ideal for service-to-service communication and programmatic environments where full OAuth flows may be impractical, and in accordance with how the MCP ecosystem is pragmatically evolving. However, please note that since it doesn't implement the full OAuth 2.1 flow, this implementation does not strictly comply with the MCP specification. + + Bearer Token authentication is a common way to secure HTTP-based APIs. In this model, the client sends a token (usually a JSON Web Token or JWT) in the `Authorization` header with the "Bearer" scheme. The server then validates this token to grant or deny access. FastMCP supports Bearer Token authentication for its HTTP-based transports (`streamable-http` and `sse`), allowing you to protect your server from unauthorized access. @@ -32,7 +36,7 @@ This design allows you to integrate FastMCP servers into existing authentication To enable Bearer Token validation on your FastMCP server, use the `BearerAuthProvider` class. This provider validates incoming JWTs by verifying signatures, checking expiration, and optionally validating claims. -The `BearerAuthProvider` validates tokens; it does **not** issue them (or implement any part of an OAuth flow). You'll need to generate tokens separately, either using FastMCP utilities or an external Identity Provider (IdP) or OAuth 2.0 Authorization Server. +The `BearerAuthProvider` validates tokens; it does **not** issue them (or implement any part of an OAuth flow). You'll need to generate tokens separately, either using FastMCP utilities or an external Identity Provider (IdP) or OAuth 2.1 Authorization Server. ### Basic Setup @@ -100,7 +104,7 @@ JWKS is recommended for production as it supports automatic key rotation and mul For development and testing, FastMCP provides the `RSAKeyPair` utility class to generate tokens without needing an external OAuth provider. -The `RSAKeyPair` utility is intended for development and testing only. For production, use a proper OAuth 2.0 Authorization Server or Identity Provider. +The `RSAKeyPair` utility is intended for development and testing only. For production, use a proper OAuth 2.1 Authorization Server or Identity Provider. ### Basic Token Generation diff --git a/docs/servers/composition.mdx b/docs/servers/composition.mdx index 73b40affc..b1519b3f3 100644 --- a/docs/servers/composition.mdx +++ b/docs/servers/composition.mdx @@ -33,7 +33,7 @@ The choice of importing or mounting depends on your use case and requirements. ### Proxy Servers -FastMCP supports [MCP proxying](/patterns/proxy), which allows you to mirror a local or remote server in a local FastMCP instance. Proxies are fully compatible with both importing and mounting. +FastMCP supports [MCP proxying](/servers/proxy), which allows you to mirror a local or remote server in a local FastMCP instance. Proxies are fully compatible with both importing and mounting. diff --git a/docs/servers/fastmcp.mdx b/docs/servers/fastmcp.mdx index 02e13aa27..598d056b6 100644 --- a/docs/servers/fastmcp.mdx +++ b/docs/servers/fastmcp.mdx @@ -135,7 +135,7 @@ For detailed information on each transport, how to configure them (host, port, p FastMCP supports composing multiple servers together using `import_server` (static copy) and `mount` (live link). This allows you to organize large applications into modular components or reuse existing servers. -See the [Server Composition](/patterns/composition) guide for full details, best practices, and examples. +See the [Server Composition](/servers/composition) guide for full details, best practices, and examples. ```python # Example: Importing a subserver @@ -159,7 +159,7 @@ main.mount("sub", sub) FastMCP can act as a proxy for any MCP server (local or remote) using `FastMCP.as_proxy`, letting you bridge transports or add a frontend to existing servers. For example, you can expose a remote SSE server locally via stdio, or vice versa. -See the [Proxying Servers](/patterns/proxy) guide for details and advanced usage. +See the [Proxying Servers](/servers/proxy) guide for details and advanced usage. ```python from fastmcp import FastMCP, Client @@ -232,29 +232,3 @@ This customization is useful when you want to: If the serializer function raises an exception, the tool will fall back to the default JSON serialization to avoid breaking the server. - -## Authentication - - - -FastMCP supports OAuth 2.0 authentication, allowing servers to protect their tools and resources. This is configured by providing an `auth_server_provider` and `auth` settings during `FastMCP` initialization. - -```python -from fastmcp import FastMCP -from mcp.server.auth.settings import AuthSettings #, ... other auth imports -# from your_auth_implementation import MyOAuthServerProvider # Placeholder - -# Create a server with authentication (conceptual example) -# mcp = FastMCP( -# name="SecureApp", -# auth_server_provider=MyOAuthServerProvider(), -# auth=AuthSettings( -# issuer_url="https://myapp.com", -# # ... other OAuth settings ... -# required_scopes=["myscope"], -# ), -# ) -``` -Due to the low-level nature of the current MCP SDK's auth provider interface, detailed implementation is beyond a quick example. Refer to the [MCP SDK documentation](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization) for specifics on implementing an `OAuthAuthorizationServerProvider`. FastMCP integrates with this by passing the provider and settings to the underlying MCP server. - -A dedicated [Authentication guide](/deployment/authentication) will cover this in more detail once higher-level abstractions are available in FastMCP. diff --git a/src/fastmcp/client/auth/oauth.py b/src/fastmcp/client/auth/oauth.py index 43df9d442..e8d988c10 100644 --- a/src/fastmcp/client/auth/oauth.py +++ b/src/fastmcp/client/auth/oauth.py @@ -68,9 +68,6 @@ class ServerOAuthMetadata(_MCPServerOAuthMetadata): class OAuthClientProvider(_MCPOAuthClientProvider): """ OAuth client provider with more flexible OAuth metadata discovery. - - This subclass handles real-world OAuth servers that may not conform - strictly to the MCP OAuth specification but are still valid OAuth 2.0 servers. """ async def _discover_oauth_metadata( diff --git a/src/fastmcp/server/auth/providers/in_memory.py b/src/fastmcp/server/auth/providers/in_memory.py index 6494ef18b..941ecbc16 100644 --- a/src/fastmcp/server/auth/providers/in_memory.py +++ b/src/fastmcp/server/auth/providers/in_memory.py @@ -1,8 +1,3 @@ -""" -This is a simple in-memory OAuth provider for testing purposes. -It simulates the OAuth 2.0 flow locally without external calls. -""" - import secrets import time @@ -36,7 +31,7 @@ DEFAULT_REFRESH_TOKEN_EXPIRY_SECONDS = None # No expiry class InMemoryOAuthProvider(OAuthProvider): """ An in-memory OAuth provider for testing purposes. - It simulates the OAuth 2.0 flow locally without external calls. + It simulates the OAuth 2.1 flow locally without external calls. """ def __init__( diff --git a/tests/server/test_auth_integration.py b/tests/server/test_auth_integration.py index f64bd0843..0b6849264 100644 --- a/tests/server/test_auth_integration.py +++ b/tests/server/test_auth_integration.py @@ -342,7 +342,7 @@ async def tokens(test_client, registered_client, auth_code, pkce_challenge, requ class TestAuthEndpoints: async def test_metadata_endpoint(self, test_client: httpx.AsyncClient): - """Test the OAuth 2.0 metadata endpoint.""" + """Test the OAuth 2.1 metadata endpoint.""" print("Sending request to metadata endpoint") response = await test_client.get("/.well-known/oauth-authorization-server") print(f"Got response: {response.status_code}")