Skip to content
@AuthPlane

AuthPlane

Open-source OAuth 2.1 + MCP authorization, self-hosted.
README.md

Authplane

Open-source OAuth 2.1 + MCP authorization, self-hosted.

authserver Server: AGPL-3.0 SDKs: Apache-2.0 MCP Authorization 2026-07-28 Contact

An MCP client calls your MCP server; the Authplane SDK inside it verifies a token issued by authserver

Building an MCP server is a one-afternoon job. Securing it isn't — and Authplane is the one piece of infrastructure that does it, in three parts:

  • authserver — the authorization server. Issues audience-bound, DPoP-capable tokens; owns discovery, registration, login, consent, and agent-to-agent delegation. One Go binary, self-hosted.
  • The SDKs — five lines in your MCP server, in your language. Verify the token, serve Protected Resource Metadata, enforce scopes per tool.
  • The conformance catalog — the test suite both sides run against, so a server and an SDK written in different languages agree on every byte.

Repositories

Repo What it is Language Status License
authserver Self-hosted OAuth 2.1 + MCP Authorization server. One Go binary, embedded Admin UI, PostgreSQL + Vault-backed signing for production. Go v0.2.0 — MCP Authorization 2026-07-28 AGPL-3.0
go-sdk Resource-server SDK and OAuth client for Go. Adapters for the official MCP Go SDK, mark3labs/mcp-go, and net/http. Go v0.3.0 Apache-2.0
ts-sdk Resource-server SDK and OAuth client for TypeScript. Adapters for the official MCP TS SDK, FastMCP, Hono, and NestJS. TypeScript v0.4.0 Apache-2.0
python-sdk Resource-server SDK and OAuth client for Python. Adapters for the official MCP Python SDK and FastMCP. Python v0.4.0 Apache-2.0
java-sdk Resource-server SDK and OAuth client for Java. Adapters for the official MCP Java SDK and Spring Boot / Spring Security. On Maven Central as ai.authplane.sdk. Java v0.2.0 Apache-2.0
cs-sdk Resource-server SDK and OAuth client for C# / .NET. Adapter for the official MCP C# SDK on ASP.NET Core. On NuGet as Authplane.Sdk / Authplane.Mcp. C# v0.1.0 Apache-2.0
conformance Language-neutral YAML catalog of OAuth 2.1 conformance cases. Every SDK runs it; every assertion traces back to a catalog case. YAML / Python tooling Active Apache-2.0

On the roadmap: a Rust SDK. Talk to us if you need it sooner.

What every SDK gives you

A consistent baseline across Go, TypeScript, Python, Java, and C# — so your MCP server validates tokens, exposes discovery, and enforces consent the same way regardless of stack:

  • JWT validation against the authserver JWKS, with caching
  • Per-route / per-tool scope enforcement
  • The /.well-known/oauth-protected-resource endpoint (PRM, RFC 9728)
  • DPoP proof verification (RFC 9449)
  • A full OAuth client — Client Credentials, Token Exchange (RFC 8693), Introspection, Revocation
  • Structured ConsentRequiredError decoding for the upstream-provider broker flow

Standards in scope

Authplane implements the MCP Authorization specification (2026-07-28) — Client ID Metadata Documents on by default, RFC 9207 iss on every authorization response, Protected Resource Metadata served by the AS, and the stable Enterprise-Managed Authorization discovery — plus the OAuth 2.1 ecosystem behind it. Full inventory:

OAuth 2.1 · PKCE (RFC 7636) · DPoP (RFC 9449) · Resource Indicators (RFC 8707) · Protected Resource Metadata (RFC 9728) · Issuer Identification (RFC 9207) · Dynamic Client Registration (RFC 7591) · CIMD · AS Metadata (RFC 8414) + OIDC Discovery · Token Exchange (RFC 8693) · JWT Bearer (RFC 7523) · JWT Access Tokens (RFC 9068) · Introspection (RFC 7662) · Revocation (RFC 7009)

The conformance catalog is the source of truth.

Try it in 60 seconds

export AUTHPLANE_ADMIN_API_KEY="$(openssl rand -hex 32)"
export AUTHPLANE_SESSION_SECRET="$(openssl rand -hex 32)"

docker run -p 9000:9000 -p 9001:9001 \
  -e AUTHPLANE_ADMIN_API_KEY \
  -e AUTHPLANE_SESSION_SECRET \
  -v authserver-data:/data \
  authplane/authserver:latest serve

Open http://localhost:9001/admin/ui/ and paste the printed API key. Then secure your MCP server with the Python MCP adapter — the Go, TypeScript, Java, and C# adapters follow the same pattern. Verified end to end with Claude Desktop, Claude Code, and MCP Inspector on v0.2.0: the client compatibility matrix records what each one sent.

