MCP

from mcp.server.fastmcp import FastMCP
from keycardai.mcp.server.auth import AuthProvider

mcp = FastMCP("Hello World Server")
auth_provider = AuthProvider(
    zone_id="your-zone-id",
    mcp_server_name="Hello World Server",
    mcp_server_url="http://localhost:8000/",
)

@mcp.tool()
async def hello() -> str:
    return "Hello from a protected MCP server!"

# Wrap the MCP app with authentication
app = auth_provider.app(mcp)

import express from "express";
import { mcpAuthMetadataRouter } from "@keycardai/mcp/server/auth/router";
import { requireBearerAuth } from "@keycardai/mcp/server/auth/middleware/bearerAuth";

const ZONE_URL = process.env.KEYCARD_ZONE_URL!;
const app = express();

// Serve OAuth metadata
app.use(
  mcpAuthMetadataRouter({
    oauthMetadata: { issuer: ZONE_URL },
    scopesSupported: ["mcp:tools"],
    resourceName: "Hello World MCP Server",
  }),
);

// Protect routes with bearer token verification. `issuers` is required.
// It pins the verifier to your zone so forged tokens from any other
// issuer are rejected before any JWKS lookup.
app.use(
  "/api",
  requireBearerAuth({
    issuers: ZONE_URL,
    requiredScopes: ["mcp:tools"],
  }),
);

app.get("/api/whoami", (req, res) => {
  res.json({ message: "Hello from a protected MCP server!" });
});

app.listen(8000);

package main

import (
    "context"
    "fmt"
    "log"
    "os"

    "github.com/keycardai/credentials-go/mcp"
    mcpgo "github.com/mark3labs/mcp-go/mcp"
    "github.com/mark3labs/mcp-go/server"
)

func main() {
    zoneURL := os.Getenv("KEYCARD_ZONE_URL")

    // Create MCP server with your preferred library
    s := server.NewMCPServer("Hello World Server", "1.0.0")
    s.AddTool(
        mcpgo.NewTool("hello",
            mcpgo.WithDescription("Say hello."),
            mcpgo.WithString("name", mcpgo.Required()),
        ),
        func(ctx context.Context, req mcpgo.CallToolRequest) (*mcpgo.CallToolResult, error) {
            name, _ := req.GetArguments()["name"].(string)
            authInfo := mcp.AuthInfoFromContext(ctx)
            return mcpgo.NewToolResultText(
                fmt.Sprintf("Hello, %s! Client: %s", name, authInfo.ClientID),
            ), nil
        },
    )

    // Mount Keycard auth on your own mux
    httpMux := http.NewServeMux()
    httpMux.Handle("/.well-known/", mcp.AuthMetadataHandler(
        mcp.WithIssuer(zoneURL),
        mcp.WithScopesSupported([]string{"mcp:tools"}),
        mcp.WithResourceName("Hello World Server"),
    ))
    httpMux.Handle("/mcp", mcp.RequireBearerAuth(
        mcp.WithRequiredScopes("mcp:tools"),
    )(server.NewStreamableHTTPServer(s)))

    log.Fatal(http.ListenAndServe(":8080", httpMux))
}

import httpx
from mcp.server.fastmcp import FastMCP
from keycardai.mcp.server.auth import AuthProvider, AccessContext, ClientSecret

auth_provider = AuthProvider(
    zone_id="your-zone-id",
    mcp_server_name="GitHub Server",
    mcp_server_url="http://localhost:8000/",
    application_credential=ClientSecret(("client_id", "client_secret")),
)

mcp = FastMCP("GitHub Server")

@mcp.tool()
@auth_provider.grant("https://api.github.com")
async def get_repos(ctx) -> dict:
    access_context: AccessContext = await ctx.get_state("keycardai")

    if access_context.has_errors():
        return {"error": access_context.get_errors()}

    token = access_context.access("https://api.github.com").access_token
    async with httpx.AsyncClient() as client:
        resp = await client.get(
            "https://api.github.com/user/repos",
            headers={"Authorization": f"Bearer {token}"},
        )
        return resp.json()

app = auth_provider.app(mcp)

import express from "express";
import { AuthProvider } from "@keycardai/mcp/server/auth/provider";
import { ClientSecret } from "@keycardai/mcp/server/auth/credentials";
import type { DelegatedRequest } from "@keycardai/mcp/server/auth/provider";

const authProvider = new AuthProvider({
  zoneUrl: process.env.KEYCARD_ZONE_URL!,
  applicationCredential: new ClientSecret(
    process.env.KEYCARD_CLIENT_ID!,
    process.env.KEYCARD_CLIENT_SECRET!,
  ),
});

const app = express();

app.get(
  "/api/repos",
  authProvider.grant("https://api.github.com"),
  async (req, res) => {
    const { accessContext } = req as DelegatedRequest;

    if (accessContext.hasErrors()) {
      res.status(502).json({ error: accessContext.getErrors() });
      return;
    }

    const token = accessContext.access("https://api.github.com").accessToken;
    const resp = await fetch("https://api.github.com/user/repos", {
      headers: { Authorization: `Bearer ${token}` },
    });
    res.json(await resp.json());
  },
);

app.listen(8000);

package main

import (
    "context"
    "io"
    "log"
    "net/http"
    "os"

    "github.com/keycardai/credentials-go/mcp"
    mcpgo "github.com/mark3labs/mcp-go/mcp"
    "github.com/mark3labs/mcp-go/server"
)

func main() {
    s := server.NewMCPServer("GitHub Server", "1.0.0")
    s.AddTool(
        mcpgo.NewTool("get_repos", mcpgo.WithDescription("List user repos")),
        func(ctx context.Context, req mcpgo.CallToolRequest) (*mcpgo.CallToolResult, error) {
            ac := mcp.AccessContextFromContext(ctx)
            if ac.HasErrors() {
                return mcpgo.NewToolResultError("Token exchange failed"), nil
            }

            token, _ := ac.Access("https://api.github.com")
            ghReq, _ := http.NewRequestWithContext(ctx, "GET",
                "https://api.github.com/user/repos", nil)
            ghReq.Header.Set("Authorization", "Bearer "+token.AccessToken)

            resp, _ := http.DefaultClient.Do(ghReq)
            defer resp.Body.Close()
            body, _ := io.ReadAll(resp.Body)
            return mcpgo.NewToolResultText(string(body)), nil
        },
    )

    // Set up auth provider for token exchange
    authProvider, _ := mcp.NewAuthProvider(
        mcp.WithZoneURL(os.Getenv("KEYCARD_ZONE_URL")),
        mcp.WithApplicationCredential(mcp.NewClientSecret(
            os.Getenv("KEYCARD_CLIENT_ID"),
            os.Getenv("KEYCARD_CLIENT_SECRET"),
        )),
    )

    httpMux := http.NewServeMux()
    httpMux.Handle("/.well-known/", mcp.AuthMetadataHandler(
        mcp.WithIssuer(os.Getenv("KEYCARD_ZONE_URL")),
        mcp.WithScopesSupported([]string{"mcp:tools"}),
        mcp.WithResourceName("GitHub Server"),
    ))
    httpMux.Handle("/mcp", mcp.RequireBearerAuth(
        mcp.WithRequiredScopes("mcp:tools"),
    )(authProvider.Grant("https://api.github.com")(
        server.NewStreamableHTTPServer(s),
    )))

    log.Fatal(http.ListenAndServe(":8080", httpMux))
}