sample-multi-tenant-saas

This MCP server implements a multi-tenant remote MCP server using a secure, RFC-compliant OpenID Connect flow for authentication and authorization. It supports dynamic client registration and per-tenant data isolation leveraging AWS services such as Cognito for identity, DynamoDB for metadata and resource state, and S3 for storage. The server exposes an OpenID configuration endpoint to advertise its registration capabilities and supports RFC 9728 protected metadata resources. To use it, deploy the server and connect MCP clients (for example, an AWS Bedrock-based client UI) to the server’s endpoint. Tenants will authenticate via Cognito, obtain access tokens, and the server will enforce multi-tenant isolation and authorization policies per tenant. The included client UI demonstrates remote MCP server management, OAuth integration, and real-time MCP tools, resources, and prompts, enabling operators to register and manage multiple MCP servers from a single interface.

Prerequisites:

• Node.js v14+ and npm
• AWS credentials configured (for deployment and AWS service access if using AWS resources)
• Git

Install and run:

1. Clone the repository git clone <repository-url> cd sample-multi-tenant-saas

2. Install server dependencies cd mcp_server npm install

3. Configure environment Create or update a .env file or set environment variables as shown in the mcp_config section. Required values include Cognito user pool details, region, and data store identifiers.

4. Start the MCP server (local development) node mcp_server/server.js

5. Optional deployment (infra) cd mcp_server/infra npm install ./deploy.sh

Note: If your deployment uses Docker, adapt the command to run the container with the same environment variables. The Quick Start mentions an infra deployment script, so ensure your CI/CD or deployment target has the required AWS permissions and network configuration.

Tips and considerations:

• Ensure Cognito user pool configuration aligns with your tenant provisioning flow (multi-tenant authentication and authorization via OAuth 2.1).
• Use RFC 7591 for dynamic client registration and RFC 8414 for the OpenID configuration discovery endpoint.
• The server relies on per-tenant isolation in DynamoDB and S3; verify IAM roles and bucket policies for restricted access.
• Monitor logs and enable appropriate observability (CloudWatch, X-Ray, or your preferred logging solution).
• When developing or testing locally, keep environment variables in a secure, non-committed store and use separate environments for development, staging, and production.
• If you encounter issues with token validation, verify that the JWT_SIGNING_KEY and COGNITO configuration are in sync with the Cognito setup.