hono-oauth

This MCP server implements Hono-based authentication against any MCP-compliant OAuth2 server. It can be deployed across Supabase Edge Functions, Cloudflare Workers, and Deno Deploy, allowing you to integrate OAuth-based authentication into MCP workflows in your edge environments. When running in Supabase Edge Functions, the server can auto-derive the AUTH_SERVER_URL from the available SUPABASE_URL; for Cloudflare Workers and Deno Deploy you must provide AUTH_SERVER_URL as an environment variable. Use the server to issue MCP-compliant authentication metadata and protections for OAuth-protected resources, enabling consistent, interoperable access control across your MCP ecosystem.

Prerequisites:

• Node.js (recommended for local development) or a deployment target compatible with the chosen environment (Supabase Edge Functions, Cloudflare Workers, or Deno Deploy).
• Access to the MCP server repository and its dependencies.

Installation steps (example for Node-based development):

1. Install dependencies

   • npm install or pnpm install

2. Configure environment variables (example for local testing)

   • Create a .env file with: AUTH_SERVER_URL=https://your-auth-server.example.com/auth/v1 (If deploying to Supabase Edge Functions, SUPABASE_URL should be set in the environment to auto-derive AUTH_SERVER_URL.)

3. Run the server locally (development placeholder)

   • node path/to/server.js

Deployment options:

• Supabase Edge Functions: follow Supabase deployment steps and ensure SUPABASE_URL is available in the environment to auto-construct AUTH_SERVER_URL.
• Cloudflare Workers: use the Cloudflare deployment workflow (pnpm cloudflare:dev / pnpm cloudflare:deploy) as documented in the README.
• Deno Deploy: use Deno deployment steps (deno deploy commands or pnpm deno:deploy) as documented in the README.

Tips:

• Be mindful of the MCP Inspector compatibility issue noted in the README. The inspector may not properly handle certain WWW-Authenticate headers or resource_metadata paths, which can affect metadata discovery on uncommon OAuth endpoints.
• For Supabase Edge Functions deployments, you do not need to manually set AUTH_SERVER_URL if SUPABASE_URL is present; the server will auto-derive the value.
• If you run into authentication flow issues, verify that AUTH_SERVER_URL is reachable from the deployment environment and that CORS or resource metadata handling aligns with the OAuth server you are using.
• When deploying across multiple environments, ensure environment variable provisioning matches each target (e.g., SUPABASE_URL for Supabase, AUTH_SERVER_URL for Cloudflare/Deno).