README.md

MCP Server Example

The code in this directory provides a working example of using tsidp with an MCP server that requires authentication. To run this example you’ll need to do the following:

1) Ensure tsidp is running or start it

If running via docker, it should look like this:

docker run -d \
  --name tsidp \
  -p 443:443 \
  -e TS_AUTHKEY=YOUR_TAILSCALE_AUTHKEY \
  -e TSNET_FORCE_LOGIN=1
  -e TAILSCALE_USE_WIP_CODE=1 \
  -v tsidp-data:/var/lib/tsidp \
  tsidp --hostname=idp --dir=/var/lib/tsidp

2) Update the ACL rules on your tailnet

MCP requires the use of resource indicators, so you’ll also need to add an ACL application grant rule to your tailnet that allows a given user and / or device the ability to specify resources in their request. The following rule is extra permissive for this demo, but it allows anyone from any device on the tailnet to exchange tokens to request any resource. If you’d like to make it more specific, you can change “*” in resources to http://localhost:9933.

{
  "src": ["*"],
  "dst": ["*"],
  "app": {
    "tailscale.com/cap/tsidp": [
      {
        "users":     ["*"],
        "resources": ["*"],
      },
    ],
  },
},

3) Start the MCP server example

In a new terminal run the MCP server using the following command. It should start on localhost port 9933.

go run ./mcp-server.go --tsidp idp.YOUR_TAILNET.ts.net

4) Start the MCP inspector

To test the server we’ll use the MCP inspector provided directly by the MCP project. As of 2025/09/13, there appears to be a bug in the latest version of the inspector, so we’ll use an earlier version.

npx @modelcontextprotocol/inspector@0.16.3

5) Go through the authorization flow

1. Change the transport type to Streamable HTTP
2. Update the URL to http://localhost:9933
3. Click on Open Auth Settings
4. Click on Quick OAuth Flow and you should see all green checks.

6) Connect to the server and make a tool call

1. Click Connect
2. Click List tools
3. Call a tool