What is Securemcp Okta Gateway

The securemcp-okta-gateway is a gateway server that facilitates OAuth 2.0 Authorization Server and Resource Server functionalities, serving as a bridge between Model Context Protocol (MCP) clients and Okta authentication.

Use cases

Use cases include dynamic client registration, managing OAuth authorization flows, issuing tokens for secure API access, and acting as a reverse proxy for protected backend services.

How to use

To use securemcp-okta-gateway, clone the repository, build the server using Go, configure the proxy routes in ‘config.yaml’, set the necessary environment variables, and start the server using the command ‘./securemcp-okta-gateway’.

Key features

Key features include OAuth 2.0 Authorization Server endpoints, Okta integration for user authentication, secure token issuance and validation, reverse proxy for backend services, health check endpoint, configurable settings via YAML and environment variables, Redis-based session and token storage, and structured logging.

Where to use

securemcp-okta-gateway can be used in applications requiring secure authentication and authorization, particularly in environments utilizing the Model Context Protocol (MCP) and Okta for user management.

Secure MCP Okta Gateway

Overview

Secure MCP Okta Gateway is a gateway server that provides OAuth 2.0 Authorization Server and Resource Server functionalities, acting as a bridge between Model Context Protocol (MCP) clients and Okta authentication. It supports dynamic client registration, authorization, token issuance, and proxying requests to backend services, all while enforcing secure authentication and authorization flows.

Features

• OAuth 2.0 Authorization Server endpoints (dynamic client registration, authorization, token, etc.)
• Okta integration for user authentication
• Secure token issuance and validation
• Reverse proxy for protected backend services
• Health check endpoint
• Configurable via YAML and environment variables
• Redis-based session and token storage
• Structured logging

Requirements

• Go 1.24 or later
• Redis server

Installation

git clone https://github.com/securemcp/securemcp-okta-gateway.git
cd securemcp-okta-gateway
go build -o securemcp-okta-gateway

Configuration

Edit config.yaml to define proxy routes:

proxies:
  - pattern: "/mcp/dice/"
    target_url: "http://localhost:3000"
  - pattern: "/mcp/uuid/"
    target_url: "http://localhost:4000"

Set environment variables as needed (see .env.sample for examples):

• KVS_ADDR: Redis address (e.g., localhost:6379)
• KVS_PASSWORD: Redis password
• PORT: Port to run the server (default: 8080)
• OKTA_URL, OKTA_CLIENT_ID, OKTA_CLIENT_SECRET, OKTA_REDIRECT_URI: Okta OAuth settings

Usage

Start the server:

./securemcp-okta-gateway

Endpoints

• GET /healthz — Health check
• POST /auth/register — Dynamic client registration
• GET /auth/authorize — OAuth authorization endpoint
• GET /auth/callback — OAuth callback endpoint
• POST /auth/token — Token issuance endpoint
• GET /.well-known/oauth-authorization-server — Authorization server metadata
• GET /.well-known/oauth-protected-resource — Resource server metadata
• Proxy endpoints as defined in config.yaml (e.g., /mcp/dice/, /mcp/uuid/)

MCP Clients

Cursor MCP Clients

License

MIT License

References

• MCP Authorization Specification
• MCP GitHub Specification