🚀 FastAPI GitHub OAuth2 Proxy for MCP

This project is a lightweight OAuth2 proxy server built with FastAPI that authenticates users via GitHub, issues JWTs, and provides an MCP-compatible interface for tool usage and secure messaging.

It supports:

• GitHub OAuth2 login
• MCP-compatible authorization metadata
• JWT issuance for downstream API access
• Protected API routes using Bearer tokens
• GitHub repository listing per authenticated user

---

📦 Features

• 🔐 GitHub OAuth2 login with PKCE + client secret support
• ✅ Dynamic client registration endpoint (/oauth/register)
• ⚒ OAuth server metadata at /.well-known/oauth-authorization-server
• 🗒 JWT issuance using python-jose (or compatible) for user identification
• 🔒 Protected API routes (/api/protected, /api/repos)
• 🌐 MCP-compatible authorization flow via fastapi_mcp

---

🧰 Requirements

• Python 3.9+
• GitHub OAuth App (Client ID + Secret)
• .env file configured (see below)

Install dependencies:

pip install -r requirements.txt

---

📂 .env Configuration

create an Oauth App on GitHub and provide the following in the .env file.

GITHUB_CLIENT_ID=your_github_client_id
GITHUB_CLIENT_SECRET=your_github_client_secret

---

⚒ Usage

python main.py

Use the MCP inspector connect to the server.

npx @modelcontextprotocol/inspector

http://localhost:8000/mcp

This will initiate the full GitHub OAuth2 login flow through MCP Inspector.

---

🔐 OAuth2 Endpoints

Endpoint	Purpose
/authorize	Redirects to GitHub for login
/callback	Handles GitHub OAuth2 redirect + token
/oauth/register	Fake dynamic client registration
/.well-known/oauth-authorization-server	OAuth2 metadata (for MCP Inspector)

---

🥪 API Routes

Method	Path	Auth Required	Description
GET	/api/public	❌ No	Public test route
GET	/api/protected	✅ Yes	Protected route showing user info
GET	/api/repos	✅ Yes	List GitHub repos for logged-in user

Use the JWT returned by /callback like this:

Authorization: Bearer <your_token>

---

🧠 Developer Notes

• Tokens and user data are stored in-memory (tokens_db).
• Replace in-memory storage with a DB (e.g. Redis/Postgres) for production use.
• Supports full CORS for localhost development tools like MCP Inspector.

---

🛄 MCP Integration

This server is compatible with the Model Context Protocol (MCP) and can be used as a remote authorization server. Clients can connect via:

{
  "authorization_endpoint": "/authorize",
  "token_endpoint": "/callback",
  "registration_endpoint": "/oauth/register"
}

Test it using the MCP Inspector and point it to your local server:

http://localhost:8000/mcp

---

📚 TODO / Enhancements

• 🔄 Support for refresh tokens
• 🔐 Encrypted GitHub token storage
• 📁 Per-user repo caching
• 🔐 Allow access only for pre-approved GitHub usernames