Get involved

  • Issues & feature requests — file them on the repo that's closest to the problem; we triage across repos.
  • Security disclosures — please follow each repo's SECURITY.md.
  • Commercial / non-AGPL licensing — write to hello@authplane.ai.

License

  • authserver — AGPL-3.0-or-later
  • go-sdk, ts-sdk, python-sdk, java-sdk, cs-sdk, conformance — Apache-2.0

Need different terms for the server? Write to hello@authplane.ai.

Popular repositories Loading

  1. authserver authserver Public

    OAuth 2.1 Authorization Server for the Model Context Protocol (MCP)

    Go 57 2

  2. python-sdk python-sdk Public

    Python SDK for protecting MCP servers and OAuth 2.1 resource servers with tokens issued by the Authplane authorization server. Includes framework adapters (e.g. MCP, FastMCP).

    Python 11

  3. ts-sdk ts-sdk Public

    TypeScript SDK for protecting MCP servers and OAuth 2.1 resource servers with tokens issued by the Authplane authorization server. Includes framework adapters (e.g. MCP, FastMCP).

    TypeScript 7

  4. go-sdk go-sdk Public

    Go SDK for protecting MCP servers and OAuth 2.1 resource servers with tokens issued by the Authplane authorization server. Includes framework adapters (e.g. MCP, net/http).

    Go 6 1

  5. conformance conformance Public

    OAuth 2.1 / RFC 9728 / MCP authorization conformance catalog. Vendor-neutral test cases that the Authplane SDKs (and any third-party MCP auth library) run against to prove protocol compliance.

    Python 3 1

  6. .github .github Public

    AuthPlane public org profile

Repositories

Showing 10 of 14 repositories
  • .github Public

    AuthPlane public org profile

    AuthPlane/.github's past year of commit activity
    0 0 0 1 Updated Sep 15, 2026
  • authserver Public

    OAuth 2.1 Authorization Server for the Model Context Protocol (MCP)

    AuthPlane/authserver's past year of commit activity
    Go 57 AGPL-3.0 2 0 0 Updated Sep 15, 2026
  • cs-sdk Public

    C# / .NET SDK for protecting MCP servers and OAuth 2.1 resource servers with tokens issued by the Authplane authorization server. Includes framework adapters (e.g. MCP).

    AuthPlane/cs-sdk's past year of commit activity
    C# 0 Apache-2.0 0 0 12 Updated Sep 14, 2026
  • java-sdk Public

    Java SDK for protecting MCP servers and OAuth 2.1 resource servers with tokens issued by the Authplane authorization server. Includes framework adapters (e.g. MCP, Spring Security).

    AuthPlane/java-sdk's past year of commit activity
    Java 0 Apache-2.0 0 6 2 Updated Sep 14, 2026
  • mysql_mcp_server Public Forked from designcomputer/mysql_mcp_server

    A Model Context Protocol (MCP) server that enables secure interaction with MySQL databases

    AuthPlane/mysql_mcp_server's past year of commit activity
    Python 0 MIT 261 0 1 Updated Sep 8, 2026
  • ts-sdk Public

    TypeScript SDK for protecting MCP servers and OAuth 2.1 resource servers with tokens issued by the Authplane authorization server. Includes framework adapters (e.g. MCP, FastMCP).

    AuthPlane/ts-sdk's past year of commit activity
    TypeScript 7 Apache-2.0 0 0 12 Updated Sep 7, 2026
  • go-sdk Public

    Go SDK for protecting MCP servers and OAuth 2.1 resource servers with tokens issued by the Authplane authorization server. Includes framework adapters (e.g. MCP, net/http).

    AuthPlane/go-sdk's past year of commit activity
    Go 6 Apache-2.0 1 1 4 Updated Sep 7, 2026
  • python-sdk Public

    Python SDK for protecting MCP servers and OAuth 2.1 resource servers with tokens issued by the Authplane authorization server. Includes framework adapters (e.g. MCP, FastMCP).

    AuthPlane/python-sdk's past year of commit activity
    Python 11 Apache-2.0 0 0 2 Updated Sep 3, 2026
  • conformance Public

    OAuth 2.1 / RFC 9728 / MCP authorization conformance catalog. Vendor-neutral test cases that the Authplane SDKs (and any third-party MCP auth library) run against to prove protocol compliance.

    AuthPlane/conformance's past year of commit activity
    Python 3 Apache-2.0 1 2 0 Updated Aug 31, 2026
  • py-fastmcp Public Forked from PrefectHQ/fastmcp

    🚀 The fast, Pythonic way to build MCP servers and clients.

    AuthPlane/py-fastmcp's past year of commit activity
    Python 0 Apache-2.0 2,386 0 0 Updated Aug 27, 2026
View all repositories

People

This organization has no public members. You must be a member to see who’s a part of this organization.