How can we add Authentication And Authorization in MCP?

[taimurlak]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

How can we add Authentication And Authorization in MCP, just like we add in our API, this make our api authorize and give us the identity of user, how can we do same thing with MCP in dotnet

[alefcarlos]

I tried the default Authentication boilerplate:

Program.cs

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSingleton<MonkeyService>();
builder.Services.AddSingleton<VoyagesService>();

builder.Services.AddAuthorization();
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer();

builder.Services
    .AddMcpServer()
    //.WithStdioServerTransport()
    .WithToolsFromAssembly();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.MapMcp();

await app.RunAsync();

Tool.cs

    [McpServerTool, Description("It prints Hello World!")]
    [Authorize]
    public static string HelloWorld() => "Hello World!";

but it doesnt work, I think the authentication framework is not yet supported

[taimurlak]

Yes maybe, i am also waiting to find a good solution for authentication and authorizations.

[coronabytes]

While custom bearer auth works. I cant find a way to access the ClaimsPrincipal or even just the userId inside the tool call

Update: Got it, however pls support this natively, maybe by accrpting ClaimsPrincial as param?

[McpServerToolType]
public static class EchoTool
{
    [McpServerTool(ReadOnly = true), Description("Echoes the message back to the client.")]
    public static async Task<string> Echo(IHttpContextAccessor accessor, string message)
    {
        var userId = accessor.HttpContext?.User.Claims.SingleOrDefault(x => x.Type == ClaimTypes.NameIdentifier)?.Value;

        return $"hello {message}";
    }
}

[basimchowdhury98]

@coronabytes How are you using the IHttpContextAccessor in the tool? When I try to use it the httpcontext inside is null. Seems like the tool is on a different scope than the http call itself.

[jason-lee-x]

I think RunSessionHandler may works

.WithHttpTransport(options =>
{
    options.RunSessionHandler = async (context, server, cancellationToken) =>
    {
        if (context.Request.Headers.TryGetValue("Authorization", out var token))
        {
            // TODO: atuh token

            // run
            await server.RunAsync(cancellationToken);
        }
    };
})

[GilEliyahu23]

I figure it out

using Microsoft.AspNetCore.Http;

namespace Company.Product.Mcp.Server.Authentication;

public class AuthorizationMiddleware
{
    private readonly RequestDelegate _next;

    public AuthorizationMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        string token = GetToken(context);

        if (!ValidateToken(token))
        {
            context.Response.StatusCode = StatusCodes.Status401Unauthorized;
            await context.Response.WriteAsync("Invalid or missing token.");
            return;
        }
        
        await _next(context); // Token is present, continue
    }


    private string GetToken(HttpContext context)
    {
        if (!context.Request.Headers.TryGetValue("Authorization", out var tokenValue))
        {
            return null;
        }
        
        var token = tokenValue.ToString();

        // TODO: Remove this.. MCP Inspector v0.14.3 does not have options to send tokens without "Bearer " prefix:
        // https://github.com/modelcontextprotocol/inspector/issues/249
        // I use it as a workaround to be able to test the MCP server with the Inspector.
        token = token.Replace("Bearer ", string.Empty, StringComparison.OrdinalIgnoreCase);

        return token;
    }

    private bool ValidateToken(string token)
    {
        // TODO Logic to validate the token
        return false;
    }
}

    app.UseMiddleware<AuthorizationMiddleware>();