Bearer Token Verification Middleware

[ardaguclu]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

Our MCP Server is implemented in Go and we are planning to migrate to this SDK soon. We had to implement all authentication/authorization logic from scratch and I'm wondering there are any plans to provide built-in authentication middlewares that seem to exist in other SDKs?;

• typescript https://github.com/modelcontextprotocol/typescript-sdk/blob/main/src/server/auth/middleware/bearerAuth.ts
• python https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/auth/middleware/bearer_auth.py

As far as I understand, if this is provided, once MCP Server owners define token verification mechanism as suggested in #174 (comment), the rest will be handled by SDK. That would drastically simplify the MCP Server implementations.

[ardaguclu]

Please let me know if this is appropriate more as an issue.

[jba]

Please do. I was going to do it myself, but then I would be the issue creator.

[ardaguclu]

Opened #246

[jba]

We do intend to provide this. We are currently designing it.

[jba]

We had to implement all authentication/authorization logic from scratch

It would be very helpful if you could share your implementation.

[ardaguclu]

We are wiring authorization middleware in https://github.com/containers/kubernetes-mcp-server/blob/94b85990e3654713ce0839e908c3bbd1f043a388/pkg/http/http.go#L30-L43. This is the implementation of middleware https://github.com/containers/kubernetes-mcp-server/blob/94b85990e3654713ce0839e908c3bbd1f043a388/pkg/http/authorization.go#L22.

[jba]

Is there any particular reason this has to be middleware? What if there were a server option that was a token verify function? It would take a bearer token and return authentication info or an error. Our streamable transport could inspect the error and send a response with the appropriate resource URL, or pass on the auth info to request handlers.

[ardaguclu]

That would nicely work too. Thank you for your reply. Besides, I believe that this would be simpler than middleware.