Add OAuth 2.1 authorization server with DPoP support and MCP HTTP integration

- Implement zero-dependency-core OAuth 2.1 server: JWT (HMAC-SHA256),
  PKCE S256, authorization code flow, Bearer token validation, client
  registration, and token introspection
- Add optional DPoP proof-of-possession via the cryptography library
  (ES256/RS256 asymmetric signatures)
- Extend MCP HTTP server with OAuth endpoints (/authorize, /token,
  /.well-known/oauth-authorization-server) and DPoP-bound resource
  access
- Add CLI flags: --oauth-issuer, --oauth-signing-key, --oauth-client,
  --oauth-token-ttl
- Add pyproject.toml [oauth] extra with cryptography dependency

Author: johnteee

pyproject.toml

@@ -14,9 +14,13 @@ graphqlite = [
     "graphqlite>=0.4.4",
     "pysqlite3>=0.6.0",
 ]
+oauth = [
+    "cryptography>=3.4",
+]
 dev = [
     "graphqlite>=0.4.4",
     "pysqlite3>=0.6.0",
+    "cryptography>=3.4",
     "pytest>=7",
     "pytest-cov>=4",
     "ruff>=0.4",

teaagent/__init__.py

@@ -45,6 +45,25 @@
 from teaagent.mcp_server import handle_mcp_request, serve_mcp_stdio
 from teaagent.memory import MemoryCatalog, MemoryEntry
 from teaagent.model_routing import ModelRoute, classify_task, route_model
+from teaagent.oauth21 import (
+    HAS_CRYPTOGRAPHY,
+    DPoPValidationResult,
+    InvalidClientError,
+    InvalidDPoPError,
+    InvalidGrantError,
+    JWTError,
+    OAuth21AuthorizationServer,
+    OAuth21Client,
+    OAuth21ResourceServer,
+    OAuth21TokenClaims,
+    OAuth21TokenResponse,
+    compute_jwk_thumbprint,
+    compute_s256_challenge,
+    create_jwt,
+    decode_jwt_unsafe,
+    generate_code_verifier,
+    verify_jwt,
+)
 from teaagent.policy import ApprovalPolicy, PermissionMode, parse_permission_mode
 from teaagent.portability import (
     PortabilityResult,
@@ -140,6 +159,23 @@
     'build_aibom',
     'build_mcp_http_server',
     'build_task_spec',
+    'HAS_CRYPTOGRAPHY',
+    'DPoPValidationResult',
+    'InvalidClientError',
+    'InvalidDPoPError',
+    'InvalidGrantError',
+    'JWTError',
+    'OAuth21AuthorizationServer',
+    'OAuth21Client',
+    'OAuth21ResourceServer',
+    'OAuth21TokenClaims',
+    'OAuth21TokenResponse',
+    'compute_jwk_thumbprint',
+    'compute_s256_challenge',
+    'create_jwt',
+    'decode_jwt_unsafe',
+    'generate_code_verifier',
+    'verify_jwt',
     'build_workspace_tool_registry',
     'check_graphqlite_runtime',
     'check_llm_configuration',

teaagent/cli.py

@@ -499,6 +499,30 @@ def build_parser() -> argparse.ArgumentParser:
         default=[],
         help='Permit this Origin header. Can be repeated. Default: allow all origins.',
     )
+    mcp_serve.add_argument(
+        '--oauth-issuer',
+        default=None,
+        help='Enable OAuth 2.1 / DPoP. Issuer URL (e.g. https://mcp.example.com).',
+    )
+    mcp_serve.add_argument(
+        '--oauth-signing-key',
+        default=None,
+        help='HMAC signing key for JWT access tokens (min 16 chars).',
+    )
+    mcp_serve.add_argument(
+        '--oauth-client',
+        action='append',
+        default=[],
+        metavar='ID:SECRET:REDIRECT_URI',
+        help='Pre-register an OAuth client. Format: client_id:client_secret:redirect_uri. '
+        'Can be repeated.',
+    )
+    mcp_serve.add_argument(
+        '--oauth-token-ttl',
+        type=int,
+        default=3600,
+        help='Access token TTL in seconds. Default 3600.',
+    )
     mcp_serve.set_defaults(func=mcp_serve_command)
 
     workspace = subparsers.add_parser('workspace', help='Inspect workspace tool pack.')
@@ -831,14 +855,39 @@ def ultrawork_stop_command(args: argparse.Namespace) -> int:
 
 
 def mcp_serve_command(args: argparse.Namespace) -> int:
+    from teaagent.oauth21 import OAuth21AuthorizationServer
+
     registry = build_workspace_tool_registry(args.root)
     if args.http:
+        oauth_server = None
+        if args.oauth_issuer and args.oauth_signing_key:
+            oauth_server = OAuth21AuthorizationServer(
+                signing_key=args.oauth_signing_key,
+                issuer=args.oauth_issuer,
+                token_ttl=args.oauth_token_ttl,
+            )
+            for spec in args.oauth_client or []:
+                parts = spec.split(':', 2)
+                if len(parts) != 3:
+                    print(
+                        f'Invalid --oauth-client format: {spec} (expected ID:SECRET:REDIRECT_URI)',
+                        file=sys.stderr,
+                    )
+                    return 1
+                oauth_server.register_client(*parts)
+        elif args.oauth_issuer or args.oauth_signing_key:
+            print(
+                'Both --oauth-issuer and --oauth-signing-key must be provided to enable OAuth.',
+                file=sys.stderr,
+            )
+            return 1
         return serve_mcp_http(
             registry,
             host=args.host,
             port=args.port,
             auth_token=args.auth_token,
             allowed_origins=args.allowed_origin or None,
+            oauth_server=oauth_server,
         )
     return serve_mcp_stdio(registry)